tickmarkr 1.33.5 → 1.35.0

package/README.md

@@ -8,11 +8,15 @@ gates) only after independent verification. An **engagement** (`tickmarkr run`)
 into a task graph, routes work to the best installed agent CLI (claude-code, codex, cursor-agent,
 opencode, grok, pi) by cost within capability floors, dispatches **field teams** in isolated git
 worktrees — as real visible TUIs when running under [herdr](https://herdr.dev), headless
-subprocesses otherwise — and records every event in the **audit trail** (`.drovr/runs/<runId>/journal.jsonl`).
+subprocesses otherwise — and records every event in the **audit trail** (engagement state directory).
 Green tasks consolidate onto a `tickmarkr/<runId>` **consolidation** branch; **sign-off** (merge to
 your mainline) is always the Partner's call, never the engine's. A fully green engagement is an
 **unqualified opinion** — every assertion independently ticked.
 
+<!-- tickmarkr:compat-legacy BEGIN: sanctioned naming residue, unchanged pending shim spec -->
+**Legacy naming (unchanged):** tickmarkr reads existing state from `.drovr/` directories and resumes runs with legacy `drovr/<runId>` branch names recorded in their journals; new engagements write to `tickmarkr/<runId>`. Environment variables `DROVR_*` remain unchanged (e.g., `DROVR_FAKE_SCRIPT`, `DROVR_E2E`). Spec markers use the historical `<!-- drovr:spec -->` comment. These names are pending formalization in a future shim spec; no action required — existing runs and configurations remain fully compatible.
+<!-- tickmarkr:compat-legacy END -->
+
 > The package ships `tickmarkr` and `tkr` only; `tkr` is the short alias.
 
 ## Vocabulary
@@ -30,7 +34,7 @@ Audit voice in docs and reports maps to engine concepts exactly once:
 | assertion | Acceptance criterion (`acceptance[]` entry) |
 | tickmark | Passed gate |
 | audit evidence | Evidence gate (commits/diff exist) |
-| audit trail | Journal (`.drovr/runs/<runId>/journal.jsonl`) |
+| audit trail | Journal (engagement event ledger) |
 | the consolidation | Integration branch (`tickmarkr/<runId>`) |
 | sign-off / issuance | Merge consolidation branch to main |
 | unqualified opinion | Green engagement (all tasks merged) |
@@ -46,11 +50,11 @@ These are law; the codebase fails closed around them:
 
 - `acceptance[]` required on every task; compile fails without it
 - new engagements consolidate to a `tickmarkr/<runId>` branch — never main (resume of older
-  engagements keeps the branch names recorded in their journal, including legacy `drovr/<runId>`)
+  engagements keeps the branch names recorded in their journal)
 - gates never trust worker claims; tickmarkr verifies everything itself
-- state is files + git only (`.drovr/`); no DB, no services
+- state is files + git only; no DB, no services
 - worker/judge/review/consult prompts end with machine-parseable trailers
-  (`DROVR_RESULT` / JSON verdicts); parse defensively, fail closed
+  (structured JSON verdicts); parse defensively, fail closed
 
 Any agent (or human) operating this repo must respect the same five rules above — they are not
 merely internal implementation details, they are the contract the gates enforce.
@@ -86,9 +90,9 @@ at 30s.
 ## Quickstart (5 minutes)
 
 ```bash
-tickmarkr init                 # guided setup + doctor; scaffolds .drovr/config.yaml and tickmarkr.spec.md
-# edit tickmarkr.spec.md        # the native spec template, marked <!-- drovr:spec -->
-tickmarkr compile tickmarkr.spec.md # spec → .drovr/graph.json (fails without acceptance criteria)
+tickmarkr init                 # guided setup + doctor; scaffolds config and spec template
+# edit tickmarkr.spec.md        # the native spec template
+tickmarkr compile tickmarkr.spec.md # spec → engagement graph (fails without acceptance criteria)
 tickmarkr plan                 # dry-run routing table + cost estimate + floor lints
 tickmarkr run                  # execute the graph (--concurrency N --driver herdr|subprocess --route-strict)
 tickmarkr report <runId> --md  # engagement record in Markdown
@@ -170,7 +174,7 @@ cursor-agent and claude-code entirely.
 
 ## Model scoping and auth detection
 
-Each agent CLI exposes a list of available models. tickmarkr's routing works only with **classified** models — those you explicitly enter into `.drovr/config.yaml` under `tiers`. The `tickmarkr doctor` command probes these models to detect auth status and records the results in `.drovr/doctor.json`, which routing consumes to avoid 401/403 dispatch failures.
+Each agent CLI exposes a list of available models. tickmarkr's routing works only with **classified** models — those you explicitly enter into the config under `tiers`. The `tickmarkr doctor` command probes these models to detect auth status and records the results, which routing consumes to avoid 401/403 dispatch failures.
 
 **Model terminology**:
 
@@ -180,7 +184,7 @@ Each agent CLI exposes a list of available models. tickmarkr's routing works onl
 
 When you run `tickmarkr doctor`, it:
 1. Probes each classified model exactly once (one minimal headless API call per model per adapter)
-2. Records results in `.drovr/doctor.json`: `authed: true` or `authed: false` with the failure reason and probe timestamp
+2. Records results locally: `authed: true` or `authed: false` with the failure reason and probe timestamp
 3. Prints a model-status table for classified models only, showing tier, auth verdict, denial status, and prefer rank
 
 **Routing and auth**:
@@ -206,9 +210,9 @@ routing:
 ## Run output and narration
 
 When you execute `tickmarkr run`, the daemon streams live narration of each audit-trail event to stdout — task status changes,
-gate results (tickmarks), worker dispatch, and merge commits. This narration is derived from the append-only `.drovr/runs/<runId>/journal.jsonl`
-ledger, which remains the authoritative source of truth for resumability. If an engagement is interrupted, `tickmarkr resume <runId>`
-replays the journal and picks up where it left off. You can also tail the journal directly for raw event inspection or
+gate results (tickmarks), worker dispatch, and merge commits. This narration is derived from the append-only event ledger,
+which remains the authoritative source of truth for resumability. If an engagement is interrupted, `tickmarkr resume <runId>`
+replays the ledger and picks up where it left off. You can also tail the ledger directly for raw event inspection or
 feed it to external tools; the narration is a convenience layer on top.
 
 ## Usage and cost
@@ -235,7 +239,7 @@ and first-attempt success rate. Cost reporting follows strict honesty rules and
 - **Ranges, never single numbers**: quota multipliers and monthly-window variation make subscription costs a range, not a point estimate
 - **"Not measurable" never becomes $0**: if a channel lacks pricing or metering data, the report explicitly states "not measurable"
 - **Basis always shown**: every cost figure prints the token count, rate used, and date so estimates can be audited
-- **No network calls**: pricing config is operator-maintained in `.drovr/config.yaml` (or `~/.config/tickmarkr/config.yaml`; legacy `~/.config/drovr` still read), seeded with dated
+- **No network calls**: pricing config is operator-maintained locally, seeded with dated
   comments and LiteLLM's JSON file named as the copy-from source; tickmarkr never calls home to fetch rates
 - **Attribution from journal**: token counts come from tickmarkr's own telemetry spans in the audit trail, never from provider invoices or dashboards
 
@@ -323,11 +327,11 @@ produced the graph. Upstream, these front-ends exist:
 
 | Spec source | Support | How |
 |---|---|---|
-| **tickmarkr spec** (native format) | Native/default | `tickmarkr init` template with the `<!-- drovr:spec -->` marker |
+| **tickmarkr spec** (native format) | Native/default | `tickmarkr init` template with native spec marker |
 | **Spec Kit** feature dir | Native | dir containing `tasks.md` |
 | **GSD** phase dir | Native | dir containing `*-PLAN.md` |
 | **Markdown PRD** | Native (universal adapter) | any `.md` with tasks + acceptance criteria |
-| OpenSpec, BMAD, Superpowers, others | Not yet | render to a tickmarkr spec (the `<!-- drovr:spec -->` marker plus the full Task surface), or contribute a front-end: one parser module behind `src/compile/index.ts`, same pattern as `gsd.ts` |
+| OpenSpec, BMAD, Superpowers, others | Not yet | render to a tickmarkr spec (with full Task surface), or contribute a front-end: one parser module behind `src/compile/index.ts`, same pattern as `gsd.ts` |
 
 Compile fails loudly on anything it can't recognize (`--type native|speckit|prd|gsd` to force).
 
@@ -393,10 +397,9 @@ npm run test:coverage  # same suite, coverage floors enforced (see below)
 npm run e2e            # opt-in real-CLI end-to-end — DOES spend tokens, needs ≥1 agent CLI installed
 ```
 
-`npm test` and `npm run test:coverage` must never call a real agent CLI or spend tokens — that's
-what `DROVR_FAKE_SCRIPT` and the `FakeAdapter` (`src/adapters/fake.ts`) exist for. If a change
-needs a real CLI to verify, that test belongs under `npm run e2e` (`tests/e2e/`), gated behind
-`DROVR_E2E=1`, never in the default suite.
+`npm test` and `npm run test:coverage` must never call a real agent CLI or spend tokens —
+test isolation uses deterministic fixtures. If a change needs a real CLI to verify, that test
+belongs under `npm run e2e` (`tests/e2e/`), an opt-in test suite not run in CI.
 
 Coverage floor: `src/{graph,route,gates,run}/**` must stay at lines 80% / functions 80% /
 branches 70% — this is the CLAUDE.md invariant, enforced verbatim in `vitest.config.ts`.
@@ -432,7 +435,7 @@ behavior) are logged as a numbered entry (`OBS-NN`) in `.planning/OBSERVATIONS.m
 That file is the standing abnormality ledger for this repo — read it before assuming a rough edge
 is new.
 
-Design spec: `docs/superpowers/specs/2026-07-07-drover-design.md`.
+See the design spec in docs/superpowers/specs/.
 
 ## License
 

package/dist/adapters/claude-code.js

@@ -49,15 +49,15 @@ export const claudeCode = {
     // Gotchas (both bit the 2026-07-10 live check): bare '{}' is REJECTED ("mcpServers: expected record"),
     // and --mcp-config is VARIADIC — a positional after it is eaten as a config-file path, so another
     // flag must always follow the value, never the prompt.
-    headlessCommand: (promptFile, model) => `claude -p "$(cat ${shq(promptFile)})" --model ${shq(model)} --permission-mode acceptEdits --strict-mcp-config --mcp-config '{"mcpServers":{}}' --output-format text`,
+    headlessCommand: (promptFile, model) => `claude -p "$(cat ${shq(promptFile)})" --model ${shq(model)} --permission-mode bypassPermissions --strict-mcp-config --mcp-config '{"mcpServers":{}}' --output-format text`,
     // HYG-03: the residual first-entry dialog on an interactive TUI is the workspace TRUST dialog (not MCP
     // config loading) — CLI-imposed, no flag to pre-accept, only store is claude's global last-writer-wins
     // ~/.claude.json keyed on the exact path. Closed WON'T-FIX (decision B, 2026-07-10): drovr writes nothing
     // to that file (a seed races claude's own writes, nondeterministically). Amortizes to one operator dismissal
     // per stable worktree path; blocked-pane paging surfaces it. Do NOT change this command to "fix" the dialog —
     // see .planning/REQUIREMENTS.md HYG-03 and 21-02-LIVE-CHECK.md. Revisit if upstream ships a --trust flag.
-    interactiveCommand: (promptFile, model) => `claude --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode acceptEdits "$(cat ${shq(promptFile)})"`,
-    resumeCommand: (sessionId, promptFile, model) => `claude -r ${shq(sessionId)} --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode acceptEdits "$(cat ${shq(promptFile)})"`,
+    interactiveCommand: (promptFile, model) => `claude --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`,
+    resumeCommand: (sessionId, promptFile, model) => `claude -r ${shq(sessionId)} --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },

package/dist/adapters/codex.js

@@ -129,11 +129,14 @@ export const codex = {
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
-    headlessCommand: (promptFile, model) => `codex exec --sandbox workspace-write ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
+    // OBS-24: -c 'mcp_servers={}' is codex's analog of claude's --strict-mcp-config — operator-global
+    // MCP servers in ~/.codex/config.toml block startup indefinitely when one is down (live-measured
+    // 2026-07-15: probe wedged >120s with MCP, 30s clean), wedging probes and worktree workers alike.
+    headlessCommand: (promptFile, model) => `codex exec --sandbox workspace-write -c 'mcp_servers={}' ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
     // TUI uses expanded -a never -s workspace-write (exec-only flags do not apply)
     // (--help 2026-07-09: valid approval policies are untrusted|on-request|never; the previously
     // used `on-failure` is invalid and made codex exit 2 pre-inference)
-    interactiveCommand: (promptFile, model) => `codex -a never -s workspace-write ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
+    interactiveCommand: (promptFile, model) => `codex -a never -s workspace-write -c 'mcp_servers={}' ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },

package/dist/adapters/model-lints.d.ts

@@ -2,5 +2,14 @@ import type { DrovrConfig } from "../config/config.js";
 import { type AuthHealth, type WorkerAdapter } from "./types.js";
 export declare const SEED_STAMPED = "2026-07-09";
 export declare const MODEL_STALE_DAYS = 30;
-export declare function modelLints(cfg: DrovrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[]): string[];
-export declare function suggestOverlay(cfg: DrovrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[]): string;
+export declare const ttyVisual: () => boolean;
+export declare function modelLints(cfg: DrovrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], opts?: {
+    tty?: boolean;
+    stateDir?: string;
+}): string[];
+export declare function formatModelAuthLine(excluded: {
+    key: string;
+    reason: string;
+    probedAt: string;
+}[], tty?: boolean, stateDir?: string): string;
+export declare function suggestOverlay(cfg: DrovrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], stateDir?: string): string;

package/dist/adapters/model-lints.js

@@ -9,10 +9,16 @@ const DAY_MS = 86400000;
 // raw list (verified 2026-07-10). Data stays raw; lints stay signal.
 const LINT_VARIANT_RE = /^auto$|-(fast|minimal|low|medium|high|xhigh)$/;
 const LINT_CAP = 5;
+const TTY_LINT_CAP = 3;
+const DEFAULT_STATE_DIR = ".drovr";
+const doctorJsonRef = (stateDir) => ` — see ${stateDir}/doctor.json`;
+export const ttyVisual = () => process.stdout.isTTY === true && process.env.NO_COLOR === undefined;
 // Diffs detected models (doctor.json) against configured tiers, both directions, per adapter id in cfg.tiers.
 // No `  ! ` prefix here — the consumer (doctor rows / plan lints) owns that. Pre-v1.5 doctor.json (models:[], no
 // modelsDetectedAt) is the compat baseline: `?.`/`?? []` everywhere, no zod (would reject old files).
-export function modelLints(cfg, health, adapters) {
+export function modelLints(cfg, health, adapters, opts) {
+    const cap = opts?.tty ? TTY_LINT_CAP : LINT_CAP;
+    const doctorRef = opts?.tty ? doctorJsonRef(opts.stateDir ?? DEFAULT_STATE_DIR) : "";
     const lints = [];
     for (const id of Object.keys(cfg.tiers)) {
         const adapter = adapters.find((a) => a.id === id);
@@ -37,8 +43,8 @@ export function modelLints(cfg, health, adapters) {
         }
         const extra = detected.filter((m) => !configured.includes(m) && !LINT_VARIANT_RE.test(m));
         if (extra.length) {
-            const shown = extra.slice(0, LINT_CAP).join(", ");
-            const tail = extra.length > LINT_CAP ? `, +${extra.length - LINT_CAP} more` : "";
+            const shown = extra.slice(0, cap).join(", ");
+            const tail = extra.length > cap ? `, +${extra.length - cap} more${doctorRef}` : "";
             lints.push(`${id}: reports ${extra.length} model(s) not in tiers (${shown}${tail}) — classify before routing (benchmark policy)`);
         }
         const at = h?.modelsDetectedAt;
@@ -50,13 +56,24 @@ export function modelLints(cfg, health, adapters) {
     }
     return lints;
 }
+// T2/T6: one lint per exclusion, naming the probe reason and date. TTY truncates reasons to 60 chars and
+// points at doctor.json for the full text; non-TTY is byte-identical to the pre-T6 registry helper.
+export function formatModelAuthLine(excluded, tty, stateDir = DEFAULT_STATE_DIR) {
+    const trunc = (s, n) => (s.length <= n ? s : `${s.slice(0, n - 1)}…`);
+    const parts = excluded.map(({ key, reason, probedAt }) => {
+        const r = tty ? trunc(reason, 60) : reason;
+        return `${key} (${r} — probed ${probedAt.split("T")[0]})`;
+    });
+    const base = `model auth: ${excluded.length} channel(s) unauthed — ${parts.join(", ")}`;
+    return tty ? `${base}${doctorJsonRef(stateDir)}` : base;
+}
 // MODEL-05/06: render detected-vs-configured drift as a paste-ready config.yaml fragment. Locked v1.5
 // decision: detection is strictly advisory — doctor prints, a human pastes; NO --write/--apply exists.
 // Additions render WHOLE-LINE-COMMENTED with a `???` tier placeholder (a tier is a benchmark claim; the
 // machine never fabricates one — auto-tiering reopens the NaN-routing class). Removals render as LIVE
 // `<id>: null` tombstones (deepMerge deletes the key). Pure function: no fs, no routing contact.
 // Returns "" when no adapter has a delta. Mirrors modelLints' per-adapter guards exactly.
-export function suggestOverlay(cfg, health, adapters) {
+export function suggestOverlay(cfg, health, adapters, stateDir = DEFAULT_STATE_DIR) {
     const blocks = [];
     for (const id of Object.keys(cfg.tiers)) {
         const adapter = adapters.find((a) => a.id === id);
@@ -100,13 +117,13 @@ export function suggestOverlay(cfg, health, adapters) {
             lines.push(`      # ${model}: ???   #${date ? ` detected ${date} —` : ""} classify per benchmark policy (AA Index + SWE-bench Pro, dated), then uncomment`);
         }
         if (omitted)
-            lines.push(`      # (+${omitted} other detected id${omitted === 1 ? "" : "s"} not related to your configured models — see .drovr/doctor.json)`);
+            lines.push(`      # (+${omitted} other detected id${omitted === 1 ? "" : "s"} not related to your configured models — see ${stateDir}/doctor.json)`);
         if (lines.length)
             blocks.push(`  ${id}:\n    models:\n${lines.join("\n")}`);
     }
     if (blocks.length === 0)
         return "";
-    return `# paste into .drovr/config.yaml — drovr prints this, it never applies it\ntiers:\n${blocks.join("\n")}\n`;
+    return `# paste into ${stateDir}/config.yaml — tickmarkr prints this, it never applies it\ntiers:\n${blocks.join("\n")}\n`;
 }
 // Purely relational id split for the addition gate (see suggestOverlay). Local, not exported: this is NOT a
 // global identity concept — src/gates/review.ts has its own local modelId(), deliberately not shared.

package/dist/adapters/registry.d.ts

@@ -5,7 +5,9 @@ export declare function allAdapters(opts?: {
 }): WorkerAdapter[];
 export declare function getAdapter(id: string, adapters: WorkerAdapter[]): WorkerAdapter;
 export declare function probeAll(adapters: WorkerAdapter[]): Promise<Record<string, AuthHealth>>;
-export declare function probeModels(cfg: DrovrConfig, repoRoot: string, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): Promise<void>;
+export type ProbeModelStatus = "ok" | "timeout" | "failed";
+export type ProbeModelProgress = (adapter: string, model: string, status: ProbeModelStatus, durationMs: number) => void;
+export declare function probeModels(cfg: DrovrConfig, repoRoot: string, adapters: WorkerAdapter[], health: Record<string, AuthHealth>, onProgress?: ProbeModelProgress): Promise<void>;
 export declare function writeDoctor(repoRoot: string, health: Record<string, AuthHealth>): void;
 export declare function readDoctor(repoRoot: string): Record<string, AuthHealth> | null;
 export declare function discoverChannels(cfg: DrovrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): BillingChannel[];
@@ -29,3 +31,13 @@ export declare function modelAuthLine(excluded: {
     probedAt: string;
 }[]): string;
 export declare function doctorAgeMs(repoRoot: string): number | null;
+export declare const INIT_DOCTOR_REUSE_MS: number;
+export declare function formatDoctorAgeForInit(ageMs: number): string;
+export declare function initDoctorReuse(repoRoot: string, fresh: boolean): {
+    reuse: boolean;
+    ageMs: number | null;
+    health: Record<string, AuthHealth> | null;
+};
+export declare function formatDoctorReport(cwd: string, cfg: DrovrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], opts?: {
+    wrote?: boolean;
+}): string;

package/dist/adapters/registry.js

@@ -1,8 +1,10 @@
 import { existsSync, mkdtempSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { modelLints, suggestOverlay } from "./model-lints.js";
+import { HerdrDriver } from "../drivers/herdr.js";
 import { drovrDir, stateDirName } from "../graph/graph.js";
-import { disallowedBy } from "../route/preference.js";
+import { disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../route/preference.js";
 import { sh } from "../run/git.js";
 import { claudeCode } from "./claude-code.js";
 import { codex } from "./codex.js";
@@ -32,7 +34,8 @@ export async function probeAll(adapters) {
     return out;
 }
 const MODEL_PROBE_PROMPT = "Reply with exactly OK and nothing else.";
-const MODEL_PROBE_TIMEOUT_MS = 30000;
+// 60s: a healthy MCP-free codex probe measured 29.9s round-trip (2026-07-15) — 30s had zero headroom.
+const MODEL_PROBE_TIMEOUT_MS = 60000;
 // Auth-words only match when tied to a failure word; bare "auth"/"OAuth"/"authored" never fail (v1.27 T2).
 const AUTH_FAILURE_RE = /\b4\d\d\b|\bauth(?:entication|orization)?\s+(?:error|failed|failure|denied)|unauthori[sz]ed|forbidden|access denied|credit(?:s)?\s+(?:exhausted|error|denied)/i;
 function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TIMEOUT_MS) {
@@ -44,8 +47,12 @@ function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TI
         ? output.slice(0, 240) || `probe exited ${code}`
         : undefined;
 }
+const probeModelStatus = (v) => v.authed ? "ok" : v.reason?.includes("timed out") ? "timeout" : "failed";
 // v1.21: one bounded, headless call per configured model; detected-but-unclassified models never enter this loop.
-export async function probeModels(cfg, repoRoot, adapters, health) {
+export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
+    // T2: a prior doctor.json timeout verdict for this model skips the retry — a persistently dead
+    // model (e.g. opencode glm-5.2) costs one 30s attempt instead of two every run.
+    const priorHealth = readDoctor(repoRoot);
     await Promise.all(adapters.map(async (a) => {
         const h = health[a.id];
         if (!h?.installed)
@@ -54,35 +61,65 @@ export async function probeModels(cfg, repoRoot, adapters, health) {
         if (process.env.VITEST && [claudeCode, codex, cursorAgent, opencode, pi, grok].includes(a))
             return;
         const verdicts = {};
+        const priorModelAuth = priorHealth?.[a.id]?.modelAuth;
         // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
-        // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap
-        await Promise.all(Object.keys(cfg.tiers[a.id]?.models ?? {}).map(async (model) => {
+        // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
+        // Capped at MODEL_PROBE_CONCURRENCY per adapter (v1.33.5 regression: 4 concurrent codex exec
+        // in one repo made ALL 4 codex probes time out where sequential passed 2/4).
+        await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), MODEL_PROBE_CONCURRENCY, async (model) => {
+            const t0 = Date.now();
             const probedAt = new Date().toISOString();
+            const priorTimedOut = priorModelAuth?.[model]?.reason?.includes("timed out") === true;
+            let verdict;
             try {
                 if (typeof a.headlessCommand !== "function") {
-                    verdicts[model] = { authed: false, reason: "headless probe unavailable", probedAt };
-                    return;
+                    verdict = { authed: false, reason: "headless probe unavailable", probedAt, durationMs: Date.now() - t0 };
                 }
-                const promptFile = join(mkdtempSync(join(tmpdir(), "drovr-auth-")), "probe.md");
-                writeFileSync(promptFile, MODEL_PROBE_PROMPT);
-                let r = await sh(a.headlessCommand(promptFile, model), repoRoot, MODEL_PROBE_TIMEOUT_MS);
-                if (r.timedOut) {
-                    r = await sh(a.headlessCommand(promptFile, model), repoRoot, MODEL_PROBE_TIMEOUT_MS);
-                    if (r.timedOut) {
-                        verdicts[model] = { authed: false, reason: `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`, probedAt };
-                        return;
+                else {
+                    const promptFile = join(mkdtempSync(join(tmpdir(), "drovr-auth-")), "probe.md");
+                    writeFileSync(promptFile, MODEL_PROBE_PROMPT);
+                    const r = await sh(a.headlessCommand(promptFile, model), repoRoot, MODEL_PROBE_TIMEOUT_MS);
+                    if (r.timedOut && priorTimedOut) {
+                        verdict = { authed: false, reason: `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`, probedAt, durationMs: Date.now() - t0 };
+                    }
+                    else if (r.timedOut) {
+                        const r2 = await sh(a.headlessCommand(promptFile, model), repoRoot, MODEL_PROBE_TIMEOUT_MS);
+                        if (r2.timedOut) {
+                            verdict = { authed: false, reason: `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`, probedAt, durationMs: Date.now() - t0 };
+                        }
+                        else {
+                            const reason = probeFailure(r2.code, r2.stdout, r2.stderr, r2.timedOut, MODEL_PROBE_TIMEOUT_MS);
+                            verdict = reason ? { authed: false, reason, probedAt, durationMs: Date.now() - t0 } : { authed: true, probedAt, durationMs: Date.now() - t0 };
+                        }
+                    }
+                    else {
+                        const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
+                        verdict = reason ? { authed: false, reason, probedAt, durationMs: Date.now() - t0 } : { authed: true, probedAt, durationMs: Date.now() - t0 };
                     }
                 }
-                const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
-                verdicts[model] = reason ? { authed: false, reason, probedAt } : { authed: true, probedAt };
             }
             catch (e) {
-                verdicts[model] = { authed: false, reason: String(e), probedAt };
+                verdict = { authed: false, reason: String(e), probedAt, durationMs: Date.now() - t0 };
             }
-        }));
+            verdicts[model] = verdict;
+            onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
+        });
         h.modelAuth = verdicts;
     }));
 }
+// T2: caps concurrent probes per adapter at 2 — v1.33.5 regression, 4 concurrent codex exec in one
+// repo made ALL 4 time out where sequential passed 2/4 (suspected CLI self-contention).
+const MODEL_PROBE_CONCURRENCY = 2;
+async function mapLimit(items, limit, fn) {
+    let i = 0;
+    const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (i < items.length) {
+            const item = items[i++];
+            await fn(item);
+        }
+    });
+    await Promise.all(workers);
+}
 const doctorPath = (repoRoot) => join(repoRoot, stateDirName(repoRoot), "doctor.json");
 export function writeDoctor(repoRoot, health) {
     drovrDir(repoRoot);
@@ -165,3 +202,97 @@ export function doctorAgeMs(repoRoot) {
     // renders a nonsensical negative age ("doctor.json is -0h old").
     return Math.max(0, Date.now() - statSync(p).mtimeMs);
 }
+// ponytail: hardcoded 60m TTL for init reuse only — promote to config when an operator asks.
+export const INIT_DOCTOR_REUSE_MS = 60 * 60 * 1000;
+export function formatDoctorAgeForInit(ageMs) {
+    return `${Math.floor(ageMs / 60_000)}m`;
+}
+export function initDoctorReuse(repoRoot, fresh) {
+    const health = readDoctor(repoRoot);
+    const ageMs = doctorAgeMs(repoRoot);
+    const reuse = !fresh && health !== null && ageMs !== null && ageMs < INIT_DOCTOR_REUSE_MS;
+    return { reuse, ageMs, health: reuse ? health : null };
+}
+// Report body shared by init's cached-doctor path — mirrors doctor.ts formatting without probing.
+export function formatDoctorReport(cwd, cfg, health, adapters, opts = {}) {
+    const rows = adapters.map((a) => {
+        const h = health[a.id];
+        const state = !h?.installed ? "not installed" : `${h.version ?? "installed"}${h.note ? ` (${h.note})` : ""}`;
+        return `  ${h?.installed ? "✓" : "✗"} ${a.id.padEnd(14)} ${state}`;
+    });
+    rows.push(`  ${HerdrDriver.available() ? "✓" : "✗"} herdr          ${HerdrDriver.available() ? "driver available (HERDR_ENV=1)" : "not detected — subprocess driver will be used"}`);
+    rows.push("workspace trust:");
+    for (const a of adapters) {
+        if (!health[a.id]?.installed)
+            continue;
+        if (!a.trust) {
+            rows.push(`  = ${a.id.padEnd(14)} trust: n/a`);
+            continue;
+        }
+        try {
+            const v = a.trust(cwd);
+            if (v.status === "trusted")
+                rows.push(`  ✓ ${a.id.padEnd(14)} trust: trusted`);
+            else if (v.status === "seeded")
+                rows.push(`  ✓ ${a.id.padEnd(14)} trust: seeded`);
+            else
+                rows.push(`  ! ${a.id.padEnd(14)} trust: action-required — run ONCE: ${v.command}`);
+        }
+        catch (e) {
+            rows.push(`  ! ${a.id.padEnd(14)} trust: action-required — run ONCE: (trust check failed: ${e instanceof Error ? e.message : String(e)})`);
+        }
+    }
+    for (const [role, sel] of [["judge", cfg.judge], ["consult", cfg.consult]]) {
+        if (!health[sel.adapter]?.installed) {
+            rows.push(`  ! ${role} runs on ${sel.adapter}:${sel.model} — NOT installed; that gate will fail closed until you install it or remap cfg.${role}`);
+        }
+    }
+    rows.push(...modelLints(cfg, health, adapters, { stateDir: stateDirName(cwd) }).map((l) => `  ! ${l}`));
+    const excluded = excludedChannels(cfg, adapters, health);
+    if (excluded.length)
+        rows.push(`  ! ${exclusionLine(excluded)}`);
+    const servable = servableExclusions(cfg, adapters, health);
+    if (servable.length)
+        rows.push(`  ! ${servabilityLine(servable)}`);
+    const visual = process.stdout.isTTY === true && process.env.NO_COLOR === undefined;
+    const frag = suggestOverlay(cfg, health, adapters, stateDirName(cwd));
+    let drift = "";
+    if (frag) {
+        if (visual) {
+            const overlayPath = join(drovrDir(cwd), "doctor-overlay.yaml");
+            writeFileSync(overlayPath, frag);
+            drift = `\nmodel drift: unclassified models detected — paste-ready overlay written to ${overlayPath} (advisory; tickmarkr never applies it)`;
+        }
+        else {
+            drift = `\nmodel drift — paste-ready overlay (advisory; tickmarkr never applies):\n${frag}`;
+        }
+    }
+    const trunc = (s, n) => (s.length <= n ? s : `${s.slice(0, n - 1)}…`);
+    const dateOf = (iso) => iso.slice(0, 10);
+    const modelStatus = adapters.flatMap((a) => {
+        const h = health[a.id];
+        if (!h?.installed)
+            return [];
+        const classified = cfg.tiers[a.id]?.models ?? {};
+        const models = Object.keys(classified);
+        const unclassified = (h.models ?? []).filter((m) => !(m in classified));
+        if (!models.length && !unclassified.length)
+            return [];
+        const w = Math.max(8, ...models.map((m) => m.length));
+        const statusRows = [`  ${a.id}`];
+        for (const m of models) {
+            const v = h.modelAuth?.[m];
+            const auth = !v ? "unknown" : v.authed ? "authed" : `unauthed: ${trunc(v.reason ?? "probe failed", 40)} (${dateOf(v.probedAt)})`;
+            const d = disallowedBy({ adapter: a.id, model: m }, cfg.routing);
+            const denied = d?.by === "deny" ? d.entry : "—";
+            const pref = preferRanks({ adapter: a.id, model: m }, cfg).map((p) => `${p.shape}#${p.rank}`).join(",") || "—";
+            statusRows.push(`    ${m.padEnd(w)} ${classified[m].padEnd(8)} ${auth}  denied=${denied}  prefer=${pref}`);
+        }
+        if (unclassified.length)
+            statusRows.push(`    (${unclassified.length} more listed, unclassified)`);
+        return statusRows;
+    });
+    const modelSummary = modelStatus.length ? `\nmodel status:\n${modelStatus.join("\n")}` : "";
+    const wrote = opts.wrote === false ? "" : `\nwrote ${stateDirName(cwd)}/doctor.json`;
+    return `tickmarkr doctor — capability matrix:\n${rows.join("\n")}${modelSummary}${drift}${wrote}`;
+}

package/dist/cli/commands/compile.js

@@ -1,7 +1,7 @@
 import { isAbsolute, join } from "node:path";
 import { parseArgs } from "node:util";
 import { compileSource } from "../../compile/index.js";
-import { saveGraph } from "../../graph/graph.js";
+import { saveGraph, stateDirName } from "../../graph/graph.js";
 import { isRunLockLive } from "../../run/lock.js";
 export async function compile(argv, cwd = process.cwd()) {
     const { values, positionals } = parseArgs({
@@ -16,8 +16,9 @@ export async function compile(argv, cwd = process.cwd()) {
     const g = compileSource(isAbsolute(src) ? src : join(cwd, src), values.type, cwd);
     // HARD-01: a compile clobbering a running daemon's graph.json is the same last-write-wins race
     // as a second daemon. Read-only check — compile never acquires/holds (it's instantaneous).
+    const stateDir = stateDirName(cwd);
     if (isRunLockLive(cwd))
-        throw new Error(".drovr/graph.lock is held by another drovr run, or is a stale/garbage lock — refusing to overwrite graph.json. If no run is active, run `drovr unlock`.");
+        throw new Error(`${stateDir}/graph.lock is held by another drovr run, or is a stale/garbage lock — refusing to overwrite graph.json. If no run is active, run \`drovr unlock\`.`);
     saveGraph(cwd, g);
-    return `compiled ${src} → .drovr/graph.json (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)})`;
+    return `compiled ${src} → ${stateDir}/graph.json (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)})`;
 }

package/dist/cli/commands/doctor.js

@@ -1,8 +1,8 @@
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { allAdapters, probeAll, probeModels, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
-import { drovrDir } from "../../graph/graph.js";
-import { modelLints, suggestOverlay } from "../../adapters/model-lints.js";
+import { drovrDir, stateDirName } from "../../graph/graph.js";
+import { modelLints, suggestOverlay, ttyVisual } from "../../adapters/model-lints.js";
 import { loadConfig } from "../../config/config.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
 import { disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
@@ -35,6 +35,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     // stderr, live: auth probes are real LLM calls (up to 30s per configured model) and the CLI
     // otherwise prints nothing until the end — silence here reads as a hang (v1.33.1)
     console.error("probing installed agent CLIs — one short LLM call per configured model, may take a minute...");
+    const probeProgressTTY = process.stderr.isTTY === true;
     const health = await probeAll(adapters);
     // MODEL-02: detect models where the adapter exposes a list surface, BEFORE writing doctor.json (write once, below).
     // Fail OPEN — the inverse of gates' fail-closed: detection is advisory, so a broken list surface NEVER fails doctor.
@@ -51,7 +52,9 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
         }
         catch { /* fail open: leave models as-is, doctor stays healthy */ }
     }
-    await probeModels(cfg, cwd, adapters, health);
+    await probeModels(cfg, cwd, adapters, health, probeProgressTTY
+        ? (adapter, model, status, durationMs) => console.error(`  ${adapter}:${model} ${status} (${(durationMs / 1000).toFixed(1)}s)`)
+        : undefined);
     writeDoctor(cwd, health);
     const rows = adapters.map((a) => {
         const h = health[a.id];
@@ -88,7 +91,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             rows.push(`  ! ${role} runs on ${sel.adapter}:${sel.model} — NOT installed; that gate will fail closed until you install it or remap cfg.${role}`);
         }
     }
-    rows.push(...modelLints(cfg, health, adapters).map((l) => `  ! ${l}`));
+    rows.push(...modelLints(cfg, health, adapters, { tty: ttyVisual(), stateDir: stateDirName(cwd) }).map((l) => `  ! ${l}`));
     const excluded = excludedChannels(cfg, adapters, health);
     if (excluded.length)
         rows.push(`  ! ${exclusionLine(excluded)}`);
@@ -99,7 +102,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     // MODEL-05/06: print-only drift fragment; advisory, whole-line-commented additions, drovr NEVER applies it.
     // TTY gets a one-line summary + the fragment as a file (the full dump drowned everything else,
     // v1.33.1 onboarding); machine/CI surface keeps the inline dump — layout is pinned by tests.
-    const frag = suggestOverlay(cfg, health, adapters);
+    const frag = suggestOverlay(cfg, health, adapters, stateDirName(cwd));
     let drift = "";
     if (frag) {
         if (visual()) {
@@ -141,5 +144,5 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
         return rows;
     });
     const modelSummary = modelStatus.length ? `\nmodel status:\n${modelStatus.join("\n")}` : "";
-    return stylize(`tickmarkr doctor — capability matrix:\n${rows.join("\n")}${modelSummary}${drift}\nwrote .drovr/doctor.json`);
+    return stylize(`tickmarkr doctor — capability matrix:\n${rows.join("\n")}${modelSummary}${drift}\nwrote ${stateDirName(cwd)}/doctor.json`);
 }

package/dist/cli/commands/init.js

@@ -2,7 +2,8 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } fr
 import { join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { parseArgs } from "node:util";
-import { configTemplate, globalConfigDir } from "../../config/config.js";
+import { allAdapters, formatDoctorAgeForInit, formatDoctorReport, initDoctorReuse } from "../../adapters/registry.js";
+import { configTemplate, DEFAULT_CONFIG, globalConfigDir, loadConfig } from "../../config/config.js";
 import { specTemplate } from "../../compile/native.js";
 import { drovrDir } from "../../graph/graph.js";
 import { doctor } from "./doctor.js";
@@ -23,6 +24,9 @@ Loop: \`tickmarkr compile <spec>\` → \`tickmarkr plan\` → \`tickmarkr run\`
 - Treat missing or unparseable results as failures.
 ${DOCS_END}
 `;
+const skillPath = (cwd, skill) => join(cwd, ".claude", "skills", skill, "SKILL.md");
+const skillsInstalled = (cwd) => AGENT_SKILLS.every((s) => existsSync(skillPath(cwd, s)));
+const wizardDriverDefault = () => process.env.HERDR_ENV === "1" ? "herdr" : "auto";
 async function installAgentFiles(cwd, force, docs, notes) {
     const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
     let prompt;
@@ -34,7 +38,7 @@ async function installAgentFiles(cwd, force, docs, notes) {
     };
     try {
         for (const skill of AGENT_SKILLS) {
-            const dest = join(cwd, ".claude", "skills", skill, "SKILL.md");
+            const dest = skillPath(cwd, skill);
             const exists = existsSync(dest);
             if (exists && !force && !(await confirm(`Overwrite ${dest}?`))) {
                 notes.push(`skipped existing ${dest}; pass --force to overwrite it`);
@@ -63,6 +67,42 @@ async function installAgentFiles(cwd, force, docs, notes) {
         prompt?.close();
     }
 }
+const askDefault = async (rl, label, def) => {
+    const answer = (await rl.question(`${label} [${def}] `)).trim();
+    return answer || def;
+};
+const askYesNo = async (rl, label, def) => {
+    const hint = def ? "Y/n" : "y/N";
+    const answer = (await rl.question(`${label} [${hint}] `)).trim();
+    if (!answer)
+        return def;
+    return /^(?:y|yes)$/i.test(answer);
+};
+async function runInitWizard(cwd) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const driverDef = wizardDriverDefault();
+        const driverRaw = await askDefault(rl, "Driver (auto|herdr|subprocess)", driverDef);
+        const driver = ["auto", "herdr", "subprocess"].includes(driverRaw)
+            ? driverRaw
+            : driverDef;
+        const concRaw = await askDefault(rl, "Concurrency", String(DEFAULT_CONFIG.concurrency));
+        const parsed = Number.parseInt(concRaw, 10);
+        const concurrency = Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_CONFIG.concurrency;
+        const llmDef = DEFAULT_CONFIG.visibility.llm;
+        const llmRaw = await askDefault(rl, "visibility.llm (pane|headless)", llmDef);
+        const llm = llmRaw === "pane" || llmRaw === "headless" ? llmRaw : llmDef;
+        let installSkills = false;
+        if (!skillsInstalled(cwd)) {
+            const skillsDef = existsSync(join(cwd, ".claude")) && !skillsInstalled(cwd);
+            installSkills = await askYesNo(rl, "Install agent skills (tickmarkr-loop/tickmarkr-auto) into .claude/skills?", skillsDef);
+        }
+        return { overlay: { driver, concurrency, visibility: { llm } }, installSkills };
+    }
+    finally {
+        rl.close();
+    }
+}
 export async function init(argv, cwd = process.cwd()) {
     const { values } = parseArgs({
         args: argv,
@@ -71,20 +111,25 @@ export async function init(argv, cwd = process.cwd()) {
             agent: { type: "boolean" },
             force: { type: "boolean" },
             docs: { type: "boolean" },
+            fresh: { type: "boolean" },
+            yes: { type: "boolean" },
         },
     });
     const gdir = values["global-dir"] ?? globalConfigDir();
     mkdirSync(gdir, { recursive: true });
     const notes = [];
-    for (const p of [join(gdir, "config.yaml"), join(drovrDir(cwd), "config.yaml")]) {
-        if (!existsSync(p)) {
-            writeFileSync(p, configTemplate());
-            notes.push(`wrote ${p}`);
-        }
-        else {
-            notes.push(`kept existing ${p}`);
-        }
+    const globalPath = join(gdir, "config.yaml");
+    if (!existsSync(globalPath)) {
+        writeFileSync(globalPath, configTemplate());
+        notes.push(`wrote ${globalPath}`);
+    }
+    else {
+        notes.push(`kept existing ${globalPath}`);
     }
+    const repoConfigPath = join(drovrDir(cwd), "config.yaml");
+    const repoConfigExists = existsSync(repoConfigPath);
+    if (repoConfigExists)
+        notes.push(`kept existing ${repoConfigPath}`);
     const specPath = join(cwd, "tickmarkr.spec.md");
     if (existsSync(specPath)) {
         notes.push(`kept existing ${specPath}`);
@@ -96,8 +141,26 @@ export async function init(argv, cwd = process.cwd()) {
         writeFileSync(specPath, specTemplate());
         notes.push(`wrote ${specPath}`);
     }
+    const fresh = values.fresh ?? false;
+    const { reuse, ageMs, health } = initDoctorReuse(cwd, fresh);
+    const doc = reuse && health && ageMs !== null
+        ? `using probe results from ${formatDoctorAgeForInit(ageMs)} ago — run tickmarkr doctor to refresh (or init --fresh)\n${formatDoctorReport(cwd, loadConfig(cwd), health, allAdapters(), { wrote: false })}`
+        : await doctor([], cwd);
+    const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true && !(values.yes ?? false);
+    if (!repoConfigExists) {
+        if (interactive) {
+            const wizard = await runInitWizard(cwd);
+            writeFileSync(repoConfigPath, configTemplate(wizard.overlay));
+            notes.push(`wrote ${repoConfigPath}`);
+            if (wizard.installSkills)
+                await installAgentFiles(cwd, values.force ?? false, values.docs ?? false, notes);
+        }
+        else {
+            writeFileSync(repoConfigPath, configTemplate());
+            notes.push(`wrote ${repoConfigPath}`);
+        }
+    }
     if (values.agent)
         await installAgentFiles(cwd, values.force ?? false, values.docs ?? false, notes);
-    const doc = await doctor([], cwd);
     return `${notes.join("\n")}\n${doc}\nnext: edit tickmarkr.spec.md, then tickmarkr compile tickmarkr.spec.md && tickmarkr plan && tickmarkr run`;
 }

package/dist/cli/commands/plan.js

@@ -1,5 +1,5 @@
-import { allAdapters, discoverChannels, doctorAgeMs, modelAuthExclusions, modelAuthLine, probeAll, readDoctor, servableExclusions, servabilityLine } from "../../adapters/registry.js";
-import { modelLints } from "../../adapters/model-lints.js";
+import { allAdapters, discoverChannels, doctorAgeMs, modelAuthExclusions, probeAll, readDoctor, servableExclusions, servabilityLine } from "../../adapters/registry.js";
+import { formatModelAuthLine, modelLints, ttyVisual } from "../../adapters/model-lints.js";
 import { collateralLints } from "../../compile/collateral.js";
 import { loadConfig } from "../../config/config.js";
 import { loadGraph } from "../../graph/graph.js";
@@ -31,7 +31,7 @@ export async function plan(_argv, cwd = process.cwd(), adapters = allAdapters())
     // T2 (2026-07-13): per-model unauthed verdicts from doctor — one lint per exclusion (reason + date).
     const modelUnauthed = modelAuthExclusions(cfg, adapters, health);
     if (modelUnauthed.length)
-        lines.push(modelAuthLine(modelUnauthed), "");
+        lines.push(formatModelAuthLine(modelUnauthed, ttyVisual()), "");
     const unauthed = adapters.filter((a) => health[a.id]?.installed && !health[a.id]?.authed).map((a) => a.id);
     if (unauthed.length)
         lines.push(`installed but unauthed: ${unauthed.join(", ")} — channels excluded from routing`, "");
@@ -58,7 +58,7 @@ export async function plan(_argv, cwd = process.cwd(), adapters = allAdapters())
         if (!health[sel.adapter]?.installed)
             lints.push(`${role}: ${sel.adapter}:${sel.model} not installed — that gate/consult will fail closed`);
     }
-    lints.push(...modelLints(cfg, health, adapters)); // health may be pre-v1.5/probeAll-fallback — no-detection branch covers both
+    lints.push(...modelLints(cfg, health, adapters, { tty: ttyVisual() })); // health may be pre-v1.5/probeAll-fallback — no-detection branch covers both
     let cost = 0;
     for (const t of g.tasks) {
         try {

package/dist/cli/commands/profile.js

@@ -1,7 +1,7 @@
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { loadConfig } from "../../config/config.js";
-import { drovrDir } from "../../graph/graph.js";
+import { drovrDir, stateDirName } from "../../graph/graph.js";
 import { learnedScore, MIN_SAMPLES, cellsOf } from "../../route/profile.js";
 import { Journal, loadRoutingProfile, readProfileCursor, RUNS_WINDOW } from "../../run/journal.js";
 // drovr profile — inspect (show) and forget (reset) the derived learned-routing profile (VIS-03).
@@ -15,14 +15,15 @@ export async function profile(argv, cwd = process.cwd()) {
 // blanket-gitignores it, so the cursor is never git-addable. Opaque string: used only in a runId > compare.
 function reset(cwd) {
     const cursor = Journal.latestRunId(cwd) ?? ""; // empty repo ⇒ empty cursor ⇒ readProfileCursor === undefined
+    const stateDir = stateDirName(cwd);
     const path = join(drovrDir(cwd), "profile-since");
     writeFileSync(path, cursor + "\n");
     return [
         cursor
             ? `profile reset — learned routing now forgets runs at or before ${cursor}.`
             : `profile reset — no runs yet; wrote an empty cursor.`,
-        `  wrote .drovr/profile-since (telemetry is UNTOUCHED — report/resume still see every run).`,
-        `  to un-reset: delete .drovr/profile-since.`,
+        `  wrote ${stateDir}/profile-since (telemetry is UNTOUCHED — report/resume still see every run).`,
+        `  to un-reset: delete ${stateDir}/profile-since.`,
     ].join("\n");
 }
 // Inspection surface: preview:true bypasses the routing.learned:off short-circuit so `show` renders the
@@ -40,7 +41,7 @@ function show(cwd) {
     if (!p || p.cells.size === 0) {
         // preview bypasses the switch ⇒ undefined here means data, not policy: no telemetry, or all behind the cursor.
         header.push("", cursor
-            ? `  empty profile — no telemetry after the reset cursor (delete .drovr/profile-since to see earlier runs).`
+            ? `  empty profile — no telemetry after the reset cursor (delete ${stateDirName(cwd)}/profile-since to see earlier runs).`
             : `  empty profile — no telemetry yet.`);
         return header.join("\n");
     }

package/dist/cli/index.js

@@ -16,6 +16,7 @@ import { unlock } from "./commands/unlock.js";
 export const COMMANDS = {
     init, doctor, compile, scope, plan, run, status, resume, report, profile, unlock, approve,
 };
+const HELP_CMDS = new Set(["help", "-h", "--help"]);
 export const USAGE = `tickmarkr — spec-driven orchestration harness for AI coding agents
 usage: tickmarkr <command>
   init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs
@@ -34,9 +35,11 @@ usage: tickmarkr <command>
 // unknown/missing cmd → USAGE (exit 1 if a cmd was typed, 0 for bare `drovr`); a handler throw becomes
 // a one-line `drovr <cmd>: <message>` (never a raw stack) at exit 1.
 export async function dispatch(cmd, argv, commands = COMMANDS) {
-    const fn = cmd ? commands[cmd] : undefined;
+    if (!cmd || HELP_CMDS.has(cmd))
+        return { out: USAGE, code: 0 };
+    const fn = commands[cmd];
     if (!fn)
-        return { out: USAGE, code: cmd ? 1 : 0 };
+        return { out: USAGE, code: 1 };
     try {
         return { out: await fn(argv), code: 0 };
     }

package/dist/config/config.d.ts

@@ -180,5 +180,12 @@ export declare function globalConfigDir(): string;
 export declare function loadConfig(repoRoot: string, opts?: {
     globalDir?: string;
 }): DrovrConfig;
-export declare function configTemplate(): string;
+export type InitConfigOverlay = {
+    concurrency?: number;
+    driver?: DrovrConfig["driver"];
+    visibility?: {
+        llm?: DrovrConfig["visibility"]["llm"];
+    };
+};
+export declare function configTemplate(overlay?: InitConfigOverlay): string;
 export {};

package/dist/config/config.js

@@ -271,8 +271,8 @@ export function loadConfig(repoRoot, opts = {}) {
         throw new ConfigError(z.prettifyError(r.error));
     return r.data;
 }
-export function configTemplate() {
-    return `# tickmarkr config overlay — merges over built-in defaults (repo beats global beats defaults)
+export function configTemplate(overlay) {
+    const base = `# tickmarkr config overlay — merges over built-in defaults (repo beats global beats defaults)
 # concurrency: 3
 # driver: auto            # auto | herdr | subprocess
 # taskTimeoutMinutes: 30
@@ -329,4 +329,19 @@ export function configTemplate() {
 # ever — tickmarkr reuses stable worktree paths so the accept persists across runs; blocked-pane paging
 # surfaces each first-time dialog.
 `;
+    if (!overlay)
+        return base;
+    const lines = [];
+    if (overlay.concurrency !== undefined)
+        lines.push(`concurrency: ${overlay.concurrency}`);
+    if (overlay.driver !== undefined)
+        lines.push(`driver: ${overlay.driver}`);
+    if (overlay.visibility?.llm !== undefined) {
+        lines.push("visibility:");
+        lines.push(`  llm: ${overlay.visibility.llm}`);
+    }
+    if (!lines.length)
+        return base;
+    const nl = base.indexOf("\n");
+    return `${base.slice(0, nl + 1)}${lines.join("\n")}\n${base.slice(nl + 1)}`;
 }

package/dist/gates/review.js

@@ -30,7 +30,7 @@ export function pickReviewer(author, channels, exclude = []) {
 const DIFF_CAP = 60_000;
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers) {
     if (task.complexity < cfg.review.complexityThreshold) {
-        return { gate: "review", pass: true, details: `skipped — complexity ${task.complexity} < threshold ${cfg.review.complexityThreshold}` };
+        return { gate: "review", pass: true, details: `skipped — complexity ${task.complexity} < threshold ${cfg.review.complexityThreshold}`, meta: { skipped: true } };
     }
     const reviewer = pickReviewer(author, channels, excludeReviewers ?? []);
     if (!reviewer) {

package/dist/graph/graph.js

@@ -6,7 +6,13 @@ export function stateDirName(repoRoot) {
     const cached = stateDirs.get(repoRoot);
     if (cached)
         return cached;
-    const name = existsSync(join(repoRoot, ".drovr")) ? ".drovr" : existsSync(join(repoRoot, ".drover")) ? ".drover" : ".drovr";
+    const name = existsSync(join(repoRoot, ".tickmarkr"))
+        ? ".tickmarkr"
+        : existsSync(join(repoRoot, ".drovr"))
+            ? ".drovr"
+            : existsSync(join(repoRoot, ".drover"))
+                ? ".drover"
+                : ".tickmarkr";
     stateDirs.set(repoRoot, name);
     return name;
 }

package/dist/run/daemon.js

@@ -11,7 +11,7 @@ import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
 import { addEvidence, attributeBlocked, blockedTasks, getTask, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
 import { consult } from "./consult.js";
-import { gitHead, sh } from "./git.js";
+import { cleanupRunWorktrees, gitHead, sh } from "./git.js";
 import { Journal, loadRoutingProfile, newRunId } from "./journal.js";
 import { acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask } from "./merge.js";
@@ -706,6 +706,12 @@ export async function runDaemon(repoRoot, opts = {}) {
         };
         journal.append("run-end", undefined, { ...summary });
         await reconcile(); // run-end boundary: nothing in flight — full sweep (empty desired set)
+        // OBS-28: lingering worktrees starve CLI probes; keepPanes:forever is the debug override.
+        if (!keepForever) {
+            const green = summary.failed.length === 0 && summary.human.length === 0
+                && summary.blocked.length === 0 && summary.pending.length === 0;
+            await cleanupRunWorktrees(repoRoot, branch, { removeIntegration: green, removeTaskIds: summary.done });
+        }
         // VIS-02: name each blocked subtree by its nearest parked/failed root, e.g. "3 blocked behind P40-02".
         const attribution = [...attributeBlocked(graph).entries()]
             .sort(([a], [b]) => a.localeCompare(b))

package/dist/run/git.d.ts

@@ -7,6 +7,13 @@ export interface ShResult {
 export declare function sh(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
 export declare function gitHead(cwd: string): Promise<string>;
+export declare const sanitizeBranch: (branch: string) => string;
+export declare const worktreePath: (repo: string, branch: string) => string;
+/** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
+export declare function cleanupRunWorktrees(repo: string, branch: string, opts: {
+    removeIntegration: boolean;
+    removeTaskIds: string[];
+}): Promise<void>;
 export declare function resolveIntegrationBranch(repo: string, branch: string): Promise<string>;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
 export declare function removeWorktree(repo: string, dir: string): Promise<void>;

package/dist/run/git.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { drovrDir } from "../graph/graph.js";
@@ -47,7 +47,16 @@ export async function shOk(cmd, cwd) {
 export async function gitHead(cwd) {
     return (await shOk("git rev-parse HEAD", cwd)).trim();
 }
-const sanitize = (branch) => branch.replace(/[^\w.-]+/g, "-");
+export const sanitizeBranch = (branch) => branch.replace(/[^\w.-]+/g, "-");
+const sanitize = sanitizeBranch;
+export const worktreePath = (repo, branch) => join(drovrDir(repo), "worktrees", sanitize(branch));
+/** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
+export async function cleanupRunWorktrees(repo, branch, opts) {
+    if (opts.removeIntegration)
+        await removeWorktree(repo, worktreePath(repo, branch));
+    for (const id of opts.removeTaskIds)
+        await removeWorktree(repo, worktreePath(repo, `${branch}--${id}`));
+}
 const branchExists = async (repo, branch) => (await sh(`git rev-parse --verify ${shq(`refs/heads/${branch}`)}`, repo)).code === 0;
 export async function resolveIntegrationBranch(repo, branch) {
     if (!branch.startsWith("drovr/"))
@@ -68,8 +77,21 @@ export async function createWorktree(repo, branch, baseRef) {
     if (existsSync(dir))
         await removeWorktree(repo, dir);
     await shOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);
+    linkNodeModules(repo, dir);
     return dir;
 }
+// best-effort: devDep-based gates (tsx, vitest) shell out root-anchored and ENOENT in a bare
+// fresh worktree (OBS-27); failure here must never fail worktree creation
+function linkNodeModules(repo, dir) {
+    const src = join(repo, "node_modules");
+    const dest = join(dir, "node_modules");
+    if (!existsSync(src) || existsSync(dest))
+        return;
+    try {
+        symlinkSync(src, dest, "dir");
+    }
+    catch { /* best-effort */ }
+}
 export async function removeWorktree(repo, dir) {
     await sh(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
     await sh(`rm -rf ${shq(dir)}`, repo);

package/dist/run/lock.js

@@ -1,7 +1,7 @@
 import { linkSync, readFileSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
-import { drovrDir } from "../graph/graph.js";
+import { drovrDir, stateDirName } from "../graph/graph.js";
 // HARD-01/02: coarse per-run advisory lock over .drovr/graph.json. LOCK-02: the lock is created by
 // the link(2) idiom — write the full payload to graph.lock.<pid>.tmp, then linkSync(tmp, lockPath),
 // which is atomic and throws EEXIST if the lock already exists (the mutual-exclusion primitive).
@@ -125,11 +125,12 @@ export function acquireRunLock(repoRoot, runId) {
             const again = acquireRunLock(repoRoot, runId); // re-serializes two stealers through linkSync
             return { reclaimed: { pid: pid ?? -1, mtimeMs }, ...again };
         }
+        const stateDir = stateDirName(repoRoot);
         if (garbage)
-            throw new Error(".drovr/graph.lock holds an unreadable/garbage payload — refusing to reclaim it; run `drovr unlock` to remove it");
+            throw new Error(`${stateDir}/graph.lock holds an unreadable/garbage payload — refusing to reclaim it; run \`drovr unlock\` to remove it`);
         // LOCK-02: shouldRefuse is false whenever dead, so this throw is reached only for a LIVE holder
         // (incl. EPERM = alive-but-not-ours). The dead-but-fresh case self-clears via the reclaim branch.
-        throw new Error(`.drovr/graph.lock held by pid ${pid ?? "?"}${heldRun ? ` (run ${heldRun})` : ""} — another drovr run? (operator escape: \`drovr unlock\`)`);
+        throw new Error(`${stateDir}/graph.lock held by pid ${pid ?? "?"}${heldRun ? ` (run ${heldRun})` : ""} — another drovr run? (operator escape: \`drovr unlock\`)`);
     }
 }
 export function releaseRunLock(repoRoot) {
@@ -169,7 +170,7 @@ export function unlockRun(repoRoot) {
         return { held: false };
     } // statSync ENOENT ⇒ no lock
     if (!insp.dead && !insp.garbage) {
-        throw new Error(`.drovr/graph.lock held by LIVE pid ${insp.pid}${insp.runId ? ` (run ${insp.runId})` : ""} — refusing to unlock; stop that run first`);
+        throw new Error(`${stateDirName(repoRoot)}/graph.lock held by LIVE pid ${insp.pid}${insp.runId ? ` (run ${insp.runId})` : ""} — refusing to unlock; stop that run first`);
     }
     try {
         unlinkSync(p);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.33.5",
+  "version": "1.35.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -12,9 +12,9 @@ Use this to execute a requested sequence of repository specs. It is SDD-agnostic
 
 When working in a multi-agent terminal environment, decide your role before starting:
 
-- **Orchestrator:** your session was started to execute the mission. Run the loop below.
-- **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a verified send, then supervise it.
-- **Primary session without an orchestrator:** create one child orchestration session, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself.
+- **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane ORCHESTRATOR and run the loop below.
+- **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a verified send, then supervise it as OVERSEER.
+- **Primary session without an orchestrator:** rename your own tab OVERSEER, spawn one child orchestration session with `--permission-mode bypassPermissions`, label its tab ORCHESTRATOR, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself.
 
 Outside a multi-agent terminal environment, run the loop directly.
 

package/skills/tickmarkr-loop/SKILL.md

@@ -11,9 +11,9 @@ Use this for any spec that `tickmarkr compile` accepts. It is SDD-agnostic: use
 
 When working in a multi-agent terminal environment, decide your role before starting:
 
-- **Orchestrator:** your session was started to execute the mission. Run the loop below.
-- **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a verified send, then supervise it.
-- **Primary session without an orchestrator:** create one child orchestration session, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself.
+- **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane ORCHESTRATOR and run the loop below.
+- **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a verified send, then supervise it as OVERSEER.
+- **Primary session without an orchestrator:** rename your own tab OVERSEER, spawn one child orchestration session with `--permission-mode bypassPermissions`, label its tab ORCHESTRATOR, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself.
 
 Outside a multi-agent terminal environment, run the loop directly.