tickmarkr 1.37.0 → 1.40.0

package/dist/plan/scope.js

@@ -2,7 +2,7 @@ import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "no
 import { tmpdir } from "node:os";
 import { basename, dirname, extname, join } from "node:path";
 import { discoverChannels, getAdapter, probeAll } from "../adapters/registry.js";
-import { compileNative, NATIVE_MARKER } from "../compile/native.js";
+import { compileNative, LEGACY_PREFIX } from "../compile/native.js";
 import { pickDriver } from "../drivers/index.js";
 import { extractJson, runLlm } from "../gates/llm.js";
 import { TaskSchema } from "../graph/schema.js";
@@ -48,7 +48,7 @@ function section(source, name) {
     return lines.slice(start + 1, end === -1 ? undefined : end).join("\n");
 }
 function extractDraft(raw) {
-    const clean = raw.replace(/\nDROVR_EXIT:\d[\s\S]*$/, "").trim();
+    const clean = raw.replace(/\nTICKMARKR_EXIT:\d[\s\S]*$/, "").trim();
     try {
         const value = JSON.parse(clean);
         if (typeof value === "string")
@@ -64,18 +64,18 @@ function extractDraft(raw) {
     const fenced = [...clean.matchAll(/```(?:markdown|md)?\s*\n([\s\S]*?)```/gi)].at(-1)?.[1];
     if (fenced)
         return fenced;
-    const marker = clean.search(/<!--\s*(?:tickmarkr|drovr):spec/);
+    const marker = clean.search(new RegExp(`<!--\\s*(?:tickmarkr|${LEGACY_PREFIX}):spec`));
     return (marker === -1 ? clean : clean.slice(marker)).trimEnd() + "\n";
 }
 function validateDraft(draft) {
-    if (!NATIVE_MARKER.test(draft))
+    if (!/^<!--\s*tickmarkr:spec/.test(draft))
         throw new Error("draft is missing the tickmarkr native marker");
     if (!section(draft, "Assumptions").trim())
         throw new Error("draft is missing explicit assumptions");
     const requirements = [...new Set(section(draft, "Requirements").match(/\bREQ-\d{2}\b/g) ?? [])];
     if (!requirements.length)
         throw new Error("draft has no REQ-nn requirements");
-    const dir = mkdtempSync(join(tmpdir(), "drovr-scope-compile-"));
+    const dir = mkdtempSync(join(tmpdir(), "tickmarkr-scope-compile-"));
     const file = join(dir, "draft.spec.md");
     try {
         writeFileSync(file, draft);

package/dist/route/preference.d.ts

@@ -1,10 +1,10 @@
 import { type AuthHealth } from "../adapters/types.js";
-import type { DrovrConfig } from "../config/config.js";
+import type { TickmarkrConfig } from "../config/config.js";
 export interface Disallowed {
     by: "deny" | "allow";
     entry: string;
 }
-export declare function excludedChannels(cfg: DrovrConfig, adapters: {
+export declare function excludedChannels(cfg: TickmarkrConfig, adapters: {
     id: string;
 }[] | string[], health: Record<string, AuthHealth>): {
     key: string;
@@ -17,11 +17,11 @@ export declare function exclusionLine(excluded: {
 export declare function preferRanks(c: {
     adapter: string;
     model: string;
-}, cfg: DrovrConfig): {
+}, cfg: TickmarkrConfig): {
     shape: string;
     rank: number;
 }[];
 export declare function disallowedBy(c: {
     adapter: string;
     model: string;
-}, routing: DrovrConfig["routing"]): Disallowed | null;
+}, routing: TickmarkrConfig["routing"]): Disallowed | null;

package/dist/route/router.d.ts

@@ -1,5 +1,5 @@
 import { type Assignment, type BillingChannel } from "../adapters/types.js";
-import { type DrovrConfig } from "../config/config.js";
+import { type TickmarkrConfig } from "../config/config.js";
 import type { Task } from "../graph/schema.js";
 import { type RoutingProfile } from "./profile.js";
 export type LadderStep = "retry" | "escalate" | "consult" | "human";
@@ -30,5 +30,5 @@ export declare class RoutingError extends Error {
     constructor(msg: string);
 }
 export declare function marginalCostRank(c: BillingChannel): number;
-export declare function route(task: Task, cfg: DrovrConfig, channels: BillingChannel[], profile?: RoutingProfile, preferCtx?: RoutingPreferContext): Route;
-export declare function nextChannel(current: Assignment, task: Task, cfg: DrovrConfig, channels: BillingChannel[], tried: string[], profile?: RoutingProfile): Assignment | null;
+export declare function route(task: Task, cfg: TickmarkrConfig, channels: BillingChannel[], profile?: RoutingProfile, preferCtx?: RoutingPreferContext): Route;
+export declare function nextChannel(current: Assignment, task: Task, cfg: TickmarkrConfig, channels: BillingChannel[], tried: string[], profile?: RoutingProfile): Assignment | null;

package/dist/run/consult.d.ts

@@ -1,12 +1,15 @@
 import type { WorkerAdapter } from "../adapters/types.js";
-import type { DrovrConfig } from "../config/config.js";
+import type { TickmarkrConfig } from "../config/config.js";
 import type { ExecutorDriver, Slot } from "../drivers/types.js";
 import type { GateResult } from "../gates/types.js";
 export interface ConsultVerdict {
     action: "retry" | "reroute" | "decompose" | "human";
     notes: string;
+    reason?: string;
+    guidance?: string;
     excludeAdapter?: string;
 }
+export declare function renderRetryGuidance(v: ConsultVerdict): string;
 export interface Dossier {
     taskId: string;
     trigger: string;
@@ -16,7 +19,7 @@ export interface Dossier {
     gates: GateResult[];
 }
 export declare function buildDossierPrompt(d: Dossier): string;
-export declare function consult(d: Dossier, cfg: DrovrConfig, adapters: WorkerAdapter[], driver: ExecutorDriver, cwd: string, runDir: string, opts?: {
+export declare function consult(d: Dossier, cfg: TickmarkrConfig, adapters: WorkerAdapter[], driver: ExecutorDriver, cwd: string, runDir: string, opts?: {
     keep?: boolean;
     onSlot?: (slot: Slot) => void;
     runId?: string;

package/dist/run/consult.js

@@ -3,9 +3,24 @@ import { join } from "node:path";
 import { getAdapter } from "../adapters/registry.js";
 import { extractJson, gatePaneName } from "../gates/llm.js";
 import { sh } from "./git.js";
+const MAX_RETRY_GUIDANCE_LINES = 10;
+function guidanceParts(text) {
+    return text.split(/\n+/).flatMap((line) => line.split(/(?<=[.!?])\s+/)).map((s) => s.trim()).filter(Boolean);
+}
+// OBS-37a: retry worker prompts get structured bullets only — never the consult's raw notes prose
+// (herdr false-blocked when consult verdict text was echoed verbatim in a cursor worker prompt).
+export function renderRetryGuidance(v) {
+    const lines = [`Action: ${v.action}`];
+    if (v.reason)
+        lines.push(`Reason: ${v.reason}`);
+    const body = v.guidance ?? (v.reason ? "" : v.notes);
+    for (const part of guidanceParts(body))
+        lines.push(part);
+    return lines.slice(0, MAX_RETRY_GUIDANCE_LINES).map((l) => `- ${l}`).join("\n");
+}
 const ACTIONS = ["retry", "reroute", "decompose", "human"];
 export function buildDossierPrompt(d) {
-    return `DROVR-CONSULT
+    return `TICKMARKR-CONSULT
 You are a senior engineering consult for the tickmarkr orchestrator. A worker task hit trouble.
 Read the dossier and return a verdict. Be decisive; cost is the lowest priority, quality the highest.
 
@@ -32,12 +47,12 @@ trust dialog, broken install) — not when a single model produced bad code. Omi
 reroutes so other models of the same adapter remain eligible.
 
 Respond with ONLY this JSON:
-{"action": "retry" | "reroute" | "decompose" | "human", "notes": "one short paragraph of guidance", "excludeAdapter"?: "<adapter-id>"}
+{"action": "retry" | "reroute" | "decompose" | "human", "reason": "why this action", "guidance": "imperative steps for the worker (newline-separated ok)", "excludeAdapter"?: "<adapter-id>"}
 `;
 }
 let consultSeq = 0;
 export async function consult(d, cfg, adapters, driver, cwd, runDir, 
-// T2 ownership contract: runId names the consult pane canonically (drovr:consult:<task>:0:<runId>)
+// T2 ownership contract: runId names the consult pane canonically (tickmarkr:consult:<task>:0:<runId>)
 // via SlotOpts.owned; without it the legacy gatePaneName shape survives (non-daemon callers/tests).
 opts = {}) {
     const n = ++consultSeq;
@@ -58,10 +73,10 @@ opts = {}) {
             ...(opts.runId ? { owned: { role: "consult", taskId: d.taskId, attempt: 0, runId: opts.runId } } : {}),
         });
         opts.onSlot?.(slot);
-        await driver.run(slot, `${adapter.headlessCommand(promptFile, cfg.consult.model)}; printf '\\nDROVR_''EXIT:%s\\n' $?`);
-        // digit-suffixed marker only: a dossier quoting drovr's own "DROVR_EXIT:" literal must not
+        await driver.run(slot, `${adapter.headlessCommand(promptFile, cfg.consult.model)}; printf '\\nTICKMARKR_''EXIT:%s\\n' $?`);
+        // digit-suffixed marker only: a dossier quoting tickmarkr's own "TICKMARKR_EXIT:" literal must not
         // false-complete the consult pane before its verdict (same guard as daemon.ts:193 / llm.ts).
-        await driver.waitOutput(slot, "DROVR_EXIT:\\d", cfg.consult.stallMinutes * 60_000, { regex: true });
+        await driver.waitOutput(slot, "TICKMARKR_EXIT:\\d", cfg.consult.stallMinutes * 60_000, { regex: true });
         out = await driver.read(slot, 300);
         if (!opts.keep)
             await driver.close(slot);
@@ -76,5 +91,14 @@ opts = {}) {
     // zero-match expansion as channel-level reroute.
     const raw = v.excludeAdapter;
     const excludeAdapter = typeof raw === "string" && raw.length > 0 ? raw : undefined;
-    return { action: v.action, notes: String(v.notes ?? ""), ...(excludeAdapter ? { excludeAdapter } : {}) };
+    const reason = typeof v.reason === "string" ? v.reason : undefined;
+    const guidance = typeof v.guidance === "string" ? v.guidance : undefined;
+    const notes = String(v.notes ?? guidance ?? reason ?? "");
+    return {
+        action: v.action,
+        notes,
+        ...(reason ? { reason } : {}),
+        ...(guidance ? { guidance } : {}),
+        ...(excludeAdapter ? { excludeAdapter } : {}),
+    };
 }

package/dist/run/daemon.js

@@ -10,7 +10,7 @@ import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
 import { addEvidence, attributeBlocked, blockedTasks, getTask, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
-import { consult } from "./consult.js";
+import { consult, renderRetryGuidance } from "./consult.js";
 import { cleanupRunWorktrees, gitHead, sh } from "./git.js";
 import { Journal, loadRoutingProfile, newRunId } from "./journal.js";
 import { acquireRunLock, releaseRunLock } from "./lock.js";
@@ -53,7 +53,7 @@ export async function runDaemon(repoRoot, opts = {}) {
         const recordedBranch = typeof branchEvent?.data.branch === "string" ? branchEvent.data.branch : undefined;
         const branch = recordedBranch
             ? branchEvent.event === "merge" ? recordedBranch.slice(0, recordedBranch.lastIndexOf("--")) : recordedBranch
-            : opts.resume ? `drovr/${runId}` : integrationBranch(cfg, runId);
+            : integrationBranch(cfg, runId);
         if (lock.reclaimed)
             journal.append("lock-reclaimed", undefined, lock.reclaimed); // HARD-02 audit trail
         // GATE-08 (v1.12): the humanGate guard consults this run's journaled approvals, not just the compiled
@@ -127,14 +127,14 @@ export async function runDaemon(repoRoot, opts = {}) {
         };
         await reconcile(); // run start/resume boundary: nothing in flight — full sweep, incl. older runs' leftovers
         // v1.4 self-reference guard: a random nonce on the worker trailer AND exit marker. Displayed
-        // source/diffs (e.g. a worker editing drovr's own prompt.ts/daemon.ts) can't know it, so an echoed
-        // DROVR_RESULT/DROVR_EXIT literal can never premature-harvest the worker. Quote-split keeps the
+        // source/diffs (e.g. a worker editing tickmarkr's own prompt.ts/daemon.ts) can't know it, so an echoed
+        // TICKMARKR_RESULT/TICKMARKR_EXIT literal can never premature-harvest the worker. Quote-split keeps the
         // echoed command line itself from matching the marker it prints.
         //
         // v1.13 (VIS-09 safety, 43-02): the nonce is per-ATTEMPT, declared at the top of the attempt loop
         // below — NOT here at run scope. A run-scoped nonce is a latent hazard: HerdrDriver.read() is
         // `pane read --lines 1000` over scrollback and SubprocessDriver never clears s.buf, so any transcript
-        // retention across attempts would let attempt N harvest attempt N-1's DROVR_RESULT out of scrollback
+        // retention across attempts would let attempt N harvest attempt N-1's TICKMARKR_RESULT out of scrollback
         // as its OWN completion — silently LYING about a worker's outcome. Pinned by the stale-trailer oracle
         // in tests/run/daemon.test.ts ("a retained prior-attempt trailer cannot complete a retry"); a future
         // hoist back to run scope reddens it.
@@ -159,6 +159,7 @@ export async function runDaemon(repoRoot, opts = {}) {
         };
         const execTask = async (t) => {
             const startMs = Date.now();
+            const taskTimeoutMinutes = t.timeoutMinutes ?? cfg.taskTimeoutMinutes;
             if (t.humanGate && !approved.has(t.id)) {
                 // GATE-08: the condition is the APPROVAL, never the code path. `!opts.resume` (or any run-phase
                 // term) would silently dispatch every unapproved gate that becomes ready during a resume — pinned
@@ -252,11 +253,13 @@ export async function runDaemon(repoRoot, opts = {}) {
             const applyVerdict = async (v, attempts, trigger) => {
                 journal.append("consult-verdict", t.id, {
                     action: v.action, notes: v.notes,
+                    ...(v.reason ? { reason: v.reason } : {}),
+                    ...(v.guidance ? { guidance: v.guidance } : {}),
                     ...(v.excludeAdapter ? { excludeAdapter: v.excludeAdapter } : {}),
                 });
                 await driver.notify(`tickmarkr ${runId}: ${t.id} consult verdict: ${v.action}`, { tier: "attention" });
                 if (v.action === "retry") {
-                    feedback = v.notes || feedback;
+                    feedback = renderRetryGuidance(v) || feedback;
                     return true;
                 }
                 if (v.action === "reroute") {
@@ -294,8 +297,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // v1.13 (VIS-09 safety): one FRESH nonce per attempt — see the run-scope comment above. A retained
                 // prior-attempt trailer (herdr scrollback / subprocess buffer) must never satisfy this attempt.
                 const nonce = randomBytes(4).toString("hex");
-                const exitMarkerCmd = `printf '\\nDROVR_''EXIT_${nonce}:%s\\n' $?`;
-                const exitRe = new RegExp(`DROVR_EXIT_${nonce}:(\\d+)`);
+                const exitMarkerCmd = `printf '\\nTICKMARKR_''EXIT_${nonce}:%s\\n' $?`;
+                const exitRe = new RegExp(`TICKMARKR_EXIT_${nonce}:(\\d+)`);
                 if (attempt >= MAX_ATTEMPTS) {
                     await park(t, `attempt cap (${MAX_ATTEMPTS}) reached`, "attempt-cap", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
                     return;
@@ -404,13 +407,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                     finished = false;
                     exitCode = null;
                     output = "";
-                    const deadline = Date.now() + cfg.taskTimeoutMinutes * 60_000;
+                    const deadline = Date.now() + taskTimeoutMinutes * 60_000;
                     while (Date.now() < deadline) {
                         const sliceStart = Date.now();
                         const slice = Math.min(BLOCKED_POLL_MS, deadline - sliceStart);
-                        if (await driver.waitOutput(slot, `(${trailerPattern(nonce)})|DROVR_EXIT_${nonce}:\\d`, slice, { regex: true })) {
-                            // verify before accepting: a worker that merely DISPLAYS a marker (e.g. editing drovr's
-                            // own source, where "DROVR_EXIT:" is a string literal) must not end the wait. Only a
+                        if (await driver.waitOutput(slot, `(${trailerPattern(nonce)})|TICKMARKR_EXIT_${nonce}:\\d`, slice, { regex: true })) {
+                            // verify before accepting: a worker that merely DISPLAYS a marker (e.g. editing tickmarkr's
+                            // own source, where "TICKMARKR_EXIT:" is a string literal) must not end the wait. Only a
                             // parseable trailer or a digit-suffixed exit marker in the harvest is completion.
                             output = await driver.read(slot, 1000); // TUI transcripts carry chrome — read deeper than print's 500
                             finished = new RegExp(trailerPattern(nonce)).test(output);
@@ -429,7 +432,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const st = paged ? "" : await driver.status(slot);
                         if (!paged && (st === "blocked" || st === "idle")) {
                             // T5: once-per-slot auto-answer when the adapter declares a trust dialog and the pane
-                            // text matches. drovr created the worktree from the operator's own repo — safe by construction.
+                            // text matches. tickmarkr created the worktree from the operator's own repo — safe by construction.
                             if (!trustAnswered && adapter.trustDialog && driver.sendKey) {
                                 try {
                                     const paneText = await driver.read(slot, 80);
@@ -473,11 +476,21 @@ export async function runDaemon(repoRoot, opts = {}) {
                 else {
                     const inv = adapter.invoke(t, wt, assignment, { promptFile });
                     await driver.run(slot, `${inv.command}; ${exitMarkerCmd}`);
-                    finished = await driver.waitOutput(slot, `DROVR_EXIT_${nonce}:\\d`, cfg.taskTimeoutMinutes * 60_000, { regex: true });
+                    finished = await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, taskTimeoutMinutes * 60_000, { regex: true });
                     output = await driver.read(slot, 500);
                     exitCode = Number(exitRe.exec(output)?.[1] ?? 1);
                 }
-                if (keepOpen)
+                // SPEND-01 interactive metering race: the harvest loop breaks on the trailer, but the worker
+                // shell may still be running post-trailer bookkeeping (session-store flush, fake usage stamp,
+                // exit wrapper). Print mode already waits for TICKMARKR_EXIT, which follows that tail; drain
+                // interactive attempts to the same exit marker before close and the post-hoc usage disk read
+                // so a writer never races the reader (real CLIs can flush usage asynchronously after the trailer).
+                if (interactive && finished && !exitRe.test(output)) {
+                    await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, 2_000, { regex: true });
+                }
+                // keepPanes retains visible context, not a timed-out subprocess tree. Close before consult/retry
+                // can recreate the worktree; Herdr and subprocesses that reached their exit marker stay unchanged.
+                if (keepOpen && (finished || driver.id !== "subprocess"))
                     keptSlots.push(slot);
                 else
                     await driver.close(slot);
@@ -536,7 +549,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts: attempt + 1, outcome: "failed", durationMs: 0, overrun: true, retryMode });
                     const v = await runConsult("stall", output, exitCode !== null && interactive
                         ? `worker process exited (code ${exitCode}) without a trailer`
-                        : `no completion marker within ${cfg.taskTimeoutMinutes}m`, []);
+                        : `no completion marker within ${taskTimeoutMinutes}m`, []);
                     if (await applyVerdict(v, attempt + 1, "stall"))
                         continue;
                     return;
@@ -548,7 +561,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         return;
                     const g = e.result;
                     // GATE-09 (ROADMAP SC-4): journal every judge retry as an attributable event — which gate flaked,
-                    // which channel flaked, which channel retried — so `drovr journal`/report can distinguish "judge
+                    // which channel flaked, which channel retried — so `tickmarkr journal`/report can distinguish "judge
                     // flaked, retried" from "worker failed" (run-20260711-185020 P43-03 L70-72 billed a judge flake as
                     // a worker attempt; 47-01 fixed WHO retries, this closes the audit-trail half). The condition is
                     // META-ONLY (D-03): gate === "acceptance" + typeof-shape guards on meta.judgeRetry — never a
@@ -583,7 +596,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // D-07: judge/review panes self-clean when their verdict is read (keepLlm) — only "forever" keeps them.
                                 keep: keepLlm,
                                 onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined,
-                                // T2 ownership contract: canonical names (drovr:<role>:<task>:0:<runId>) so reconcile
+                                // T2 ownership contract: canonical names (tickmarkr:<role>:<task>:0:<runId>) so reconcile
                                 // owns judge/review panes; run-gates' -r1 retry suffix becomes attempt 1 in llm.ts.
                                 // Same-name reuse across worker attempts is safe: panes self-clean when read (keepLlm),
                                 // and herdr's DEFECT-01 reclaim covers a kept holdover under keepPanes:forever.

package/dist/run/git.d.ts

@@ -14,6 +14,6 @@ export declare function cleanupRunWorktrees(repo: string, branch: string, opts:
     removeIntegration: boolean;
     removeTaskIds: string[];
 }): Promise<void>;
-export declare function resolveIntegrationBranch(repo: string, branch: string): Promise<string>;
+export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
 export declare function removeWorktree(repo: string, dir: string): Promise<void>;

package/dist/run/git.js

@@ -2,7 +2,7 @@ import { spawn } from "node:child_process";
 import { existsSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
-import { drovrDir } from "../graph/graph.js";
+import { tickmarkrDir } from "../graph/graph.js";
 // stdin "ignore": same class as HARD-05 / SubprocessDriver — never leave an open pipe a child can block on
 // (pi -p / codex exec wait for stdin EOF). timedOut distinguishes SIGKILL-timeout from a real nonzero exit.
 export function sh(cmd, cwd, timeoutMs = 600000) {
@@ -49,7 +49,7 @@ export async function gitHead(cwd) {
 }
 export const sanitizeBranch = (branch) => branch.replace(/[^\w.-]+/g, "-");
 const sanitize = sanitizeBranch;
-export const worktreePath = (repo, branch) => join(drovrDir(repo), "worktrees", sanitize(branch));
+export const worktreePath = (repo, branch) => join(tickmarkrDir(repo), "worktrees", sanitize(branch));
 /** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
 export async function cleanupRunWorktrees(repo, branch, opts) {
     if (opts.removeIntegration)
@@ -57,12 +57,8 @@ export async function cleanupRunWorktrees(repo, branch, opts) {
     for (const id of opts.removeTaskIds)
         await removeWorktree(repo, worktreePath(repo, `${branch}--${id}`));
 }
-const branchExists = async (repo, branch) => (await sh(`git rev-parse --verify ${shq(`refs/heads/${branch}`)}`, repo)).code === 0;
-export async function resolveIntegrationBranch(repo, branch) {
-    if (!branch.startsWith("drovr/"))
-        return branch;
-    const legacy = `drover/${branch.slice("drovr/".length)}`;
-    return !(await branchExists(repo, branch)) && await branchExists(repo, legacy) ? legacy : branch;
+export async function resolveIntegrationBranch(_repo, branch) {
+    return branch;
 }
 const resolveTaskBranch = async (repo, branch) => {
     const split = branch.lastIndexOf("--");
@@ -73,7 +69,7 @@ const resolveTaskBranch = async (repo, branch) => {
 };
 export async function createWorktree(repo, branch, baseRef) {
     branch = await resolveTaskBranch(repo, branch);
-    const dir = join(drovrDir(repo), "worktrees", sanitize(branch));
+    const dir = join(tickmarkrDir(repo), "worktrees", sanitize(branch));
     if (existsSync(dir))
         await removeWorktree(repo, dir);
     await shOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);

package/dist/run/journal.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { type Assignment } from "../adapters/types.js";
-import type { DrovrConfig } from "../config/config.js";
+import type { TickmarkrConfig } from "../config/config.js";
 import { type TaskStatus } from "../graph/schema.js";
 import { type RoutingProfile } from "../route/profile.js";
 export interface JournalEvent {
@@ -70,7 +70,7 @@ export declare function readAllTelemetry(repoRoot: string, lastK: number, opts?:
 })[];
 export declare const RUNS_WINDOW = 50;
 export declare function readProfileCursor(repoRoot: string): string | undefined;
-export declare function loadRoutingProfile(repoRoot: string, cfg: DrovrConfig, opts?: {
+export declare function loadRoutingProfile(repoRoot: string, cfg: TickmarkrConfig, opts?: {
     preview?: boolean;
 }): RoutingProfile | undefined;
 export declare class Journal {

package/dist/run/journal.js

@@ -123,8 +123,8 @@ export function readAllTelemetry(repoRoot, lastK, opts = {}) {
 }
 // ponytail: fixed 50-run window; promote to a routing.learned.* config knob only if operators need to tune it.
 export const RUNS_WINDOW = 50;
-// VIS-03 reset cursor — one trimmed runId line at .drovr/profile-since; absent/empty ⇒ undefined.
-// Opaque: used ONLY in the runId > comparison above, never a shell or path join beyond .drovr/.
+// VIS-03 reset cursor — one trimmed runId line at .tickmarkr/profile-since; absent/empty ⇒ undefined.
+// Opaque: used ONLY in the runId > comparison above, never a shell or path join beyond .tickmarkr/.
 export function readProfileCursor(repoRoot) {
     const path = join(repoRoot, stateDirName(repoRoot), "profile-since");
     if (!existsSync(path))
@@ -132,7 +132,7 @@ export function readProfileCursor(repoRoot) {
     return readFileSync(path, "utf8").trim() || undefined;
 }
 // The one shared profile builder (criterion 4: plan and daemon share ONE code path).
-// preview:true bypasses the routing.learned:off short-circuit so `drovr plan` can render the
+// preview:true bypasses the routing.learned:off short-circuit so `tickmarkr plan` can render the
 // trust-ramp preview while the daemon (no preview) stays inert (VALIDATION 13-01-11).
 export function loadRoutingProfile(repoRoot, cfg, opts = {}) {
     if (cfg.routing.learned === "off" && !opts.preview)
@@ -218,7 +218,7 @@ export class Journal {
     // lastAssignment} from EXISTING events only (task-dispatch + consult-verdict + optional v1.24
     // task-approved{release:attempt-cap}). Additive-only: no new required event, no schema change, the
     // status replay above is byte-untouched (corpus criterion 3 is git-diff-provable). Motivated by the
-    // 2026-07-11 incident (run-20260711-185020, P43-03): `drovr resume` re-dispatched at attempt 0 on
+    // 2026-07-11 incident (run-20260711-185020, P43-03): `tickmarkr resume` re-dispatched at attempt 0 on
     // pi:zai/glm-5.2, the exact channel a frontier consult had just banned, because execTask's
     // attempt/tried/assignment state is loop-local and dies with the process while the journal held every fact needed.
     //

package/dist/run/lock.js

@@ -1,14 +1,14 @@
 import { linkSync, readFileSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
-import { drovrDir, stateDirName } from "../graph/graph.js";
-// HARD-01/02: coarse per-run advisory lock over .drovr/graph.json. LOCK-02: the lock is created by
+import { tickmarkrDir, stateDirName } from "../graph/graph.js";
+// HARD-01/02: coarse per-run advisory lock over .tickmarkr/graph.json. LOCK-02: the lock is created by
 // the link(2) idiom — write the full payload to graph.lock.<pid>.tmp, then linkSync(tmp, lockPath),
 // which is atomic and throws EEXIST if the lock already exists (the mutual-exclusion primitive).
 // rename() was REJECTED: it silently clobbers an existing destination, destroying that mutual
 // exclusion (two daemons would both "acquire"). LOCK-02 (OBS-05): a PROVABLY-dead holder (ESRCH)
 // self-clears immediately — expiry is NOT required. ESRCH is proof-positive death; the PID-reuse
-// hazard runs the OTHER way (a reused pid reads ALIVE and refuses until `drovr unlock`). mtime stays
+// hazard runs the OTHER way (a reused pid reads ALIVE and refuses until `tickmarkr unlock`). mtime stays
 // the heartbeat — it feeds the reclaim race guard (ino+mtime re-stat) and the reclaimed audit value.
 // Zero new deps — node:fs stdlib.
 export const HEARTBEAT_MS = 10_000;
@@ -16,7 +16,7 @@ export const STALE_MS = 60_000; // 6× heartbeat headroom; PITFALLS floor is ≥
 // T-10-01: the payload is a trust boundary — parse with zod, fail closed on garbage. Only
 // pid/runId/startedAt are ever read; anything else is ignored (info-disclosure surface).
 const PayloadSchema = z.object({ pid: z.number().int().positive(), runId: z.string(), startedAt: z.number() });
-const lockPath = (repoRoot) => join(drovrDir(repoRoot), "graph.lock");
+const lockPath = (repoRoot) => join(tickmarkrDir(repoRoot), "graph.lock");
 let heartbeat;
 let heldPath;
 // Best-effort release if the daemon exits without hitting its finally (crash mid-body). NO
@@ -33,12 +33,12 @@ process.once("exit", () => { if (heldPath)
 // `expired` for the race guard + reclaim audit); the heartbeat mechanism itself is untouched.
 // ponytail: a pid REUSED by an unrelated live process reads ALIVE (kill(pid,0) succeeds) and now
 // refuses indefinitely instead of expiring out in ≤60s — that is the fail-closed direction; the
-// escape hatch is `drovr unlock`. Acceptable for a single-machine tool (ESRCH is the only
+// escape hatch is `tickmarkr unlock`. Acceptable for a single-machine tool (ESRCH is the only
 // proof-positive death; narrowing further needs pid-start-time correlation, out of scope here).
 // LOCK-01: garbage ⇒ always refuse (mtime irrelevant). It short-circuits before dead can matter —
 // so inspect()'s `dead = pid === undefined` fallback for the garbage row stays harmless. Safe post-16-01:
-// the atomic link(2) write means drovr can no longer mint garbage itself; a garbage payload can only
-// come from external corruption, which is exactly what must refuse. Only `drovr unlock` removes it
+// the atomic link(2) write means tickmarkr can no longer mint garbage itself; a garbage payload can only
+// come from external corruption, which is exactly what must refuse. Only `tickmarkr unlock` removes it
 // — a self-heal reclaim would silently overwrite whatever corrupted the file.
 export function shouldRefuse(i) {
     return i.garbage || !i.dead;
@@ -49,7 +49,7 @@ function inspect(p) {
     const mtimeMs = st.mtimeMs;
     const expired = Date.now() - mtimeMs > STALE_MS;
     const parsed = PayloadSchema.safeParse(readPayload(p));
-    const garbage = !parsed.success; // LOCK-01: its own state — shouldRefuse refuses it unconditionally; only `drovr unlock` removes it
+    const garbage = !parsed.success; // LOCK-01: its own state — shouldRefuse refuses it unconditionally; only `tickmarkr unlock` removes it
     const pid = parsed.success ? parsed.data.pid : undefined;
     let dead = pid === undefined; // harmless fallback for the garbage row — garbage short-circuits shouldRefuse before this is read
     if (pid !== undefined) {
@@ -81,7 +81,7 @@ function unlinkIfOurs(p) {
 }
 export function acquireRunLock(repoRoot, runId) {
     const p = lockPath(repoRoot);
-    const tmp = join(drovrDir(repoRoot), `graph.lock.${process.pid}.tmp`);
+    const tmp = join(tickmarkrDir(repoRoot), `graph.lock.${process.pid}.tmp`);
     try {
         try {
             unlinkSync(tmp);
@@ -127,10 +127,10 @@ export function acquireRunLock(repoRoot, runId) {
         }
         const stateDir = stateDirName(repoRoot);
         if (garbage)
-            throw new Error(`${stateDir}/graph.lock holds an unreadable/garbage payload — refusing to reclaim it; run \`drovr unlock\` to remove it`);
+            throw new Error(`${stateDir}/graph.lock holds an unreadable/garbage payload — refusing to reclaim it; run \`tickmarkr unlock\` to remove it`);
         // LOCK-02: shouldRefuse is false whenever dead, so this throw is reached only for a LIVE holder
         // (incl. EPERM = alive-but-not-ours). The dead-but-fresh case self-clears via the reclaim branch.
-        throw new Error(`${stateDir}/graph.lock held by pid ${pid ?? "?"}${heldRun ? ` (run ${heldRun})` : ""} — another drovr run? (operator escape: \`drovr unlock\`)`);
+        throw new Error(`${stateDir}/graph.lock held by pid ${pid ?? "?"}${heldRun ? ` (run ${heldRun})` : ""} — another tickmarkr run? (operator escape: \`tickmarkr unlock\`)`);
     }
 }
 export function releaseRunLock(repoRoot) {

package/dist/run/merge.d.ts

@@ -1,4 +1,4 @@
-import type { DrovrConfig } from "../config/config.js";
+import type { TickmarkrConfig } from "../config/config.js";
 export interface TipVerifyResult {
     gate: string;
     cmd: string;
@@ -7,7 +7,7 @@ export interface TipVerifyResult {
     fingerprints: string[];
     details: string;
 }
-export declare function integrationBranch(cfg: DrovrConfig, runId: string): string;
+export declare function integrationBranch(cfg: TickmarkrConfig, runId: string): string;
 export declare function ensureIntegration(repo: string, branch: string, baseRef: string): Promise<string>;
 export declare function integrationHead(intWt: string): Promise<string>;
 export declare function mergeTask(intWt: string, taskBranch: string, message: string, gatedCommit: string): Promise<{

package/dist/run/merge.js

@@ -2,15 +2,15 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { fingerprint } from "../gates/baseline.js";
-import { drovrDir } from "../graph/graph.js";
+import { tickmarkrDir } from "../graph/graph.js";
 import { gitHead, resolveIntegrationBranch, sh, shOk } from "./git.js";
 export function integrationBranch(cfg, runId) {
-    return `tickmarkr/${runId}`;
+    return `${cfg.integrationBranchPrefix}${runId}`;
 }
 const sanitize = (branch) => branch.replace(/[^\w.-]+/g, "-");
 export async function ensureIntegration(repo, branch, baseRef) {
     branch = await resolveIntegrationBranch(repo, branch);
-    const dir = join(drovrDir(repo), "worktrees", sanitize(branch));
+    const dir = join(tickmarkrDir(repo), "worktrees", sanitize(branch));
     if (existsSync(join(dir, ".git")))
         return dir; // resume: keep existing tip
     const exists = (await sh(`git rev-parse --verify refs/heads/${shq(branch)}`, repo)).code === 0;

package/dist/run/reconcile.js

@@ -1,6 +1,6 @@
 import { formatOwnedName, isForeignName, panesToClose, parseOwnedName } from "../drivers/types.js";
 export { isForeignName, panesToClose, parseOwnedName };
-// T1: pure fold over journal rows — the exact set of drovr-owned pane/tab names that SHOULD exist
+// T1: pure fold over journal rows — the exact set of tickmarkr-owned pane/tab names that SHOULD exist
 // right now for a live run. No I/O: the caller supplies rows (Journal.read()) and a live pane listing
 // separately. Anything owned (parseOwnedName succeeds) but not in this set is garbage to close;
 // anything foreign (parseOwnedName fails) is never a candidate, no matter what state it's in.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.37.0",
+  "version": "1.40.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -22,7 +22,7 @@
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "schema": "tsx scripts/emit-schema.ts",
-    "e2e": "DROVR_E2E=1 vitest run tests/e2e --testTimeout 900000"
+    "e2e": "TICKMARKR_E2E=1 vitest run tests/e2e --testTimeout 900000"
   },
   "dependencies": {
     "picomatch": "^4.0.2",

package/schema/rungraph.schema.json

@@ -244,6 +244,10 @@
             "default": false,
             "type": "boolean"
           },
+          "timeoutMinutes": {
+            "type": "number",
+            "exclusiveMinimum": 0
+          },
           "status": {
             "default": "pending",
             "type": "string",

package/skills/tickmarkr-auto/SKILL.md

@@ -13,7 +13,7 @@ Use this to execute a requested sequence of repository specs. It is SDD-agnostic
 When working in a multi-agent terminal environment, decide your role before starting:
 
 - **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane ORCHESTRATOR and run the loop below.
-- **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a verified send, then supervise it as OVERSEER.
+- **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
 - **Primary session without an orchestrator:** rename your own tab OVERSEER, spawn one child orchestration session with `--permission-mode bypassPermissions`, label its tab ORCHESTRATOR, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself.
 
 Outside a multi-agent terminal environment, run the loop directly.
@@ -30,9 +30,30 @@ Outside a multi-agent terminal environment, run the loop directly.
 
 Run every requested target in order without seeking routine confirmation. Stop only for a blocked agent interaction, a genuinely unresolved stalled task, a designed human gate, or a failed run that needs a human decision. Diagnose from the journal and evidence first; self-release and resume only after fixing and verifying a harness defect.
 
+## Binary preflight (before compile or run)
+
+Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary against the repository's `package.json` version:
+
+1. Run `tickmarkr version` (one line, machine-parseable).
+2. Read the `version` field from the repository's `package.json`.
+3. If the binary is **older on major.minor** than the repo (e.g. binary `1.36.x` vs repo `1.38.x`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+
+A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
+
+## Verified handoffs (agent-to-agent messaging)
+
+When relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39).
+
+Use one of:
+
+- `herdr pane run <pane> "<message>"` — text plus Enter in the target shell
+- `herdr notification show "<message>"` — OS-level delivery for the operator
+
+After sending, **confirm delivery** by reading the target pane and verifying the message landed (input empty, agent status `working`, or notification acknowledged). Never report "briefed" or "relayed" without read-back confirmation.
+
 ## Per-spec loop
 
-1. **Prepare** — confirm the target list, check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
+1. **Prepare** — confirm the target list. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
 4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal event rather than polling agents. Resolve blocked interactions in the relevant agent session.