tickmarkr 1.42.0 → 1.44.0

package/dist/brand.d.ts

@@ -2,3 +2,8 @@ export declare const BANNER: string;
 /** ANSI-stripped, trailing-space-trimmed twin of BANNER — README hero and other plain surfaces. */
 export declare const PLAIN_BANNER: string;
 export declare function bannerShell(): string;
+export declare const TICKMARKR_EXIT_TRAILER = "printf '\\nTICKMARKR_''EXIT:%s\\n' $?";
+/** OBS-50: visible-pane bootstrap script — banner + agent command + byte-identical exit trailer. */
+export declare function paneDispatchScript(body: string[]): string;
+/** OBS-50: one short herdr pane-run line; bootstrap lives in the script file beside the prompt. */
+export declare function paneDispatchCommand(scriptPath: string): string;

package/dist/brand.js

@@ -17,3 +17,14 @@ export function bannerShell() {
     const printable = BANNER.replaceAll("\x1b", "\\033").replaceAll("\n", "\\n");
     return `printf '%b\\n' '${printable}'`;
 }
+// OBS-50: quote-split exit marker — herdr echoes the typed command into the transcript that
+// waitOutput matches, so the literal must not appear unsplit in the dispatch line.
+export const TICKMARKR_EXIT_TRAILER = `printf '\\nTICKMARKR_''EXIT:%s\\n' $?`;
+/** OBS-50: visible-pane bootstrap script — banner + agent command + byte-identical exit trailer. */
+export function paneDispatchScript(body) {
+    return ["export BASH_SILENCE_DEPRECATION_WARNING=1", ...body, TICKMARKR_EXIT_TRAILER].join("\n");
+}
+/** OBS-50: one short herdr pane-run line; bootstrap lives in the script file beside the prompt. */
+export function paneDispatchCommand(scriptPath) {
+    return `bash ${JSON.stringify(scriptPath)}`;
+}

package/dist/cli/commands/status.js

@@ -1,9 +1,10 @@
 import { BANNER } from "../../brand.js";
 import { blockedTasks, loadGraph, pendingTasks } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
-import { Journal } from "../../run/journal.js";
+import { Journal, journalComparable } from "../../run/journal.js";
 // ponytail: fixed 2s refresh; promote to config.visibility.* only when an operator asks.
 const REFRESH_MS = 2000;
+const NOT_COMPARABLE_NOTICE = "graph recompiled since this run — task states not comparable; run `tickmarkr run` to execute";
 // The timer must keep the process ALIVE: an unref'd timer here let the event loop drain after the
 // first frame, so a live `--watch` printed once and exited 0 (OBS-11). Never unref this.
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -40,6 +41,7 @@ const gateBox = (state, unicode) => {
         return state === "pass" ? "✓" : state === "fail" ? "✗" : state === "skip" ? "·" : "☐";
     return state === "pass" ? "[x]" : state === "fail" ? "[!]" : state === "skip" ? "." : "[ ]";
 };
+const defaultGateStates = (task) => GATE_NAMES.map((gate) => task.gates.includes(gate) ? "open" : "skip");
 const gateStates = (task, events) => {
     const outcomes = new Map();
     const start = attemptStartIdx(events, task.id);
@@ -121,18 +123,23 @@ const renderFrame = (cwd) => {
     let replayed = null;
     let events = [];
     const contexts = new Map();
+    let comparable = false;
     if (runId) {
         const j = Journal.open(cwd, runId);
         events = j.read();
-        replayed = j.replayStatuses();
-        for (const e of events) {
-            if (e.event === "task-dispatch" && e.taskId) {
-                const a = e.data.assignment;
-                if (typeof a.adapter === "string" && typeof a.model === "string")
-                    assignments.set(e.taskId, `${a.adapter}:${a.model}`);
-            }
-            if (e.event === "context-sample" && e.taskId && typeof e.data.tokens === "number" && Number.isFinite(e.data.tokens)) {
-                contexts.set(e.taskId, e.data.tokens); // last write wins
+        // OBS-52: refuse journal join when the run's recorded graphHash ≠ loaded graph — bare task-id replay lied after recompile.
+        comparable = journalComparable(events, g.spec.hash);
+        if (comparable) {
+            replayed = j.replayStatuses();
+            for (const e of events) {
+                if (e.event === "task-dispatch" && e.taskId) {
+                    const a = e.data.assignment;
+                    if (typeof a.adapter === "string" && typeof a.model === "string")
+                        assignments.set(e.taskId, `${a.adapter}:${a.model}`);
+                }
+                if (e.event === "context-sample" && e.taskId && typeof e.data.tokens === "number" && Number.isFinite(e.data.tokens)) {
+                    contexts.set(e.taskId, e.data.tokens); // last write wins
+                }
             }
         }
     }
@@ -148,7 +155,7 @@ const renderFrame = (cwd) => {
         const label = starved.has(t.id) ? " starved" : waiting.has(t.id) ? " dep-waiting" : "";
         const channel = assignments.get(t.id) ?? "-";
         const assignCol = contexts.has(t.id) ? `${channel}${divider}ctx ${contexts.get(t.id)}` : channel;
-        return { t, st, label, assignCol, states: gateStates(t, events) };
+        return { t, st, label, assignCol, states: comparable ? gateStates(t, events) : defaultGateStates(t) };
     });
     const statusColor = (st) => st === "done" ? 32 : st === "failed" ? 31 : st === "human" ? 33 : 36;
     if (!unicode) {
@@ -160,7 +167,7 @@ const renderFrame = (cwd) => {
             return `${prefix}${shortGoal(t.goal, Math.max(0, width - prefix.length - suffix.length))}${suffix}`;
         });
         const header = runId
-            ? `tickmarkr status${divider}run ${runId}${divider}${liveness(events).replaceAll(" · ", divider)}${divider}${done}/${g.tasks.length} done`
+            ? `tickmarkr status${divider}run ${runId}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events).replaceAll(" · ", divider)}${divider}${done}/${g.tasks.length} done`
             : `tickmarkr status${divider}no runs yet${divider}${done}/${g.tasks.length} done`;
         const legend = `  gates: ${GATE_NAMES.map((gate) => `${GATE_KEYS[gate]} ${gate}`).join(divider)}`;
         return [header, legend, ...rows].join("\n");
@@ -181,7 +188,9 @@ const renderFrame = (cwd) => {
         .replaceAll(" · ", dot);
     const tally = `${done}/${g.tasks.length} done`;
     const header = ` ${color("✓", 32, true)} ${color("tickmarkr", 1, true)}${dot}` +
-        (runId ? `run ${runId}${dot}${live}${dot}` : `no runs yet${dot}`) +
+        (runId
+            ? `run ${runId}${dot}${!comparable ? `${NOT_COMPARABLE_NOTICE}${dot}` : ""}${live}${dot}`
+            : `no runs yet${dot}`) +
         `${gauge} ${done === g.tasks.length && g.tasks.length > 0 ? color(tally, 32, true) : tally}`;
     const rule = dim("─".repeat(Math.min(width, 100)));
     const legend = dim(`   gates: ${GATE_NAMES.map((gate) => `${GATE_KEYS[gate]} ${gate}`).join(" · ")}`);

package/dist/compile/native.js

@@ -144,6 +144,15 @@ export function compileNative(file) {
     if (plainCount > 0) {
         console.warn(`tickmarkr: ${plainCount} acceptance item${plainCount === 1 ? "" : "s"} in ${file} ${plainCount === 1 ? "is a plain string" : "are plain strings"} — compiled as judge oracle${plainCount === 1 ? "" : "s"}. Prefix with command:/test:/judge: to make the oracle explicit.`);
     }
+    // OBS-51: semicolon-joined judge criteria invite intermittent clause-split verdicts — warn per item.
+    for (const draft of drafts) {
+        for (const item of draft.acceptance) {
+            const text = typeof item === "string" ? item : item.oracle === "judge" ? item.text : null;
+            if (text?.includes(";")) {
+                console.warn(`tickmarkr: OBS-51: task ${draft.id} judge criterion contains semicolon-joined clauses — split into separate acceptance items: ${JSON.stringify(text)}`);
+            }
+        }
+    }
     return result;
 }
 // Commented native spec written to tickmarkr.spec.md by `tickmarkr init`. Documented via HTML comments (which the

package/dist/gates/acceptance.js

@@ -1,7 +1,8 @@
 import { channelKey, shq } from "../adapters/types.js";
 import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
-import { sh, shOk } from "../run/git.js";
+import { sh } from "../run/git.js";
+import { checkDiffCap, fetchTaskDiff } from "./review.js";
 import { extractJson, runLlm } from "./llm.js";
 const isCommand = (a) => typeof a === "object" && a.oracle === "command";
 const isTest = (a) => typeof a === "object" && a.oracle === "test";
@@ -57,12 +58,11 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
     const warn = onlyJudge
         ? "WARNING: only judge oracles — no deterministic command/test oracle guards this task (deterministic preferred, spec §2).\n"
         : "";
-    const diff = await shOk(`git diff '${baseRef}..HEAD'`, worktree);
+    const { full: diff, forCap } = await fetchTaskDiff(worktree, baseRef);
     const diffCap = opts.diffCap ?? DEFAULT_DIFF_CAP;
-    if (diff.length > diffCap) {
-        return { gate: "acceptance", pass: false,
-            details: warn + detBlock + `diff exceeds verifiable cap (${diff.length} > ${diffCap}) — split the task, or raise gates.diffCap` };
-    }
+    const capFail = checkDiffCap("acceptance", forCap.length, diffCap, warn + detBlock);
+    if (capFail)
+        return capFail;
     const prompt = `TICKMARKR-JUDGE
 You are a strict acceptance judge. Decide whether the diff satisfies EVERY acceptance criterion.
 Judge only what the diff proves — plausible-but-wrong must fail. Do not award partial credit.
@@ -93,12 +93,18 @@ Respond with ONLY this JSON (no prose before or after):
             meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
     }
     const inconsistencies = [];
-    if (v.criteria.length !== judgeItems.length) {
-        inconsistencies.push(`judge verdict inconsistent: criteria count mismatch — expected ${judgeItems.length}, received ${v.criteria.length}`);
+    const expected = judgeItems.length;
+    const received = v.criteria.length;
+    // OBS-51: judges sometimes split one semicolon-joined criterion into multiple verdict items.
+    const clauseSplitAllPass = received > expected
+        && v.criteria.every((c) => c && typeof c === "object" && c.met === true);
+    if (received !== expected && !clauseSplitAllPass) {
+        inconsistencies.push(`judge verdict inconsistent: criteria count mismatch — expected ${expected}, received ${received}`);
     }
     v.criteria.forEach((c, i) => {
         if (!c || typeof c !== "object" || c.met !== true) {
-            inconsistencies.push(`judge verdict inconsistent: criteria[${i}].met must be true`);
+            const unmet = c && typeof c === "object" && c.criterion ? ` — unmet clause: ${c.criterion}` : "";
+            inconsistencies.push(`judge verdict inconsistent: criteria[${i}].met must be true${unmet}`);
         }
     });
     const pass = v.pass === true && inconsistencies.length === 0;

package/dist/gates/llm.js

@@ -2,7 +2,7 @@ import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
-import { bannerShell } from "../brand.js";
+import { bannerShell, paneDispatchCommand, paneDispatchScript } from "../brand.js";
 import { sh } from "../run/git.js";
 export const GATE_PANE_SEP = " · ";
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
@@ -38,13 +38,15 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
 // as a visible named agent (herdr pane), with the quote-split completion wrapper.
 export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
-    const pf = join(mkdtempSync(join(tmpdir(), "tickmarkr-llm-")), "prompt.md");
+    const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
+    const pf = join(dir, "prompt.md");
     writeFileSync(pf, prompt);
+    const scriptPath = join(dir, "dispatch.sh");
+    // OBS-50: bootstrap in a script beside the prompt — pane sees one short bash line + banner, not the raw inline command
+    writeFileSync(scriptPath, paneDispatchScript([bannerShell(), adapter.headlessCommand(pf, model)]));
     const slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
     via.onSlot?.(slot);
-    // brand banner at pane top — gate panes run headless-print (no alt screen), so it stays visible;
-    // extractJson is anchored to JSON braces and the exit marker to TICKMARKR_EXIT:\d, neither matches banner text
-    await via.driver.run(slot, `${bannerShell()}; ${adapter.headlessCommand(pf, model)}; printf '\\nTICKMARKR_''EXIT:%s\\n' $?`);
+    await via.driver.run(slot, paneDispatchCommand(scriptPath));
     // wait for the digit-suffixed marker (a real $? exit code), never a bare "TICKMARKR_EXIT:" that a
     // self-referential diff under review merely DISPLAYS — same guard the worker path uses (daemon.ts:193).
     // Without it, a judge/review pane echoing tickmarkr's own source false-completes before its verdict lands.

package/dist/gates/review.d.ts

@@ -7,6 +7,13 @@ export interface ReviewVerdict {
     approve: boolean;
     issues: string[];
 }
+export declare function fetchTaskDiff(worktree: string, baseRef: string): Promise<{
+    full: string;
+    forCap: string;
+}>;
+export declare function checkDiffCap(gate: string, measured: number, cap: number, prefix?: string): GateResult | null;
+export declare function isDiffCapPark(result: GateResult): boolean;
+export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[]): BillingChannel | null;
 export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[]): Promise<GateResult>;

package/dist/gates/review.js

@@ -5,6 +5,32 @@ import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { marginalCostRank } from "../route/router.js";
 import { extractJson, runLlm } from "./llm.js";
+// OBS-48: cap on zero-context diff bytes (git diff -U0), not context-padded full diff — scattered
+// one-line hunks no longer trip at ~370 diff-bytes per changed line. Full diff still goes to the judge.
+const DIFF_CAP_REMEDY = "split the task, or raise gates.diffCap";
+export async function fetchTaskDiff(worktree, baseRef) {
+    const full = await shOk(`git diff '${baseRef}..HEAD'`, worktree);
+    const forCap = await shOk(`git diff -U0 '${baseRef}..HEAD'`, worktree);
+    return { full, forCap };
+}
+export function checkDiffCap(gate, measured, cap, prefix = "") {
+    if (measured <= cap)
+        return null;
+    return {
+        gate,
+        pass: false,
+        details: prefix + `diff exceeds verifiable cap (${measured} > ${cap}) — ${DIFF_CAP_REMEDY}`,
+        // daemon/run-gates: park('human') immediately — the diff cannot shrink by retrying (OBS-48).
+        meta: { park: "human" },
+    };
+}
+export function isDiffCapPark(result) {
+    return result.pass === false && result.meta?.park === "human" && /diff exceeds verifiable cap/i.test(result.details);
+}
+// ponytail: single policy hook for callers after runGates — skips the escalation ladder on diff-cap trips.
+export function diffCapParkReason(results) {
+    return results.find(isDiffCapPark)?.details ?? null;
+}
 // FLEET-05: canonical model identity = the segment after the last "/". Provider-prefixed ids name ONE
 // base model behind two harnesses (zai-coding-plan/glm-5.2, zai/glm-5.2 → "glm-5.2"); vendor alone (mixed vs
 // zhipu) is not a diversity signal. Suffix-stripping over-excludes only if two genuinely different
@@ -37,12 +63,11 @@ export async function reviewGate(task, worktree, baseRef, author, channels, adap
             ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive" }
             : { gate: "review", pass: true, details: "WARNING: no cross-vendor reviewer available — review waived by config" };
     }
-    const diff = await shOk(`git diff '${baseRef}..HEAD'`, worktree);
+    const { full: diff, forCap } = await fetchTaskDiff(worktree, baseRef);
     const diffCap = cfg.gates.diffCap ?? DEFAULT_DIFF_CAP;
-    if (diff.length > diffCap) {
-        return { gate: "review", pass: false,
-            details: `diff exceeds verifiable cap (${diff.length} > ${diffCap}) — split the task, or raise gates.diffCap` };
-    }
+    const capFail = checkDiffCap("review", forCap.length, diffCap);
+    if (capFail)
+        return capFail;
     const prompt = `TICKMARKR-REVIEW
 You are a skeptical cross-vendor code reviewer. Another agent (vendor: ${author.adapter}) authored this diff.
 Look for correctness bugs, security issues, and acceptance-criteria gaps. Approve only if you would merge it.

package/dist/run/consult.js

@@ -1,6 +1,7 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getAdapter } from "../adapters/registry.js";
+import { bannerShell, paneDispatchCommand, paneDispatchScript } from "../brand.js";
 import { extractJson, gatePaneName } from "../gates/llm.js";
 import { sh } from "./git.js";
 const MAX_RETRY_GUIDANCE_LINES = 10;
@@ -73,7 +74,10 @@ opts = {}) {
             ...(opts.runId ? { owned: { role: "consult", taskId: d.taskId, attempt: 0, runId: opts.runId } } : {}),
         });
         opts.onSlot?.(slot);
-        await driver.run(slot, `${adapter.headlessCommand(promptFile, cfg.consult.model)}; printf '\\nTICKMARKR_''EXIT:%s\\n' $?`);
+        const scriptPath = join(dir, `${d.taskId}-${n}.sh`);
+        // OBS-50: visible consult panes get the brand banner; headless path above stays banner-free (machine-parsed stdout)
+        writeFileSync(scriptPath, paneDispatchScript([bannerShell(), adapter.headlessCommand(promptFile, cfg.consult.model)]));
+        await driver.run(slot, paneDispatchCommand(scriptPath));
         // digit-suffixed marker only: a dossier quoting tickmarkr's own "TICKMARKR_EXIT:" literal must not
         // false-complete the consult pane before its verdict (same guard as daemon.ts:193 / llm.ts).
         await driver.waitOutput(slot, "TICKMARKR_EXIT:\\d", cfg.consult.stallMinutes * 60_000, { regex: true });

package/dist/run/daemon.js

@@ -11,7 +11,7 @@ import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
 import { addEvidence, attributeBlocked, blockedTasks, getTask, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
 import { consult, renderRetryGuidance } from "./consult.js";
-import { cleanupRunWorktrees, gitHead, sh } from "./git.js";
+import { cleanupRunWorktrees, gitHead, linkNodeModules, sh, WORKTREE_LAYOUT_CONTRACT } from "./git.js";
 import { Journal, loadRoutingProfile, newRunId } from "./journal.js";
 import { acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
@@ -87,7 +87,7 @@ export async function runDaemon(repoRoot, opts = {}) {
             baseRef = await gitHead(repoRoot);
             baseline = await captureBaseline(repoRoot, commands);
             writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(baseline, null, 2));
-            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch }); // pid: v1.13 (VIS-11) liveness
+            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphHash: graph.spec.hash }); // graphHash: OBS-52 status join guard; pid: v1.13 (VIS-11) liveness
         }
         // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
         // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
@@ -343,6 +343,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                 }
                 const promptFile = writePrompt(journal.dir, t, attempt, feedback, nonce);
+                // OBS-47: state the worktree layout contract in the worker prompt (cheap-tier workers were
+                // committing/deleting node_modules and tripping the scope gate). Prepended, not appended, so the
+                // completion trailer stays the structural last line (prompt.ts's design). The harness re-asserts
+                // the link itself before gates regardless of what the worker does with it.
+                writeFileSync(promptFile, `${WORKTREE_LAYOUT_CONTRACT}\n\n${readFileSync(promptFile, "utf8")}`);
                 const adapter = getAdapter(assignment.adapter, adapters);
                 // VIS-04: workers share one role tab. T2: `owned` names the pane canonically (ownership contract);
                 // the legacy name stays the fallback for drivers without owned handling (subprocess spies).
@@ -556,6 +561,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                 }
                 graph = setStatus(graph, t.id, "gated");
                 saveGraph(repoRoot, graph);
+                // OBS-47: re-assert the node_modules link BEFORE gates run on any attempt. A worker may have
+                // deleted/replaced the symlink provisioned at worktree creation (run-20260717-004803 T5 lost two
+                // attempts + a consult to this); restore it harness-side so a prior attempt's environment damage
+                // can never fail a later attempt's gates. Gates never trust worker claims — this runs
+                // unconditionally, never on worker say-so. Restoration can fail (EPERM/busy); fail closed with a
+                // named environmental verdict instead of letting the test gate mask it as a code red.
+                if (!linkNodeModules(repoRoot, wt, { force: true })) {
+                    await park(t, "environmental: node_modules link could not be re-asserted before gates (OBS-47)", "setup", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                    return;
+                }
                 const onGate = async (e) => {
                     if (e.phase === "start")
                         return;

package/dist/run/git.d.ts

@@ -8,6 +8,7 @@ export declare function sh(cmd: string, cwd: string, timeoutMs?: number): Promis
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
 export declare function gitHead(cwd: string): Promise<string>;
 export declare const sanitizeBranch: (branch: string) => string;
+export declare const WORKTREES_DIR = "worktrees.noindex";
 export declare const worktreePath: (repo: string, branch: string) => string;
 /** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
 export declare function cleanupRunWorktrees(repo: string, branch: string, opts: {
@@ -16,5 +17,8 @@ export declare function cleanupRunWorktrees(repo: string, branch: string, opts:
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
-export declare function linkNodeModules(repo: string, dir: string): void;
+export declare function linkNodeModules(repo: string, dir: string, { force }?: {
+    force?: boolean | undefined;
+}): boolean;
+export declare const WORKTREE_LAYOUT_CONTRACT = "## Worktree layout contract (harness-provisioned \u2014 do not modify)\n- node_modules is a symlink into the main repo's node_modules, provisioned by tickmarkr. Never commit, delete, or replace it \u2014 the harness re-asserts this link before gates run, so modifying it cannot help and may fail your attempt.";
 export declare function removeWorktree(repo: string, dir: string): Promise<void>;

package/dist/run/git.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { existsSync, symlinkSync } from "node:fs";
+import { existsSync, lstatSync, readlinkSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
@@ -49,7 +49,12 @@ export async function gitHead(cwd) {
 }
 export const sanitizeBranch = (branch) => branch.replace(/[^\w.-]+/g, "-");
 const sanitize = sanitizeBranch;
-export const worktreePath = (repo, branch) => join(tickmarkrDir(repo), "worktrees", sanitize(branch));
+// OBS-49: macOS Spotlight skips any *.noindex directory, so worktree churn during gate bursts
+// stops spawning mdworkers (9 mdworkers measured on an 18-core M5 Max at load-77). Accepted cost:
+// CLI trust stores key on exact worktree paths (OBS-16), so each worktree re-prompts for trust
+// once after this rename — the same one-time per-install cost as the v1.38 state-dir rename.
+export const WORKTREES_DIR = "worktrees.noindex";
+export const worktreePath = (repo, branch) => join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
 /** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
 export async function cleanupRunWorktrees(repo, branch, opts) {
     if (opts.removeIntegration)
@@ -69,25 +74,47 @@ const resolveTaskBranch = async (repo, branch) => {
 };
 export async function createWorktree(repo, branch, baseRef) {
     branch = await resolveTaskBranch(repo, branch);
-    const dir = join(tickmarkrDir(repo), "worktrees", sanitize(branch));
+    const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
     if (existsSync(dir))
         await removeWorktree(repo, dir);
     await shOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);
     linkNodeModules(repo, dir);
     return dir;
 }
-// best-effort: devDep-based gates (tsx, vitest) shell out root-anchored and ENOENT in a bare
-// fresh worktree (OBS-27); failure here must never fail worktree creation
-export function linkNodeModules(repo, dir) {
+// OBS-41/OBS-47: the harness provisions node_modules as a symlink into the main repo so devDep-based
+// gates (tsx, vitest) resolve in a bare worktree. Provisioning (createWorktree) calls this LENIENT —
+// create the link only when dest is absent, never clobber (best-effort, never fails worktree creation).
+// The pre-gate re-assert (OBS-47) calls this with force:true — a worker that deleted/replaced the link
+// (real directory, wrong/broken symlink) is restored to the provisioned link. Idempotent: an
+// already-correct link is a no-op. Returns whether dest is the provisioned link: provisioning ignores
+// the result; the pre-gate caller treats false as a named environmental park, never a masked test red.
+export function linkNodeModules(repo, dir, { force = false } = {}) {
     const src = join(repo, "node_modules");
     const dest = join(dir, "node_modules");
-    if (!existsSync(src) || existsSync(dest))
-        return;
+    if (!existsSync(src))
+        return true; // nothing provisioned to link — correct state is no link (OBS-27 best-effort)
     try {
+        if (lstatSync(dest).isSymbolicLink() && readlinkSync(dest) === src)
+            return true; // already the provisioned link
+    }
+    catch { /* dest absent — fall through to create */ }
+    if (!force && existsSync(dest))
+        return false; // lenient provisioning (OBS-41): never clobber an existing entry
+    try {
+        rmSync(dest, { recursive: true, force: true }); // force tolerates absent; clears a wrong link / real dir / file
         symlinkSync(src, dest, "dir");
+        return true;
+    }
+    catch {
+        return false;
     }
-    catch { /* best-effort */ }
 }
+// OBS-47: the worktree layout the harness provisions, stated in the worker prompt so cheap-tier workers
+// stop tripping the scope gate by committing/deleting/replacing node_modules. The harness re-asserts the
+// link itself before gates regardless (gates never trust worker claims) — this contract just keeps the
+// worker from spending an attempt on environment repair.
+export const WORKTREE_LAYOUT_CONTRACT = `## Worktree layout contract (harness-provisioned — do not modify)
+- node_modules is a symlink into the main repo's node_modules, provisioned by tickmarkr. Never commit, delete, or replace it — the harness re-asserts this link before gates run, so modifying it cannot help and may fail your attempt.`;
 export async function removeWorktree(repo, dir) {
     await sh(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
     await sh(`rm -rf ${shq(dir)}`, repo);

package/dist/run/journal.d.ts

@@ -62,6 +62,8 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     }>>;
 }, z.core.$strip>;
 export type TelemetryRow = z.infer<typeof TelemetryRowSchema>;
+export declare function recordedGraphHash(events: JournalEvent[]): string | undefined;
+export declare function journalComparable(events: JournalEvent[], loadedHash: string): boolean;
 export declare function newRunId(now?: Date): string;
 export declare function readAllTelemetry(repoRoot: string, lastK: number, opts?: {
     after?: string;

package/dist/run/journal.js

@@ -72,6 +72,18 @@ export const TelemetryRowSchema = z.object({
     // v1.29 additive: mode of the attempt represented by this row. Absent on old telemetry.
     retryMode: z.enum(RETRY_MODES).optional(),
 });
+// OBS-52: graph hash on run-start binds status replay to the compiled graph that started the run.
+export function recordedGraphHash(events) {
+    for (const e of events) {
+        if (e.event === "run-start" && typeof e.data.graphHash === "string")
+            return e.data.graphHash;
+    }
+    return undefined;
+}
+export function journalComparable(events, loadedHash) {
+    const recorded = recordedGraphHash(events);
+    return recorded !== undefined && recorded === loadedHash;
+}
 export function newRunId(now = new Date()) {
     const p = (n, w = 2) => String(n).padStart(w, "0");
     return `run-${now.getFullYear()}${p(now.getMonth() + 1)}${p(now.getDate())}-${p(now.getHours())}${p(now.getMinutes())}${p(now.getSeconds())}`;

package/dist/run/merge.js

@@ -3,14 +3,14 @@ import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { fingerprint } from "../gates/baseline.js";
 import { tickmarkrDir } from "../graph/graph.js";
-import { gitHead, linkNodeModules, resolveIntegrationBranch, sh, shOk } from "./git.js";
+import { gitHead, linkNodeModules, resolveIntegrationBranch, sh, shOk, WORKTREES_DIR } from "./git.js";
 export function integrationBranch(cfg, runId) {
     return `${cfg.integrationBranchPrefix}${runId}`;
 }
 const sanitize = (branch) => branch.replace(/[^\w.-]+/g, "-");
 export async function ensureIntegration(repo, branch, baseRef) {
     branch = await resolveIntegrationBranch(repo, branch);
-    const dir = join(tickmarkrDir(repo), "worktrees", sanitize(branch));
+    const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
     if (!existsSync(join(dir, ".git"))) {
         const exists = (await sh(`git rev-parse --verify refs/heads/${shq(branch)}`, repo)).code === 0;
         if (exists) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.42.0",
+  "version": "1.44.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",