tickmarkr 1.44.0 → 1.46.0

package/dist/gates/acceptance.js

@@ -1,18 +1,93 @@
+import { z } from "zod";
 import { channelKey, shq } from "../adapters/types.js";
 import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
 import { checkDiffCap, fetchTaskDiff } from "./review.js";
-import { extractJson, runLlm } from "./llm.js";
+import { extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+// Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
+const JUDGE_TIMEOUT_MS = 900_000;
+const JudgeVerdictRowSchema = z.object({
+    criterion: z.string(),
+    met: z.boolean(),
+    reason: z.string(),
+});
+const JudgeVerdictSchema = z.object({
+    pass: z.boolean(),
+    criteria: z.array(JudgeVerdictRowSchema),
+});
+export function judgeCriterionId(index) {
+    return `c${index + 1}`;
+}
+function renderJudgeCriterion(item, index) {
+    return `[${judgeCriterionId(index)}] ${renderAcceptanceItem(item)}`;
+}
+function checkJudgeVerdict(raw, expectedIds) {
+    const parsed = JudgeVerdictSchema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            verdict: { pass: false, criteria: [] },
+            inconsistencies: ["judge verdict inconsistent: malformed verdict shape"],
+        };
+    }
+    const v = parsed.data;
+    const inconsistencies = [];
+    const counts = new Map();
+    for (const row of v.criteria) {
+        counts.set(row.criterion, (counts.get(row.criterion) ?? 0) + 1);
+    }
+    for (const [id, n] of counts) {
+        if (n > 1)
+            inconsistencies.push(`judge verdict inconsistent: duplicate criterion id ${id}`);
+        if (!expectedIds.includes(id))
+            inconsistencies.push(`judge verdict inconsistent: unknown criterion id ${id}`);
+    }
+    for (const id of expectedIds) {
+        if (!counts.has(id))
+            inconsistencies.push(`judge verdict inconsistent: missing criterion id ${id}`);
+    }
+    for (const row of v.criteria) {
+        if (!row.met && v.pass) {
+            inconsistencies.push(`judge verdict inconsistent: pass=true contradicts unmet criterion ${row.criterion}`);
+        }
+    }
+    if (!v.pass && v.criteria.every((row) => row.met) && inconsistencies.length === 0 && v.criteria.length === expectedIds.length) {
+        inconsistencies.push("judge verdict inconsistent: pass=false contradicts all criteria met");
+    }
+    return { verdict: v, inconsistencies };
+}
 const isCommand = (a) => typeof a === "object" && a.oracle === "command";
 const isTest = (a) => typeof a === "object" && a.oracle === "test";
 const isJudge = (a) => typeof a === "string" || (typeof a === "object" && a.oracle === "judge");
 // npm/yarn/pnpm/npx script wrappers need `--` to forward -t to the underlying vitest/jest runner; a bare
 // runner (vitest/jest) takes -t directly. -t is the shared testNamePattern shorthand both honor.
-function testFiltered(testCmd, name) {
-    const fwd = /^\s*(npm|yarn|pnpm|npx)\b/.test(testCmd) ? "-- " : "";
+// OBS-55: when the base command already contains `--`, append -t after forwarded args — a second `--`
+// makes vitest treat -t as a positional file filter and the name filter is dropped.
+export function testFiltered(testCmd, name) {
+    const wrapped = /^\s*(npm|yarn|pnpm|npx)\b/.test(testCmd);
+    if (wrapped && /\s--\s/.test(testCmd))
+        return `${testCmd} -t ${shq(name)}`;
+    const fwd = wrapped ? "-- " : "";
     return `${testCmd} ${fwd}-t ${shq(name)}`;
 }
+// vitest/jest summary: "Tests  N passed | M skipped (T)" — count passed+failed as actually ran.
+function testsRan(output) {
+    const lines = output.replace(/\x1b\[[\d;#]*[A-Za-z]/g, "").split("\n");
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i].trim();
+        const m = line.match(/^Tests\s+(.+?)\s*\(\d+\)\s*$/);
+        if (!m)
+            continue;
+        let ran = 0;
+        for (const chunk of m[1].split("|").map((s) => s.trim())) {
+            const n = chunk.match(/^(\d+)\s+(passed|failed)\b/);
+            if (n)
+                ran += Number(n[1]);
+        }
+        return ran;
+    }
+    return null;
+}
 // last few non-empty output lines, for context on a failing oracle (capped so details stay readable)
 function tail(out, n = 8) {
     const t = out.trim();
@@ -39,10 +114,17 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
                     details: `oracle failed: test "${a.test}" — no test command configured to run it (failing closed)` };
             }
             const r = await sh(testFiltered(opts.testCmd, a.test), worktree);
+            const out = (r.stderr || "") + "\n" + (r.stdout || "");
             if (r.code !== 0) {
                 return { gate: "acceptance", pass: false,
                     details: `oracle failed: test "${a.test}" (exit ${r.code})${tail(r.stderr || r.stdout)}` };
             }
+            // OBS-55: exit 0 alone is vacuous when the name filter matched zero tests — fail closed.
+            const ran = testsRan(out);
+            if (ran === null || ran < 1) {
+                return { gate: "acceptance", pass: false,
+                    details: `oracle failed: test "${a.test}" — name filter matched zero tests (filter: ${a.test})${tail(out)}` };
+            }
             passedDet.push(`✓ test: ${a.test} (exit 0)`);
         }
     }
@@ -63,6 +145,8 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
     const capFail = checkDiffCap("acceptance", forCap.length, diffCap, warn + detBlock);
     if (capFail)
         return capFail;
+    const expectedIds = judgeItems.map((_, index) => judgeCriterionId(index));
+    const nonce = generateVerdictNonce();
     const prompt = `TICKMARKR-JUDGE
 You are a strict acceptance judge. Decide whether the diff satisfies EVERY acceptance criterion.
 Judge only what the diff proves — plausible-but-wrong must fail. Do not award partial credit.
@@ -72,19 +156,22 @@ Deterministic command/test oracles have already passed mechanically; judge ONLY
 Goal: ${task.goal}
 
 ## Acceptance criteria (judge)
-${judgeItems.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}
+${judgeItems.map((a, index) => `- ${renderJudgeCriterion(a, index)}`).join("\n")}
 
 ## Diff (vs base)
 \`\`\`diff
 ${diff}
 \`\`\`
 
+${verdictNonceLine(nonce)}
+
 Respond with ONLY this JSON (no prose before or after):
-{"pass": true|false, "criteria": [{"criterion": "...", "met": true|false, "reason": "..."}]}
+{"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "..."}]}
+Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) exactly once.
 `;
-    const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via);
-    const v = extractJson(raw);
-    if (!v || typeof v.pass !== "boolean" || !Array.isArray(v.criteria)) {
+    const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
+    const extracted = extractVerdictJson(raw, nonce);
+    if (!extracted) {
         // GATE-09: structured meta names the flaked judge channel (mirrors review.ts:99 meta precedent) so
         // run-gates can retry the judge on a failover channel without string-matching details (D-03).
         // The parsed-verdict paths below are untouched — the flake signal is exactly extractJson→null here.
@@ -92,25 +179,9 @@ Respond with ONLY this JSON (no prose before or after):
             details: warn + detBlock + "judge output unparseable — failing closed",
             meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
     }
-    const inconsistencies = [];
-    const expected = judgeItems.length;
-    const received = v.criteria.length;
-    // OBS-51: judges sometimes split one semicolon-joined criterion into multiple verdict items.
-    const clauseSplitAllPass = received > expected
-        && v.criteria.every((c) => c && typeof c === "object" && c.met === true);
-    if (received !== expected && !clauseSplitAllPass) {
-        inconsistencies.push(`judge verdict inconsistent: criteria count mismatch — expected ${expected}, received ${received}`);
-    }
-    v.criteria.forEach((c, i) => {
-        if (!c || typeof c !== "object" || c.met !== true) {
-            const unmet = c && typeof c === "object" && c.criterion ? ` — unmet clause: ${c.criterion}` : "";
-            inconsistencies.push(`judge verdict inconsistent: criteria[${i}].met must be true${unmet}`);
-        }
-    });
-    const pass = v.pass === true && inconsistencies.length === 0;
-    const lines = v.criteria.map((c, i) => c && typeof c === "object"
-        ? `${c.met ? "✓" : "✗"} ${c.criterion}: ${c.reason}`
-        : `✗ criteria[${i}]: invalid criterion`);
+    const { verdict: v, inconsistencies } = checkJudgeVerdict(extracted, expectedIds);
+    const pass = v.pass === true && inconsistencies.length === 0 && v.criteria.every((row) => row.met);
+    const lines = v.criteria.map((row) => `${row.met ? "✓" : "✗"} ${row.criterion}: ${row.reason}`);
     if (!v.pass)
         lines.push("judge verdict pass=false");
     lines.push(...inconsistencies);

package/dist/gates/llm.d.ts

@@ -1,6 +1,12 @@
 import type { WorkerAdapter } from "../adapters/types.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 export declare const GATE_PANE_SEP = " \u00B7 ";
+/** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
+export declare function generateVerdictNonce(): string;
+export declare function verdictNonceLine(nonce: string): string;
+export declare function extractPromptNonce(prompt: string): string | null;
+export declare function gateExitTrailer(nonce: string): string;
+export declare function augmentFakeVerdictOutput(adapter: WorkerAdapter, out: string, nonce: string): string;
 export type GatePaneRole = "judge" | "review" | "consult";
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export declare function gatePaneName(role: GatePaneRole, taskId: string, suffix?: string): string;
@@ -23,3 +29,5 @@ export declare function runHeadless(adapter: WorkerAdapter, model: string, promp
 export declare function runViaDriver(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function runLlm(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via?: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function extractJson<T>(raw: string): T | null;
+/** Fable F3: verdict JSON must echo the call nonce — skip unbound or mismatched objects. */
+export declare function extractVerdictJson<T>(raw: string, nonce: string): T | null;

package/dist/gates/llm.js

@@ -1,10 +1,35 @@
+import { randomBytes } from "node:crypto";
 import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
-import { bannerShell, paneDispatchCommand, paneDispatchScript } from "../brand.js";
+import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { sh } from "../run/git.js";
 export const GATE_PANE_SEP = " · ";
+/** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
+export function generateVerdictNonce() {
+    return randomBytes(4).toString("hex");
+}
+export function verdictNonceLine(nonce) {
+    return `VERDICT_NONCE: ${nonce}`;
+}
+export function extractPromptNonce(prompt) {
+    return /VERDICT_NONCE:\s*([0-9a-f]+)/i.exec(prompt)?.[1] ?? null;
+}
+export function gateExitTrailer(nonce) {
+    return `printf '\\nTICKMARKR_''EXIT_${nonce}:%s\\n' $?`;
+}
+// ponytail: fake adapter serves static verdict JSON without nonce; append a bound copy for zero-token tests.
+export function augmentFakeVerdictOutput(adapter, out, nonce) {
+    if (adapter.id !== "fake")
+        return out;
+    const obj = extractJson(out);
+    if (!obj || typeof obj !== "object" || obj.nonce === nonce)
+        return out;
+    if (typeof obj.nonce === "string")
+        return out;
+    return `${out}\n${JSON.stringify({ ...obj, nonce })}`;
+}
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export function gatePaneName(role, taskId, suffix = "") {
     return `${role}${GATE_PANE_SEP}${taskId}${suffix}`;
@@ -33,7 +58,11 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
     const pf = join(mkdtempSync(join(tmpdir(), "tickmarkr-llm-")), "prompt.md");
     writeFileSync(pf, prompt);
     const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
-    return r.stdout + "\n" + r.stderr;
+    const nonce = extractPromptNonce(prompt);
+    let out = r.stdout + "\n" + r.stderr;
+    if (nonce)
+        out = augmentFakeVerdictOutput(adapter, out, nonce);
+    return out;
 }
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
 // as a visible named agent (herdr pane), with the quote-split completion wrapper.
@@ -43,17 +72,23 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
     writeFileSync(pf, prompt);
     const scriptPath = join(dir, "dispatch.sh");
     // OBS-50: bootstrap in a script beside the prompt — pane sees one short bash line + banner, not the raw inline command
-    writeFileSync(scriptPath, paneDispatchScript([bannerShell(), adapter.headlessCommand(pf, model)]));
+    const nonce = extractPromptNonce(prompt) ?? generateVerdictNonce();
+    writeFileSync(scriptPath, [
+        "export BASH_SILENCE_DEPRECATION_WARNING=1",
+        bannerShell(),
+        adapter.headlessCommand(pf, model),
+        gateExitTrailer(nonce),
+    ].join("\n"));
     const slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
     via.onSlot?.(slot);
     await via.driver.run(slot, paneDispatchCommand(scriptPath));
-    // wait for the digit-suffixed marker (a real $? exit code), never a bare "TICKMARKR_EXIT:" that a
-    // self-referential diff under review merely DISPLAYS — same guard the worker path uses (daemon.ts:193).
-    // Without it, a judge/review pane echoing tickmarkr's own source false-completes before its verdict lands.
-    await via.driver.waitOutput(slot, "TICKMARKR_EXIT:\\d", timeoutMs, { regex: true });
-    const out = await via.driver.read(slot, 400);
+    // nonce-suffixed exit only: a displayed bare "TICKMARKR_EXIT:" or another call's marker must not
+    // false-complete — same guard the worker path uses (daemon.ts:330-331).
+    await via.driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, timeoutMs, { regex: true });
+    let out = await via.driver.read(slot, 400);
     if (!via.keep)
         await via.driver.close(slot);
+    out = augmentFakeVerdictOutput(adapter, out, nonce);
     return out;
 }
 export function runLlm(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
@@ -104,3 +139,52 @@ export function extractJson(raw) {
     }
     return null;
 }
+/** Fable F3: verdict JSON must echo the call nonce — skip unbound or mismatched objects. */
+export function extractVerdictJson(raw, nonce) {
+    const fenced = [...raw.matchAll(/```json\s*\n([\s\S]*?)```/g)];
+    for (let fi = fenced.length - 1; fi >= 0; fi--) {
+        try {
+            const v = JSON.parse(fenced[fi][1]);
+            if (v && typeof v === "object" && v.nonce === nonce) {
+                const { nonce: _n, ...rest } = v;
+                return rest;
+            }
+        }
+        catch {
+            /* fall through */
+        }
+    }
+    let pos = raw.length - 1;
+    while (pos >= 0) {
+        const end = raw.lastIndexOf("}", pos);
+        if (end === -1)
+            return null;
+        let depth = 1;
+        let stepped = false;
+        for (let i = end - 1; i >= 0; i--) {
+            if (raw[i] === "}")
+                depth++;
+            else if (raw[i] === "{") {
+                depth--;
+                if (depth === 0) {
+                    stepped = true;
+                    try {
+                        const v = JSON.parse(raw.slice(i, end + 1));
+                        if (v && typeof v === "object" && v.nonce === nonce) {
+                            const { nonce: _n, ...rest } = v;
+                            return rest;
+                        }
+                    }
+                    catch {
+                        /* keep scanning */
+                    }
+                    pos = i - 1;
+                    break;
+                }
+            }
+        }
+        if (!stepped)
+            return null;
+    }
+    return null;
+}

package/dist/gates/review.js

@@ -4,7 +4,7 @@ import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { marginalCostRank } from "../route/router.js";
-import { extractJson, runLlm } from "./llm.js";
+import { extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // OBS-48: cap on zero-context diff bytes (git diff -U0), not context-padded full diff — scattered
 // one-line hunks no longer trip at ~370 diff-bytes per changed line. Full diff still goes to the judge.
 const DIFF_CAP_REMEDY = "split the task, or raise gates.diffCap";
@@ -68,6 +68,7 @@ export async function reviewGate(task, worktree, baseRef, author, channels, adap
     const capFail = checkDiffCap("review", forCap.length, diffCap);
     if (capFail)
         return capFail;
+    const nonce = generateVerdictNonce();
     const prompt = `TICKMARKR-REVIEW
 You are a skeptical cross-vendor code reviewer. Another agent (vendor: ${author.adapter}) authored this diff.
 Look for correctness bugs, security issues, and acceptance-criteria gaps. Approve only if you would merge it.
@@ -81,8 +82,10 @@ ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}
 ${diff}
 \`\`\`
 
+${verdictNonceLine(nonce)}
+
 Respond with ONLY this JSON:
-{"approve": true|false, "issues": ["..."]}
+{"nonce": "${nonce}", "approve": true|false, "issues": ["..."]}
 `;
     const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? { driver: via.driver, keep: via.keep, onSlot: via.onSlot, name: via.nameFor("review", reviewer.adapter), label: via.labelFor("review") } : undefined, 
     // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
@@ -91,7 +94,7 @@ Respond with ONLY this JSON:
     // (run-20260709-104447 P87-09). ponytail: literal 15min; make it cfg.review.timeoutMs if a
     // second knob-turner appears.
     900_000);
-    const v = extractJson(raw);
+    const v = extractVerdictJson(raw, nonce);
     if (!v || typeof v.approve !== "boolean" || !Array.isArray(v.issues)) {
         return {
             gate: "review",

package/dist/gates/scope.js

@@ -1,5 +1,5 @@
 import picomatch from "picomatch";
-import { shOk } from "../run/git.js";
+import { shGitOk } from "../run/git.js";
 /** Pure offender split — corpus-replay oracle exercises this exact decision logic. */
 export function dispositionOffenders(offenders, allowDeviations) {
     const allowedMatch = allowDeviations.length ? picomatch(allowDeviations, { dot: true }) : () => false;
@@ -16,7 +16,7 @@ export function dispositionOffenders(offenders, allowDeviations) {
 export async function scopeGate(worktree, baseRef, files, result, allowDeviations = []) {
     if (!files.length)
         return { gate: "scope", pass: true, details: "no file scope declared — unrestricted" };
-    const changed = (await shOk(`git diff --name-only '${baseRef}..HEAD'`, worktree)).trim().split("\n").filter(Boolean);
+    const changed = (await shGitOk(`git diff --name-only '${baseRef}..HEAD'`, worktree)).trim().split("\n").filter(Boolean);
     const inScope = picomatch(files, { dot: true }); // byte-identical options to assertWriteScope in src/compile/common.ts
     const offenders = changed.filter((f) => !inScope(f));
     if (!offenders.length)

package/dist/graph/graph.d.ts

@@ -1,6 +1,7 @@
 import { type RunGraph, type Task, type TaskStatus } from "./schema.js";
 export declare function stateDirName(_repoRoot: string): string;
 export declare function graphPath(repoRoot: string): string;
+export declare function graphDefinitionHash(g: RunGraph): string;
 export declare function tickmarkrDir(repoRoot: string): string;
 export declare function loadGraph(repoRoot: string): RunGraph;
 export declare function saveGraph(repoRoot: string, g: RunGraph): void;

package/dist/graph/graph.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { validateGraph } from "./schema.js";
@@ -7,6 +8,17 @@ export function stateDirName(_repoRoot) {
 export function graphPath(repoRoot) {
     return join(repoRoot, stateDirName(repoRoot), "graph.json");
 }
+// T3 (Sol #2 / Fable F2): ONE canonical engagement identity over COMPILED TASK DEFINITIONS only.
+// status/evidence are runtime-mutated (the daemon flips status, accumulates evidence every attempt) so
+// they are excluded — the identity survives a status flip or evidence growth but changes the instant a
+// task definition changes (goal/acceptance/deps/gates/etc.). Shared by status AND resume through the
+// single comparator in journal.ts (engagementComparable) so the journal↔graph join is decided once.
+// ponytail: sha256 truncated to 16 hex — stable, grep-friendly; promote to full digest only if a
+// collision ever bites (engagement ids are not a trust boundary, collisions just force a re-run).
+export function graphDefinitionHash(g) {
+    const definitions = g.tasks.map(({ status: _status, evidence: _evidence, ...def }) => def);
+    return createHash("sha256").update(JSON.stringify({ version: g.version, spec: g.spec, tasks: definitions })).digest("hex").slice(0, 16);
+}
 export function tickmarkrDir(repoRoot) {
     const dir = join(repoRoot, stateDirName(repoRoot));
     mkdirSync(dir, { recursive: true });

package/dist/plan/prompt.js

@@ -1,5 +1,5 @@
 export function scopePrompt(intent, repair) {
-    return `TICKMARKR-JUDGE
+    return `TICKMARKR-SCOPE
 You are drafting a tickmarkr native spec from an answered intent. Return only the Markdown spec, with no commentary or code fence.
 
 The draft must:

package/dist/route/profile.d.ts

@@ -11,6 +11,7 @@ export interface ProfileRow {
     consults?: number;
     parkKind?: string;
     runId?: string;
+    taskId?: string;
     quotaFailover?: true;
     overrun?: true;
 }
@@ -23,6 +24,7 @@ export interface ProfileCell {
     doneMedianMs?: number;
     nRaw?: number;
     overruns?: number;
+    discounted?: number;
 }
 export interface RoutingProfile {
     cells: Map<string, ProfileCell>;
@@ -38,10 +40,20 @@ export declare const EXPLORE_CAP = 5;
 export declare const HALF_LIFE_RUNS = 5;
 export declare const DECAY_CAP = 30;
 export declare function decayWeight(age: number, halfLife?: number): number;
+export declare const HYGIENE_WEIGHTS: readonly [0, 0.5, 1];
+export type HygieneWeight = (typeof HYGIENE_WEIGHTS)[number];
+export interface ProfileDiscount {
+    runId: string;
+    taskId?: string;
+    weight: 0 | 0.5;
+    reason: string;
+}
+export declare function resolveHygieneWeight(row: ProfileRow, discounts?: readonly ProfileDiscount[]): HygieneWeight;
 export declare function explorationBonus(cell: ProfileCell | undefined): number;
 export declare function classify(r: ProfileRow): 1 | 0.5 | 0 | null;
 export declare function buildProfile(rows: ProfileRow[], opts?: {
     halfLifeRuns?: number;
+    discounts?: readonly ProfileDiscount[];
 }): RoutingProfile;
 export declare function cellOf(profile: RoutingProfile | undefined, shape: string, chKey: string, channel: string): ProfileCell | undefined;
 export declare function cellsOf(profile: RoutingProfile): Generator<{
@@ -58,8 +70,18 @@ export interface CellSummary {
     quotaHits: number;
     cold: boolean;
     exploreRemaining: number;
+    discounted: number;
 }
 export declare function cellSummary(cell: ProfileCell): CellSummary;
+export interface LearnedScoreTerms {
+    quality: number;
+    perf: number;
+    avail: number;
+    overrun: number;
+}
+export declare function learnedScoreTerms(profile: RoutingProfile | undefined, shape: string, chKey: string, channel: string, opts?: {
+    availWeight?: number;
+}): LearnedScoreTerms;
 export declare function learnedScore(profile: RoutingProfile | undefined, shape: string, chKey: string, channel: string, opts?: {
     availWeight?: number;
 }): number;

package/dist/route/profile.js

@@ -31,6 +31,25 @@ export const DECAY_CAP = 30;
 export function decayWeight(age, halfLife = HALF_LIFE_RUNS) {
     return 2 ** -Math.min(Math.floor(age / halfLife), DECAY_CAP);
 }
+// v1.46 T5 evidence hygiene — operator-filed discounts on poisoned runs/tasks. h ∈ {0, 0.5, 1} is dyadic
+// so h·w (w a power of two) and every partial sum stay exact; magnitude headroom loses one bit (2^-32 floor).
+export const HYGIENE_WEIGHTS = [0, 0.5, 1];
+// Resolve h for one row: run-level marks (no taskId) apply to every row in the run; task-level marks are
+// selective. Multiple marks ⇒ minimum weight (most aggressive discount wins).
+export function resolveHygieneWeight(row, discounts = []) {
+    if (!discounts.length || row.runId === undefined)
+        return 1;
+    let h = 1;
+    for (const d of discounts) {
+        if (d.runId !== row.runId)
+            continue;
+        if (d.taskId !== undefined && d.taskId !== row.taskId)
+            continue;
+        if (d.weight < h)
+            h = d.weight;
+    }
+    return h;
+}
 // Phase 14 exploration bonus: an under-observed channel keeps gathering evidence so early bad luck can't
 // starve it permanently (EXP-01). Total by construction — dispatches is a finite non-negative integer counter,
 // the denominator is a compile-time positive constant; no ln/sqrt/data-dependent divide, so none of the
@@ -107,8 +126,12 @@ export function buildProfile(rows, opts = {}) {
         // in IEEE-754 ⇒ the fold stays order-insensitive (v1.7's invariant EXTENDED, not abandoned). Magnitude
         // headroom: weights are multiples of 2^-31, so exactness holds while row-count ≪ 2^21. nRaw is the
         // integer undecayed observation count (Phase 28) — never enters the score arithmetic.
+        // SINGLE evidence-fold site — hygiene h multiplies quality evidence ONLY (n, qSum), never dispatches/quotaHits/overruns.
         if (q !== null) {
-            const w = decayWeight(ageOf(r.runId), halfLife);
+            const h = resolveHygieneWeight(r, opts.discounts);
+            const w = decayWeight(ageOf(r.runId), halfLife) * h;
+            if (h < 1)
+                c.discounted = (c.discounted ?? 0) + 1;
             c.n += w;
             c.qSum += q * w;
             c.nRaw = (c.nRaw ?? 0) + 1;
@@ -154,18 +177,15 @@ export function cellSummary(cell) {
         quotaHits: cell.quotaHits,
         cold: cell.n < MIN_SAMPLES,
         exploreRemaining: Math.max(0, EXPLORE_CAP - cell.dispatches),
+        discounted: cell.discounted ?? 0,
     };
 }
-// Total by construction: every miss returns the explicit NEUTRAL constant; every denominator is a
-// compile-time-positive constant sum; no Record indexing by row strings (the TIER_RANK[typo] scar).
-// Score 0 defers to the static sort keys, which already encode the benchmark-dated tier seeds — a
-// per-channel numeric prior would give differing n=0 scores and break ROUTE-07's byte-identical cold
-// start. Shrinking toward 0 IS shrinking toward the static prior.
-export function learnedScore(profile, shape, chKey, channel, opts = {}) {
+// Per-term decomposition of learnedScore — the single arithmetic source for profile --explain.
+export function learnedScoreTerms(profile, shape, chKey, channel, opts = {}) {
     const availWeight = opts.availWeight ?? AVAIL_WEIGHT;
     const cell = cellOf(profile, shape, chKey, channel);
     if (!cell)
-        return NEUTRAL; // unknown channel ⇒ exactly neutral (empty-profile / cold-start leg, ROUTE-07)
+        return { quality: NEUTRAL, perf: NEUTRAL, avail: NEUTRAL, overrun: NEUTRAL };
     // Cold-start proof (ROUTE-07): n ≤ nRaw ≤ dispatches and doneCount ≤ dispatches by construction, so a
     // thin-dispatch cell (dispatches < MIN_SAMPLES) gates ALL THREE terms to literal +0 ⇒ exactly NEUTRAL.
     // Each term is gated INDEPENDENTLY (no early-exit) so a dispatch-warm/quality-cold HIGH-throttle cell can
@@ -192,6 +212,18 @@ export function learnedScore(profile, shape, chKey, channel, opts = {}) {
     // fact as a quality signal, ejecting it, or predicting it. overruns=0 ⇒ overrunPen 0 (overrun-free byte-identity).
     // Gated on dispatches (≥ MIN_SAMPLES > 0 ⇒ positive denominator, no divide-by-zero) INDEPENDENTLY of n, mirroring
     // the ROUTE-12 avail term exactly. NOT the symmetric (0.5 − ratio) form (the v1.9 ROUTE-16 penalty-only precedent).
-    const overrunPen = cell.dispatches < MIN_SAMPLES ? 0 : -OVERRUN_WEIGHT * ((cell.overruns ?? 0) / cell.dispatches); // ∈ [−OVERRUN_WEIGHT, 0]
-    return quality + perf + avail + overrunPen; // score ∈ (−0.625, +0.525), finite for every input
+    const overrun = cell.dispatches < MIN_SAMPLES ? 0 : -OVERRUN_WEIGHT * ((cell.overruns ?? 0) / cell.dispatches); // ∈ [−OVERRUN_WEIGHT, 0]
+    return { quality, perf, avail, overrun };
+}
+// Total by construction: every miss returns the explicit NEUTRAL constant; every denominator is a
+// compile-time-positive constant sum; no Record indexing by row strings (the TIER_RANK[typo] scar).
+// Score 0 defers to the static sort keys, which already encode the benchmark-dated tier seeds — a
+// per-channel numeric prior would give differing n=0 scores and break ROUTE-07's byte-identical cold
+// start. Shrinking toward 0 IS shrinking toward the static prior.
+export function learnedScore(profile, shape, chKey, channel, opts = {}) {
+    const cell = cellOf(profile, shape, chKey, channel);
+    if (!cell)
+        return NEUTRAL; // unknown channel ⇒ exactly neutral (empty-profile / cold-start leg, ROUTE-07)
+    const t = learnedScoreTerms(profile, shape, chKey, channel, opts);
+    return t.quality + t.perf + t.avail + t.overrun; // score ∈ (−0.625, +0.525), finite for every input
 }

package/dist/route/router.d.ts

@@ -30,5 +30,5 @@ export declare class RoutingError extends Error {
     constructor(msg: string);
 }
 export declare function marginalCostRank(c: BillingChannel): number;
-export declare function route(task: Task, cfg: TickmarkrConfig, channels: BillingChannel[], profile?: RoutingProfile, preferCtx?: RoutingPreferContext): Route;
-export declare function nextChannel(current: Assignment, task: Task, cfg: TickmarkrConfig, channels: BillingChannel[], tried: string[], profile?: RoutingProfile): Assignment | null;
+export declare function route(task: Task, cfg: TickmarkrConfig, channels: BillingChannel[], profile?: RoutingProfile, preferCtx?: RoutingPreferContext, exclude?: ReadonlySet<string>): Route;
+export declare function nextChannel(current: Assignment, task: Task, cfg: TickmarkrConfig, channels: BillingChannel[], tried: string[], profile?: RoutingProfile, exclude?: ReadonlySet<string>): Assignment | null;

package/dist/route/router.js

@@ -44,7 +44,14 @@ function ladderFor(task, entry) {
     const escalate = task.routingHints?.escalate ?? entry?.escalate ?? true;
     return escalate ? ["retry", "escalate", "consult", "human"] : ["retry", "consult", "human"];
 }
-export function route(task, cfg, channels, profile, preferCtx) {
+function withoutExcluded(channels, exclude) {
+    if (!exclude?.size)
+        return channels;
+    // OBS-57: in-run demotion after consecutive no-trailer windows — route around poisoned channels for the rest of the run.
+    return channels.filter((c) => !exclude.has(channelKey(c)));
+}
+export function route(task, cfg, channels, profile, preferCtx, exclude) {
+    channels = withoutExcluded(channels, exclude);
     const lints = [];
     const floor = cfg.routing.floors[task.shape];
     const entry = cfg.routing.map[task.shape];
@@ -201,7 +208,8 @@ export function route(task, cfg, channels, profile, preferCtx) {
         ? preferVia : "cheapest sufficient tier");
     return { assignment: toAssignment(eligible[0]), ladder: ladderFor(task, entry), lints, provenance: `${degraded}${bound}, marginal-cost auto (${chosenBy})`, ...(deviation ? { deviation } : {}) };
 }
-export function nextChannel(current, task, cfg, channels, tried, profile) {
+export function nextChannel(current, task, cfg, channels, tried, profile, exclude) {
+    channels = withoutExcluded(channels, exclude);
     // already cheapest-sufficient: TIER_RANK asc is the PRIMARY key so escalation climbs one band at a time.
     // Do NOT "unify" this onto route()'s key order (marginal-cost first) — that reverses climb-one-band on mixed fleets (ROUTE-02, D2).
     // ROUTE-13: learnedScore is the STRICTLY-LAST key — within-band tiebreak only. Precomputed

package/dist/run/consult.d.ts

@@ -10,6 +10,11 @@ export interface ConsultVerdict {
     excludeAdapter?: string;
 }
 export declare function renderRetryGuidance(v: ConsultVerdict): string;
+export declare function augmentRetryBrief(feedback: string, opts: {
+    attempted: string[];
+    carried: string[];
+    present: Set<string>;
+}): string;
 export interface Dossier {
     taskId: string;
     trigger: string;
@@ -18,7 +23,7 @@ export interface Dossier {
     diff: string;
     gates: GateResult[];
 }
-export declare function buildDossierPrompt(d: Dossier): string;
+export declare function buildDossierPrompt(d: Dossier, nonce: string): string;
 export declare function consult(d: Dossier, cfg: TickmarkrConfig, adapters: WorkerAdapter[], driver: ExecutorDriver, cwd: string, runDir: string, opts?: {
     keep?: boolean;
     onSlot?: (slot: Slot) => void;