tickmarkr 1.50.0 → 1.52.0

package/dist/adapters/codex.js

@@ -126,6 +126,9 @@ export function hasCodexTrustedProject(text, root) {
 export const codex = {
     id: "codex",
     vendor: "openai",
+    // OBS-72: codex probes self-contend in one repo (v1.33.5: 4 concurrent → all 4 timed out;
+    // 2026-07-18: gpt-5.5 lost the concurrent pair every doctor sweep) — probe one model at a time.
+    probeConcurrency: 1,
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)

package/dist/adapters/model-lints.js

@@ -68,8 +68,8 @@ export function contextWindowLints(tasks, assignments, cfg, repoRoot) {
     return lints;
 }
 const adapterHasAuthedChannel = (adapterId, shape, cfg, health, adapters) => {
-    const entry = cfg.routing.map[shape];
-    const minTier = entry?.tier ?? cfg.routing.floors[shape] ?? "cheap";
+    // v1.52 T5: routing.floors is the only band authority — a map entry can no longer carry a tier.
+    const minTier = cfg.routing.floors[shape] ?? "cheap";
     const a = adapters.find((x) => x.id === adapterId);
     const h = health[adapterId];
     if (!a || !h?.installed || typeof a.channels !== "function")

package/dist/adapters/registry.js

@@ -82,8 +82,10 @@ function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TI
     if (timedOut)
         return `probe timed out after ${timeoutMs}ms`;
     const output = `${stderr}\n${stdout}`.trim().replace(/\s+/g, " ");
+    // OBS-72: TAIL, not head — the error lands at the END of CLI output; a head slice stores only the
+    // startup banner and hid the real "Not inside a trusted directory" failure for a day.
     return code !== 0 || QUOTA_RE.test(output) || AUTH_FAILURE_RE.test(output)
-        ? output.slice(0, 240) || `probe exited ${code}`
+        ? output.slice(-240) || `probe exited ${code}`
         : undefined;
 }
 export const pendingAutoPreferKey = Symbol.for("tickmarkr.pendingAutoPrefer");
@@ -97,8 +99,9 @@ export const DOCTOR_ROUTING_STALE_MS = 24 * 60 * 60 * 1000;
 export function deriveAutoPrefer(cfg, adapters, health, profile) {
     const derivedAt = new Date().toISOString();
     const out = { derivedAt };
-    for (const [shape, entry] of Object.entries(cfg.routing.map)) {
-        const minTier = entry?.tier ?? cfg.routing.floors[shape] ?? "cheap";
+    // v1.52 T5: routing.floors is the only band authority — a map entry can no longer carry a tier.
+    for (const shape of Object.keys(cfg.routing.map)) {
+        const minTier = cfg.routing.floors[shape] ?? "cheap";
         const ranked = [];
         for (const a of adapters) {
             const h = health[a.id];
@@ -153,54 +156,70 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
         const verdicts = {};
         const priorModelAuth = priorHealth?.[a.id]?.modelAuth;
         const probeRoot = a.probeCwd === "neutral" ? mkdtempSync(join(tmpdir(), "tickmarkr-probe-")) : repoRoot;
-        // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
-        // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
-        // Capped at MODEL_PROBE_CONCURRENCY per adapter (v1.33.5 regression: 4 concurrent codex exec
-        // in one repo made ALL 4 codex probes time out where sequential passed 2/4).
-        await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), MODEL_PROBE_CONCURRENCY, async (model) => {
+        const store = (model, verdict) => {
+            verdicts[model] = verdict;
+            onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
+        };
+        // One bounded probe call. verdict:null = a first-pass failure that earns the one serial retry
+        // (OBS-72: a failure inside the concurrent batch is indistinguishable from adapter self-contention
+        // until re-probed alone); a retry attempt always returns a final verdict.
+        const attempt = async (model, retry) => {
             const t0 = Date.now();
             const probedAt = new Date().toISOString();
-            const priorTimedOut = priorModelAuth?.[model]?.reason?.includes("timed out") === true;
-            let verdict;
+            const v = (authed, reason) => ({ authed, ...(reason !== undefined ? { reason } : {}), probedAt, durationMs: Date.now() - t0 });
             try {
-                if (typeof a.headlessCommand !== "function") {
-                    verdict = { authed: false, reason: "headless probe unavailable", probedAt, durationMs: Date.now() - t0 };
-                }
-                else {
-                    const promptFile = join(mkdtempSync(join(tmpdir(), "tickmarkr-auth-")), "probe.md");
-                    writeFileSync(promptFile, MODEL_PROBE_PROMPT);
-                    const r = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
-                    if (r.timedOut && priorTimedOut) {
-                        verdict = { authed: false, reason: `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`, probedAt, durationMs: Date.now() - t0 };
-                    }
-                    else if (r.timedOut) {
-                        const r2 = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
-                        if (r2.timedOut) {
-                            verdict = { authed: false, reason: `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`, probedAt, durationMs: Date.now() - t0 };
-                        }
-                        else {
-                            const reason = probeFailure(r2.code, r2.stdout, r2.stderr, r2.timedOut, MODEL_PROBE_TIMEOUT_MS);
-                            verdict = reason ? { authed: false, reason, probedAt, durationMs: Date.now() - t0 } : { authed: true, probedAt, durationMs: Date.now() - t0 };
-                        }
-                    }
-                    else {
-                        const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
-                        verdict = reason ? { authed: false, reason, probedAt, durationMs: Date.now() - t0 } : { authed: true, probedAt, durationMs: Date.now() - t0 };
-                    }
+                if (typeof a.headlessCommand !== "function")
+                    return { verdict: v(false, "headless probe unavailable"), timedOut: false };
+                const promptFile = join(mkdtempSync(join(tmpdir(), "tickmarkr-auth-")), "probe.md");
+                writeFileSync(promptFile, MODEL_PROBE_PROMPT);
+                const r = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
+                // T2 rule unchanged: a prior doctor.json timeout skips the retry — a persistently dead
+                // model (e.g. opencode glm-5.2) costs one attempt instead of two every run.
+                if (r.timedOut && !retry && priorModelAuth?.[model]?.reason?.includes("timed out") === true) {
+                    return { verdict: v(false, `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`), timedOut: true };
                 }
+                const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
+                if (!reason)
+                    return { verdict: v(true), timedOut: false };
+                if (!retry)
+                    return { verdict: null, timedOut: r.timedOut === true };
+                return {
+                    verdict: r.timedOut && retry.firstTimedOut ? v(false, `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`) : v(false, reason),
+                    timedOut: r.timedOut === true,
+                };
             }
             catch (e) {
-                verdict = { authed: false, reason: String(e), probedAt, durationMs: Date.now() - t0 };
+                return { verdict: retry ? v(false, String(e)) : null, timedOut: false };
             }
-            verdicts[model] = verdict;
-            onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
+        };
+        // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
+        // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
+        // Capped at MODEL_PROBE_CONCURRENCY per adapter unless the adapter declares its own cap
+        // (codex: 1 — OBS-72, its concurrent probes self-contend in one repo).
+        const retries = [];
+        await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), a.probeConcurrency ?? MODEL_PROBE_CONCURRENCY, async (model) => {
+            const first = await attempt(model);
+            if (first.verdict)
+                store(model, first.verdict);
+            else
+                retries.push({ model, firstTimedOut: first.timedOut });
         });
+        // OBS-72: re-probe each first-pass failure once with ONE probe in flight, only after the
+        // concurrent batch drained — an in-slot retry still races its concurrency partner. Success here
+        // was contention; a second failure is the real verdict. Successful first-pass probes stored
+        // above and never wait; cost is one extra call per genuinely dead model only.
+        for (const { model, firstTimedOut } of retries) {
+            const second = await attempt(model, { firstTimedOut });
+            if (second.verdict)
+                store(model, second.verdict);
+        }
         h.modelAuth = verdicts;
     }));
     health[pendingAutoPreferKey] = deriveAutoPrefer(cfg, adapters, health);
 }
 // T2: caps concurrent probes per adapter at 2 — v1.33.5 regression, 4 concurrent codex exec in one
 // repo made ALL 4 time out where sequential passed 2/4 (suspected CLI self-contention).
+// v1.52 T4: default only — an adapter's own probeConcurrency declaration wins (codex: 1).
 const MODEL_PROBE_CONCURRENCY = 2;
 async function mapLimit(items, limit, fn) {
     let i = 0;

package/dist/adapters/types.d.ts

@@ -73,6 +73,7 @@ export interface WorkerAdapter {
     id: string;
     vendor: string;
     probeCwd?: "repo" | "neutral";
+    probeConcurrency?: number;
     probe(): Promise<AuthHealth>;
     channels(cfg: TickmarkrConfig): BillingChannel[];
     headlessCommand(promptFile: string, model: string): string;

package/dist/cli/commands/fleet.js

@@ -6,9 +6,10 @@ import { parseArgs } from "node:util";
 import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, readAutoPrefer } from "../../adapters/registry.js";
 import { fleetUnclassifiedModels } from "../../adapters/model-lints.js";
 import { GLYPHS, bold, legend as legendText, toggleActive, toggleInactive } from "../../brand.js";
-import { fleetEditableFromConfig, fleetEditableEquals, fleetRepoOverlayFromDelta, formatFleetPrint, globalConfigDir, loadConfig, overlayPreferShapes, readOverlayFile, repoOverlayPath, repoOverlayYaml, unifiedYamlDiff, } from "../../config/config.js";
+import { fleetEditableFromConfig, fleetEditableEquals, fleetRepoOverlayFromDelta, formatFleetPrint, globalConfigDir, overlayBytesLoadError, overlayPreferShapes, readOverlayFile, repoOverlayPath, repoOverlayYaml, ROUTING_MODES, unifiedYamlDiff, } from "../../config/config.js";
 import { SHAPES, TIERS } from "../../graph/schema.js";
 import { route } from "../../route/router.js";
+import { resolveRunMode } from "../../run/daemon.js";
 import { loadRoutingProfile } from "../../run/journal.js";
 const NON_TTY_MSG = "tickmarkr fleet: interactive fleet editor requires a TTY — use `tickmarkr fleet --print` for non-interactive output";
 const QUIT = "fleet: quit without writing";
@@ -55,10 +56,21 @@ function provenanceMap(editable) {
     }
     return out;
 }
-function proposedOverlayText(initial, editable, repoRoot) {
-    const merged = fleetRepoOverlayFromDelta(initial, editable, readOverlayFile(repoOverlayPath(repoRoot)));
-    return repoOverlayYaml(merged, provenanceMap(editable));
+// v1.51 T4: serializeFleetOverlay predates routing.mode — splice the mode line under routing:
+// so a repo-declared mode survives fleet writes and a mode selection lands as routing.mode.
+function withModeLine(yaml, mode) {
+    if (!mode)
+        return yaml;
+    if (/^routing:$/m.test(yaml))
+        return yaml.replace(/^routing:$/m, `routing:\n  mode: ${mode}`);
+    return `routing:\n  mode: ${mode}\n${yaml}`;
 }
+// v1.51 T4: one gloss per routing mode on the fleet mode screen — mirrors the preset compiler.
+const MODE_GLOSS = {
+    "partner-led": "every shape frontier · explore off",
+    "risk-based": "risk-tiered default floors",
+    "staff-led": "implement/refactor one band down · integrity shapes hold frontier",
+};
 const isAbort = (k) => k.name === "escape" || k.name === "q" || (k.ctrl === true && k.name === "c");
 const isNext = (k) => k.name === "return" || k.name === "enter";
 const isToggle = (k) => k.name === "space";
@@ -154,8 +166,14 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
     const input = io.input ?? process.stdin;
     const output = io.output ?? process.stdout;
     const interactive = input.isTTY === true && output.isTTY === true;
-    if (print)
-        return formatFleetPrint(cwd, { globalDir });
+    if (print) {
+        // v1.51 T4: the print surface names the mode and its source layer right under the header —
+        // comment-prefixed so the YAML body stays machine-parseable and regex-stable.
+        const rm = resolveRunMode(cwd, { globalDir });
+        const body = formatFleetPrint(cwd, { globalDir });
+        const nl = body.indexOf("\n");
+        return `${body.slice(0, nl)}\n# mode: ${rm.mode.mode} (${rm.source})${body.slice(nl)}`;
+    }
     if (!interactive)
         return { out: NON_TTY_MSG, code: 1 };
     const fresh = values.fresh ?? false;
@@ -166,15 +184,16 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             code: 1,
         };
     }
-    const cfg = loadConfig(cwd, { globalDir });
+    const rm = resolveRunMode(cwd, { globalDir });
+    const cfg = rm.cfg;
     const initial = fleetEditableFromConfig(cfg);
     const editable = structuredClone(initial);
     const health = cached;
     const term = openTerm(input, output);
     try {
-        // step 1/4 — probe data
+        // step 1/5 — probe data
         const ageLine = formatAge(doctorAgeMs(cwd));
-        term.frame(listFrame("step 1/4 · probe data", "enter continue · r refresh via doctor · esc/q quit", [`probe data: ${ageLine} (.tickmarkr/doctor.json)`], 0));
+        term.frame(listFrame("step 1/5 · probe data", "enter continue · r refresh via doctor · esc/q quit", [`probe data: ${ageLine} (.tickmarkr/doctor.json)`], 0));
         for (;;) {
             const k = await term.key();
             if (isAbort(k))
@@ -185,7 +204,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             if (isNext(k))
                 break;
         }
-        // step 2/4 — agent CLIs (space toggles adapter deny)
+        // step 2/5 — agent CLIs (space toggles adapter deny)
         const installed = adapters.filter((a) => health[a.id]?.installed);
         const adapterRows = () => installed.map((a) => {
             const h = health[a.id];
@@ -194,7 +213,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         });
         const listLegend = "↑↓/jk move · space toggle · enter next · esc/q quit";
         let aCursor = 0;
-        term.frame(listFrame("step 2/4 · agent CLIs", listLegend, adapterRows(), aCursor));
+        term.frame(listFrame("step 2/5 · agent CLIs", listLegend, adapterRows(), aCursor));
         for (;;) {
             const k = await term.key();
             if (isAbort(k))
@@ -218,9 +237,9 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 changed = true;
             }
             if (changed)
-                term.frame(listFrame("step 2/4 · agent CLIs", listLegend, adapterRows(), aCursor));
+                term.frame(listFrame("step 2/5 · agent CLIs", listLegend, adapterRows(), aCursor));
         }
-        // step 3/4 — models per enabled adapter (space toggles deny, t assigns tier from the row)
+        // step 3/5 — models per enabled adapter (space toggles deny, t assigns tier from the row)
         const enabledAdapters = installed.filter((a) => !isDeniedAdapter(a.id, editable));
         for (const a of enabledAdapters) {
             const unclassifiedAll = fleetUnclassifiedModels(cfg, health, adapters).filter((u) => u.adapter === a.id);
@@ -238,7 +257,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 const denied = isDeniedModel(a.id, r.model, editable);
                 return `${denied ? toggleInactive() : toggleActive()} ${r.model}  ${tier?.tier ?? "???"}  ${denied ? "denied" : "allowed"}`;
             });
-            const title = `step 3/4 · models · ${a.id}`;
+            const title = `step 3/5 · models · ${a.id}`;
             const modelsLegend = "↑↓/jk move · space toggle · t tier · enter next · esc/q quit";
             let mCursor = 0;
             term.frame(listFrame(title, modelsLegend, renderRows(rowsData()), mCursor));
@@ -283,7 +302,44 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                     term.frame(listFrame(title, modelsLegend, renderRows(rowsData()), mCursor));
             }
         }
-        // step 4/4 — shape routing (typed entry for pin/tier/prefer from the highlighted row)
+        // step 4/5 — routing mode (selection is in-memory; the write happens only through the diff confirm).
+        // Candidate floor tables come from the ONE preset compiler via resolveRunMode — no mode math here.
+        const modeCfgs = Object.fromEntries(ROUTING_MODES.map((m) => [m, m === rm.mode.mode ? rm : resolveRunMode(cwd, { flag: m, globalDir })]));
+        const modeRows = () => ROUTING_MODES.map((m) => `${m === rm.mode.mode ? toggleActive() : " "} ${m.padEnd(11)}  ${MODE_GLOSS[m]}`);
+        // preview: the highlighted mode's resolved floor table diffed against the current mode
+        const floorPreview = (cand) => {
+            if (cand === rm.mode.mode)
+                return [];
+            const cur = cfg.routing.floors;
+            const next = modeCfgs[cand].cfg.routing.floors;
+            const changed = SHAPES.filter((s) => cur[s] !== next[s]);
+            return [
+                `  floors vs ${rm.mode.mode}:`,
+                ...(changed.length ? changed.map((s) => `    ${s}: ${cur[s]} → ${next[s]}`) : ["    (no floor changes)"]),
+            ];
+        };
+        const modeTitle = "step 4/5 · routing mode";
+        const modeLegend = "↑↓/jk move · enter select · esc/q quit";
+        let modeCursor = ROUTING_MODES.indexOf(rm.mode.mode);
+        let selectedMode = rm.mode.mode;
+        const modeFrame = () => [...listFrame(modeTitle, modeLegend, modeRows(), modeCursor), ...floorPreview(ROUTING_MODES[modeCursor])];
+        term.frame(modeFrame());
+        for (;;) {
+            const k = await term.key();
+            if (isAbort(k))
+                return QUIT;
+            if (isNext(k)) {
+                selectedMode = ROUTING_MODES[modeCursor];
+                break;
+            }
+            const moved = moveCursor(k, modeCursor, ROUTING_MODES.length);
+            if (moved !== modeCursor) {
+                modeCursor = moved;
+                term.frame(modeFrame());
+            }
+        }
+        // step 5/5 — shape routing (typed entry for pin/tier/prefer from the highlighted row);
+        // previews route under the SELECTED mode's resolved floors, never a floor edit of its own
         const channels = discoverChannels(cfg, adapters, health);
         const profile = loadRoutingProfile(cwd, cfg, { preview: true });
         const autoPrefer = readAutoPrefer(cwd);
@@ -291,7 +347,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         const shapeRows = () => SHAPES.map((shape) => {
             let now;
             try {
-                const r = route(previewTask(shape), { ...cfg, routing: { ...cfg.routing, map: editable.map, floors: editable.floors } }, channels, profile);
+                const r = route(previewTask(shape), { ...cfg, routing: { ...cfg.routing, map: editable.map, floors: modeCfgs[selectedMode].cfg.routing.floors } }, channels, profile);
                 now = `${r.assignment.adapter}:${r.assignment.model} (${r.assignment.channel}, ${r.assignment.tier})`;
             }
             catch (e) {
@@ -300,8 +356,9 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             const auto = autoPrefer?.[shape] && !overlayShapes.has(shape) ? "  (auto-prefer active)" : "";
             return `${shape}  →  ${now}${auto}`;
         });
-        const shapesTitle = "step 4/4 · shape routing";
-        const shapesLegend = "↑↓/jk move · a auto · p pin · t tier · f prefer · enter next · esc/q quit";
+        const shapesTitle = "step 5/5 · shape routing";
+        // v1.52 T5: no map-tier editing action — routing.floors is the only band authority now.
+        const shapesLegend = "↑↓/jk move · a auto · p pin · f prefer · enter next · esc/q quit";
         let sCursor = 0;
         term.frame(listFrame(shapesTitle, shapesLegend, shapeRows(), sCursor));
         for (;;) {
@@ -332,15 +389,6 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 editable.map[shape] = { pin: { via: pin.slice(0, i), model: pin.slice(i + 1) } };
                 changed = true;
             }
-            else if (k.name === "t") {
-                const tier = (await term.askTyped(`tier (${TIERS.join("|")})> `));
-                if (!TIERS.includes(tier))
-                    return { out: `fleet: invalid tier ${tier}`, code: 1 };
-                const next = { ...entry, tier };
-                delete next.pin;
-                editable.map[shape] = next;
-                changed = true;
-            }
             else if (k.name === "f") {
                 const pref = await term.askTyped("prefer (comma-separated adapters or adapter:model)> ");
                 editable.map[shape] = { ...entry, prefer: pref.split(",").map((s) => s.trim()).filter(Boolean) };
@@ -349,10 +397,17 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             if (changed)
                 term.frame(listFrame(shapesTitle, shapesLegend, shapeRows(), sCursor));
         }
-        // review — unified diff + typed confirm
+        // review — unified diff + typed confirm (the ONLY write path; the mode screen funnels through here)
         const before = currentRepoOverlayText(cwd);
-        const after = proposedOverlayText(initial, editable, cwd);
-        if (fleetEditableEquals(initial, editable) || before === after) {
+        const existing = readOverlayFile(repoOverlayPath(cwd));
+        const modeChanged = selectedMode !== rm.mode.mode;
+        // preserve a repo-declared mode line verbatim; write a new one only when the selection changed it
+        const writeMode = modeChanged ? selectedMode : existing.routing?.mode;
+        const merged = fleetEditableEquals(initial, editable)
+            ? structuredClone(existing)
+            : fleetRepoOverlayFromDelta(initial, editable, existing);
+        const after = withModeLine(repoOverlayYaml(merged, provenanceMap(editable)), writeMode);
+        if ((!modeChanged && fleetEditableEquals(initial, editable)) || before === after) {
             return "fleet: no overlay changes (empty diff)";
         }
         const diff = unifiedYamlDiff(before, after, repoOverlayPath(cwd));
@@ -360,11 +415,16 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         const confirm = await term.askTyped("write overlay? [y/N] ");
         if (!/^y(?:es)?$/i.test(confirm))
             return "fleet: discarded overlay changes";
-        const merged = fleetRepoOverlayFromDelta(initial, editable, readOverlayFile(repoOverlayPath(cwd)));
-        const body = repoOverlayYaml(merged, provenanceMap(editable));
         const path = repoOverlayPath(cwd);
+        // v1.52 T2 reload guard: the exact bytes about to land must reload through the production
+        // loader path, or the write is refused and the existing overlay stays untouched (OBS-75 class:
+        // fleet must never persist a config that bricks every later command).
+        const loadError = overlayBytesLoadError(cwd, after, { globalDir });
+        if (loadError) {
+            return { out: `fleet: refusing to write ${path} — the config loader rejects the proposed overlay:\n${loadError}`, code: 1 };
+        }
         mkdirSync(dirname(path), { recursive: true });
-        writeFileSync(path, body);
+        writeFileSync(path, after);
         return `fleet: wrote ${path}`;
     }
     finally {

package/dist/cli/commands/plan.d.ts

@@ -1,2 +1,2 @@
 import type { WorkerAdapter } from "../../adapters/types.js";
-export declare function plan(_argv: string[], cwd?: string, adapters?: WorkerAdapter[]): Promise<string>;
+export declare function plan(argv: string[], cwd?: string, adapters?: WorkerAdapter[]): Promise<string>;

package/dist/cli/commands/plan.js

@@ -1,11 +1,14 @@
 import { allAdapters, discoverChannels, doctorAgeMs, modelAuthExclusions, probeAll, readDoctor, servableExclusions, servabilityLine } from "../../adapters/registry.js";
 import { formatModelAuthLine, contextWindowLints, modelLints, ttyVisual } from "../../adapters/model-lints.js";
 import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
+import { parseArgs } from "node:util";
 import { collateralLints } from "../../compile/collateral.js";
-import { loadConfig } from "../../config/config.js";
+import { DEFAULT_CONFIG, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
 import { loadGraph } from "../../graph/graph.js";
+import { resolveRunMode } from "../../run/daemon.js";
 import { excludedChannels, exclusionLine } from "../../route/preference.js";
-import { route, RoutingError } from "../../route/router.js";
+import { staffLedEvidence } from "../../route/profile.js";
+import { QUALITY_ENV, route, RoutingError } from "../../route/router.js";
 import { modelId } from "../../gates/review.js";
 import { loadRoutingProfile } from "../../run/journal.js";
 // T4 (v1.50): TTY-only brand pass — the title helper frames the routing table, lint/unroutable
@@ -31,12 +34,19 @@ const fleetCanCrossVendorReview = (channels) => {
                 return true;
     return false;
 };
-export async function plan(_argv, cwd = process.cwd(), adapters = allAdapters()) {
+export async function plan(argv, cwd = process.cwd(), adapters = allAdapters()) {
     // ponytail: hardcoded 24h TTL — promote to config when an operator asks. mtime is the signal because
     // doctor.json has no probe timestamp and a schema field would break the existing-files compat invariant.
     const DOCTOR_STALE_MS = 24 * 60 * 60 * 1000;
-    const cfg = loadConfig(cwd);
+    // v1.51 T2: plan previews any mode without a config edit — same source precedence as run
+    // (flag > spec front-matter > repo > global > default), same preset compiler.
+    const { values } = parseArgs({ args: argv, options: { mode: { type: "string" } }, allowPositionals: true });
+    if (values.mode !== undefined && !ROUTING_MODES.includes(values.mode)) {
+        throw new Error(`--mode must be one of ${ROUTING_MODES.join(" | ")} (got ${values.mode})`);
+    }
+    delete process.env[QUALITY_ENV];
     const g = loadGraph(cwd);
+    const { cfg, mode, source } = resolveRunMode(cwd, { flag: values.mode, spec: g.mode });
     // readDoctor cache path: staleness line only fires here (probeAll fallback is fresh by construction).
     const cached = readDoctor(cwd);
     const health = cached ?? (await probeAll(adapters));
@@ -46,7 +56,17 @@ export async function plan(_argv, cwd = process.cwd(), adapters = allAdapters())
     // output byte-identical to today.
     const profile = loadRoutingProfile(cwd, cfg, { preview: true });
     let deviations = 0;
-    const lines = [`tickmarkr plan — dry run (${channels.length} channels available)`, ""];
+    // v1.51 T4: the mode is never invisible — the header names the resolved mode, its winning
+    // source, and the explore posture; each task row carries a floor-derivation line below.
+    const lines = [
+        `tickmarkr plan — dry run (${channels.length} channels available)`,
+        `mode: ${mode.mode} (${source}) · explore ${cfg.routing.explore?.mode ?? "on"}`,
+        "",
+    ];
+    const derivation = (shape) => {
+        const floor = cfg.routing.floors[shape];
+        return floor ? `    floor ${floor} ← ${mode.provenance[shape] ?? "config floors"}` : null;
+    };
     const excluded = excludedChannels(cfg, adapters, health);
     if (excluded.length)
         lines.push(exclusionLine(excluded), "");
@@ -78,7 +98,24 @@ export async function plan(_argv, cwd = process.cwd(), adapters = allAdapters())
             return ` — ${m.key} is unauthed (${m.reason}, probed ${m.probedAt.split("T")[0]})`;
         return "";
     };
-    const lints = [];
+    // v1.51 T1: mode-resolution lints (shadowed deltas, below-integrity operator floors) surface here every run.
+    const lints = [...mode.lints];
+    // v1.51 T5: staff-led economics guard — when the MODE (never an explicit operator line) lowered a
+    // shape's floor and warm evidence shows the cheap band materially under the mid incumbent, say so.
+    // Advisory only: no floor is raised here or anywhere on prediction — raises stay evidence-triggered
+    // (task-hint floors, the in-run retry ladder), each journaled with provenance.
+    if (mode.mode === "staff-led") {
+        const fmtScore = (s) => `${s < 0 ? "" : "+"}${s.toFixed(3)}`;
+        for (const [shape, floor] of Object.entries(cfg.routing.floors)) {
+            const dflt = DEFAULT_CONFIG.routing.floors[shape];
+            if (mode.provenance[shape] !== "mode staff-led" || !dflt || TIER_RANK[floor] >= TIER_RANK[dflt])
+                continue;
+            const ev = staffLedEvidence(profile, shape, channels);
+            if (ev) {
+                lints.push(`staff-led may cost more than risk-based on ${shape} (cheap best ${fmtScore(ev.cheapBest)} vs mid ${fmtScore(ev.midBest)}, n=${ev.n}) — advisory only, floor stays ${floor}`);
+            }
+        }
+    }
     for (const [role, sel] of [["judge", cfg.judge], ["consult", cfg.consult]]) {
         if (!health[sel.adapter]?.installed)
             lints.push(`${role}: ${sel.adapter}:${sel.model} not installed — that gate/consult will fail closed`);
@@ -100,6 +137,9 @@ export async function plan(_argv, cwd = process.cwd(), adapters = allAdapters())
             const est = r.assignment.channel === "sub" ? 0 : cfg.pricing[r.assignment.tier];
             cost += est;
             lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`);
+            const d = derivation(t.shape);
+            if (d)
+                lines.push(d);
             if (r.deviation) {
                 deviations++;
                 const d = r.deviation;
@@ -111,6 +151,9 @@ export async function plan(_argv, cwd = process.cwd(), adapters = allAdapters())
                 throw e;
             const msg = `${e.message}${exclusionReason(e.message)}`;
             lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} !! ${msg}`);
+            const d = derivation(t.shape);
+            if (d)
+                lines.push(d);
             lints.push(`${t.id}: unroutable — ${msg}`);
         }
     }

package/dist/cli/commands/run.js

@@ -1,10 +1,10 @@
 import { parseArgs } from "node:util";
 import { allAdapters, discoverChannels, probeAll, readDoctor } from "../../adapters/registry.js";
-import { loadConfig } from "../../config/config.js";
+import { ROUTING_MODES } from "../../config/config.js";
 import { pickDriver } from "../../drivers/index.js";
 import { loadGraph } from "../../graph/graph.js";
-import { formatSummary, runDaemon } from "../../run/daemon.js";
-import { route, QUALITY_ENV, NO_EXPLORE_ENV } from "../../route/router.js";
+import { formatSummary, resolveRunMode, runDaemon } from "../../run/daemon.js";
+import { route, NO_EXPLORE_ENV, QUALITY_ENV } from "../../route/router.js";
 import { formatJournalNarration, loadRoutingProfile } from "../../run/journal.js";
 import { ttyVisual } from "../../adapters/model-lints.js";
 import { statusRow } from "../../brand.js";
@@ -24,6 +24,11 @@ export const narrationLine = (event) => {
 };
 const summaryGreen = (s) => s.failed.length === 0 && s.human.length === 0 && s.blocked.length === 0 && s.pending.length === 0
     && s.tipVerify !== "failed";
+// v1.51 T2: --quality is a pure compatibility alias for `--mode partner-led` (this run only). It
+// carries no one-band floor raise of its own: the flag never sets ExploreContext.quality or the
+// TICKMARKR_QUALITY env, so no downstream code raises a floor on its behalf (proven in mode-sources).
+const QUALITY_ALIAS_NOTICE = "tickmarkr: --quality is a compatibility alias for --mode partner-led (this run only) — "
+    + "the v1.47 one-band floor raise is retired (deprecated); use --mode partner-led";
 export async function run(argv, cwd = process.cwd()) {
     const { values } = parseArgs({
         args: argv,
@@ -32,6 +37,7 @@ export async function run(argv, cwd = process.cwd()) {
             driver: { type: "string" },
             "route-strict": { type: "boolean" },
             "no-explore": { type: "boolean" },
+            mode: { type: "string" },
             quality: { type: "boolean" },
         },
     });
@@ -40,14 +46,28 @@ export async function run(argv, cwd = process.cwd()) {
         if (!Number.isInteger(n) || n <= 0)
             throw new Error(`--concurrency must be a positive integer (got ${values.concurrency})`);
     }
-    const cfg = loadConfig(cwd);
-    const quality = !!values.quality;
-    const noExplore = !!values["no-explore"] || quality;
-    const exploreCtx = noExplore || quality ? { noExplore, quality } : undefined;
+    if (values.quality && values.mode !== undefined) {
+        throw new Error("--quality is a compatibility alias for --mode partner-led and cannot be combined with an explicit --mode — pass one or the other");
+    }
+    if (values.mode !== undefined && !ROUTING_MODES.includes(values.mode)) {
+        throw new Error(`--mode must be one of ${ROUTING_MODES.join(" | ")} (got ${values.mode})`);
+    }
+    if (values.quality)
+        console.warn(QUALITY_ALIAS_NOTICE);
+    const flagMode = values.mode ?? (values.quality ? "partner-led" : undefined);
+    delete process.env[QUALITY_ENV];
+    const graph = loadGraph(cwd);
+    const { cfg, conflict } = resolveRunMode(cwd, { flag: flagMode, spec: graph.mode });
+    if (conflict) {
+        // Loud, never silent: live intent (the flag) may override compiled intent (the spec) — strict refuses.
+        if (values["route-strict"])
+            throw new Error(`--route-strict: refusing to dispatch — ${conflict}`);
+        console.warn(`tickmarkr: !! ${conflict}`);
+    }
+    const noExplore = !!values["no-explore"];
+    const exploreCtx = noExplore ? { noExplore } : undefined;
     if (noExplore)
         process.env[NO_EXPLORE_ENV] = "1";
-    if (quality)
-        process.env[QUALITY_ENV] = "1";
     try {
         if (values["route-strict"]) {
             const adapters = allAdapters();
@@ -55,13 +75,14 @@ export async function run(argv, cwd = process.cwd()) {
             const channels = discoverChannels(cfg, adapters, health);
             // no preview: the strict pre-flight routes through exactly what the daemon will use (honors the switch)
             const profile = loadRoutingProfile(cwd, cfg);
-            const lints = loadGraph(cwd).tasks.flatMap((t) => route(t, cfg, channels, profile, undefined, undefined, exploreCtx).lints);
+            const lints = graph.tasks.flatMap((t) => route(t, cfg, channels, profile, undefined, undefined, exploreCtx).lints);
             if (lints.length)
                 throw new Error(`--route-strict: routing lints present, refusing to dispatch:\n${lints.join("\n")}`);
         }
         const s = await runDaemon(cwd, {
             concurrency: values.concurrency ? Number(values.concurrency) : undefined,
             driver: pickDriver(cfg, values.driver),
+            mode: flagMode,
             narrate: (event) => console.log(narrationLine(event)),
         });
         const out = `run ${s.runId} finished — ${formatSummary(s)} (merge to main is a human decision)`;
@@ -70,7 +91,5 @@ export async function run(argv, cwd = process.cwd()) {
     finally {
         if (noExplore)
             delete process.env[NO_EXPLORE_ENV];
-        if (quality)
-            delete process.env[QUALITY_ENV];
     }
 }