tickmarkr 1.51.0 → 1.52.0

package/dist/adapters/codex.js

@@ -126,6 +126,9 @@ export function hasCodexTrustedProject(text, root) {
 export const codex = {
     id: "codex",
     vendor: "openai",
+    // OBS-72: codex probes self-contend in one repo (v1.33.5: 4 concurrent → all 4 timed out;
+    // 2026-07-18: gpt-5.5 lost the concurrent pair every doctor sweep) — probe one model at a time.
+    probeConcurrency: 1,
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)

package/dist/adapters/model-lints.d.ts

@@ -17,7 +17,6 @@ export type RoutedAssignment = {
 /** Advisory only — absent windows config or undeclared model window ⇒ no lint. */
 export declare function contextWindowLints(tasks: ReadonlyArray<Task>, assignments: ReadonlyArray<RoutedAssignment>, cfg: TickmarkrConfig, repoRoot: string): string[];
 export declare function seedPreferLints(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], overlayPreferShapes?: ReadonlySet<string>): string[];
-export declare function mapTierLints(cfg: TickmarkrConfig): string[];
 export declare function modelLints(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], opts?: {
     tty?: boolean;
     stateDir?: string;

package/dist/adapters/model-lints.js

@@ -68,8 +68,8 @@ export function contextWindowLints(tasks, assignments, cfg, repoRoot) {
     return lints;
 }
 const adapterHasAuthedChannel = (adapterId, shape, cfg, health, adapters) => {
-    const entry = cfg.routing.map[shape];
-    const minTier = entry?.tier ?? cfg.routing.floors[shape] ?? "cheap";
+    // v1.52 T5: routing.floors is the only band authority — a map entry can no longer carry a tier.
+    const minTier = cfg.routing.floors[shape] ?? "cheap";
     const a = adapters.find((x) => x.id === adapterId);
     const h = health[adapterId];
     if (!a || !h?.installed || typeof a.channels !== "function")
@@ -95,14 +95,6 @@ export function seedPreferLints(cfg, health, adapters, overlayPreferShapes = new
     }
     return lints;
 }
-// v1.51 T3: built-in defaults no longer carry map tiers, so any tier surviving the merge came from an
-// overlay. Deprecated — routing.floors is the single band authority; MapEntrySchema.tier removal itself
-// is deferred to the next version. One lint per shape, identical text on every surface (plan + doctor).
-export function mapTierLints(cfg) {
-    return Object.entries(cfg.routing.map)
-        .filter(([, entry]) => entry.tier !== undefined)
-        .map(([shape, entry]) => `routing.map.${shape}.tier: ${entry.tier} is deprecated — move this value to routing.floors.${shape} (single band authority; tier removal deferred to next version)`);
-}
 // Diffs detected models (doctor.json) against configured tiers, both directions, per adapter id in cfg.tiers.
 // No `  ! ` prefix here — the consumer (doctor rows / plan lints) owns that. Pre-v1.5 doctor.json (models:[], no
 // modelsDetectedAt) is the compat baseline: `?.`/`?? []` everywhere, no zod (would reject old files).
@@ -145,7 +137,6 @@ export function modelLints(cfg, health, adapters, opts) {
         }
     }
     lints.push(...seedPreferLints(cfg, health, adapters, opts?.overlayPreferShapes));
-    lints.push(...mapTierLints(cfg)); // v1.51 T3: shared here so plan and doctor draw the exact same message
     return lints;
 }
 // T2/T6: one lint per exclusion, naming the probe reason and date. TTY truncates reasons to 60 chars and

package/dist/adapters/registry.js

@@ -82,8 +82,10 @@ function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TI
     if (timedOut)
         return `probe timed out after ${timeoutMs}ms`;
     const output = `${stderr}\n${stdout}`.trim().replace(/\s+/g, " ");
+    // OBS-72: TAIL, not head — the error lands at the END of CLI output; a head slice stores only the
+    // startup banner and hid the real "Not inside a trusted directory" failure for a day.
     return code !== 0 || QUOTA_RE.test(output) || AUTH_FAILURE_RE.test(output)
-        ? output.slice(0, 240) || `probe exited ${code}`
+        ? output.slice(-240) || `probe exited ${code}`
         : undefined;
 }
 export const pendingAutoPreferKey = Symbol.for("tickmarkr.pendingAutoPrefer");
@@ -97,8 +99,9 @@ export const DOCTOR_ROUTING_STALE_MS = 24 * 60 * 60 * 1000;
 export function deriveAutoPrefer(cfg, adapters, health, profile) {
     const derivedAt = new Date().toISOString();
     const out = { derivedAt };
-    for (const [shape, entry] of Object.entries(cfg.routing.map)) {
-        const minTier = entry?.tier ?? cfg.routing.floors[shape] ?? "cheap";
+    // v1.52 T5: routing.floors is the only band authority — a map entry can no longer carry a tier.
+    for (const shape of Object.keys(cfg.routing.map)) {
+        const minTier = cfg.routing.floors[shape] ?? "cheap";
         const ranked = [];
         for (const a of adapters) {
             const h = health[a.id];
@@ -153,54 +156,70 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
         const verdicts = {};
         const priorModelAuth = priorHealth?.[a.id]?.modelAuth;
         const probeRoot = a.probeCwd === "neutral" ? mkdtempSync(join(tmpdir(), "tickmarkr-probe-")) : repoRoot;
-        // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
-        // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
-        // Capped at MODEL_PROBE_CONCURRENCY per adapter (v1.33.5 regression: 4 concurrent codex exec
-        // in one repo made ALL 4 codex probes time out where sequential passed 2/4).
-        await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), MODEL_PROBE_CONCURRENCY, async (model) => {
+        const store = (model, verdict) => {
+            verdicts[model] = verdict;
+            onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
+        };
+        // One bounded probe call. verdict:null = a first-pass failure that earns the one serial retry
+        // (OBS-72: a failure inside the concurrent batch is indistinguishable from adapter self-contention
+        // until re-probed alone); a retry attempt always returns a final verdict.
+        const attempt = async (model, retry) => {
             const t0 = Date.now();
             const probedAt = new Date().toISOString();
-            const priorTimedOut = priorModelAuth?.[model]?.reason?.includes("timed out") === true;
-            let verdict;
+            const v = (authed, reason) => ({ authed, ...(reason !== undefined ? { reason } : {}), probedAt, durationMs: Date.now() - t0 });
             try {
-                if (typeof a.headlessCommand !== "function") {
-                    verdict = { authed: false, reason: "headless probe unavailable", probedAt, durationMs: Date.now() - t0 };
-                }
-                else {
-                    const promptFile = join(mkdtempSync(join(tmpdir(), "tickmarkr-auth-")), "probe.md");
-                    writeFileSync(promptFile, MODEL_PROBE_PROMPT);
-                    const r = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
-                    if (r.timedOut && priorTimedOut) {
-                        verdict = { authed: false, reason: `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`, probedAt, durationMs: Date.now() - t0 };
-                    }
-                    else if (r.timedOut) {
-                        const r2 = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
-                        if (r2.timedOut) {
-                            verdict = { authed: false, reason: `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`, probedAt, durationMs: Date.now() - t0 };
-                        }
-                        else {
-                            const reason = probeFailure(r2.code, r2.stdout, r2.stderr, r2.timedOut, MODEL_PROBE_TIMEOUT_MS);
-                            verdict = reason ? { authed: false, reason, probedAt, durationMs: Date.now() - t0 } : { authed: true, probedAt, durationMs: Date.now() - t0 };
-                        }
-                    }
-                    else {
-                        const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
-                        verdict = reason ? { authed: false, reason, probedAt, durationMs: Date.now() - t0 } : { authed: true, probedAt, durationMs: Date.now() - t0 };
-                    }
+                if (typeof a.headlessCommand !== "function")
+                    return { verdict: v(false, "headless probe unavailable"), timedOut: false };
+                const promptFile = join(mkdtempSync(join(tmpdir(), "tickmarkr-auth-")), "probe.md");
+                writeFileSync(promptFile, MODEL_PROBE_PROMPT);
+                const r = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
+                // T2 rule unchanged: a prior doctor.json timeout skips the retry — a persistently dead
+                // model (e.g. opencode glm-5.2) costs one attempt instead of two every run.
+                if (r.timedOut && !retry && priorModelAuth?.[model]?.reason?.includes("timed out") === true) {
+                    return { verdict: v(false, `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`), timedOut: true };
                 }
+                const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
+                if (!reason)
+                    return { verdict: v(true), timedOut: false };
+                if (!retry)
+                    return { verdict: null, timedOut: r.timedOut === true };
+                return {
+                    verdict: r.timedOut && retry.firstTimedOut ? v(false, `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`) : v(false, reason),
+                    timedOut: r.timedOut === true,
+                };
             }
             catch (e) {
-                verdict = { authed: false, reason: String(e), probedAt, durationMs: Date.now() - t0 };
+                return { verdict: retry ? v(false, String(e)) : null, timedOut: false };
             }
-            verdicts[model] = verdict;
-            onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
+        };
+        // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
+        // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
+        // Capped at MODEL_PROBE_CONCURRENCY per adapter unless the adapter declares its own cap
+        // (codex: 1 — OBS-72, its concurrent probes self-contend in one repo).
+        const retries = [];
+        await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), a.probeConcurrency ?? MODEL_PROBE_CONCURRENCY, async (model) => {
+            const first = await attempt(model);
+            if (first.verdict)
+                store(model, first.verdict);
+            else
+                retries.push({ model, firstTimedOut: first.timedOut });
         });
+        // OBS-72: re-probe each first-pass failure once with ONE probe in flight, only after the
+        // concurrent batch drained — an in-slot retry still races its concurrency partner. Success here
+        // was contention; a second failure is the real verdict. Successful first-pass probes stored
+        // above and never wait; cost is one extra call per genuinely dead model only.
+        for (const { model, firstTimedOut } of retries) {
+            const second = await attempt(model, { firstTimedOut });
+            if (second.verdict)
+                store(model, second.verdict);
+        }
         h.modelAuth = verdicts;
     }));
     health[pendingAutoPreferKey] = deriveAutoPrefer(cfg, adapters, health);
 }
 // T2: caps concurrent probes per adapter at 2 — v1.33.5 regression, 4 concurrent codex exec in one
 // repo made ALL 4 time out where sequential passed 2/4 (suspected CLI self-contention).
+// v1.52 T4: default only — an adapter's own probeConcurrency declaration wins (codex: 1).
 const MODEL_PROBE_CONCURRENCY = 2;
 async function mapLimit(items, limit, fn) {
     let i = 0;

package/dist/adapters/types.d.ts

@@ -73,6 +73,7 @@ export interface WorkerAdapter {
     id: string;
     vendor: string;
     probeCwd?: "repo" | "neutral";
+    probeConcurrency?: number;
     probe(): Promise<AuthHealth>;
     channels(cfg: TickmarkrConfig): BillingChannel[];
     headlessCommand(promptFile: string, model: string): string;

package/dist/cli/commands/fleet.js

@@ -6,7 +6,7 @@ import { parseArgs } from "node:util";
 import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, readAutoPrefer } from "../../adapters/registry.js";
 import { fleetUnclassifiedModels } from "../../adapters/model-lints.js";
 import { GLYPHS, bold, legend as legendText, toggleActive, toggleInactive } from "../../brand.js";
-import { fleetEditableFromConfig, fleetEditableEquals, fleetRepoOverlayFromDelta, formatFleetPrint, globalConfigDir, overlayPreferShapes, readOverlayFile, repoOverlayPath, repoOverlayYaml, ROUTING_MODES, unifiedYamlDiff, } from "../../config/config.js";
+import { fleetEditableFromConfig, fleetEditableEquals, fleetRepoOverlayFromDelta, formatFleetPrint, globalConfigDir, overlayBytesLoadError, overlayPreferShapes, readOverlayFile, repoOverlayPath, repoOverlayYaml, ROUTING_MODES, unifiedYamlDiff, } from "../../config/config.js";
 import { SHAPES, TIERS } from "../../graph/schema.js";
 import { route } from "../../route/router.js";
 import { resolveRunMode } from "../../run/daemon.js";
@@ -357,7 +357,8 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             return `${shape}  →  ${now}${auto}`;
         });
         const shapesTitle = "step 5/5 · shape routing";
-        const shapesLegend = "↑↓/jk move · a auto · p pin · t tier · f prefer · enter next · esc/q quit";
+        // v1.52 T5: no map-tier editing action — routing.floors is the only band authority now.
+        const shapesLegend = "↑↓/jk move · a auto · p pin · f prefer · enter next · esc/q quit";
         let sCursor = 0;
         term.frame(listFrame(shapesTitle, shapesLegend, shapeRows(), sCursor));
         for (;;) {
@@ -388,15 +389,6 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 editable.map[shape] = { pin: { via: pin.slice(0, i), model: pin.slice(i + 1) } };
                 changed = true;
             }
-            else if (k.name === "t") {
-                const tier = (await term.askTyped(`tier (${TIERS.join("|")})> `));
-                if (!TIERS.includes(tier))
-                    return { out: `fleet: invalid tier ${tier}`, code: 1 };
-                const next = { ...entry, tier };
-                delete next.pin;
-                editable.map[shape] = next;
-                changed = true;
-            }
             else if (k.name === "f") {
                 const pref = await term.askTyped("prefer (comma-separated adapters or adapter:model)> ");
                 editable.map[shape] = { ...entry, prefer: pref.split(",").map((s) => s.trim()).filter(Boolean) };
@@ -424,6 +416,13 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         if (!/^y(?:es)?$/i.test(confirm))
             return "fleet: discarded overlay changes";
         const path = repoOverlayPath(cwd);
+        // v1.52 T2 reload guard: the exact bytes about to land must reload through the production
+        // loader path, or the write is refused and the existing overlay stays untouched (OBS-75 class:
+        // fleet must never persist a config that bricks every later command).
+        const loadError = overlayBytesLoadError(cwd, after, { globalDir });
+        if (loadError) {
+            return { out: `fleet: refusing to write ${path} — the config loader rejects the proposed overlay:\n${loadError}`, code: 1 };
+        }
         mkdirSync(dirname(path), { recursive: true });
         writeFileSync(path, after);
         return `fleet: wrote ${path}`;

package/dist/config/config.d.ts

@@ -20,11 +20,7 @@ export declare const MapEntrySchema: z.ZodObject<{
         via: z.ZodString;
         model: z.ZodString;
     }, z.core.$strip>>;
-    tier: z.ZodOptional<z.ZodEnum<{
-        cheap: "cheap";
-        mid: "mid";
-        frontier: "frontier";
-    }>>;
+    tier: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodNull>, z.ZodTransform<undefined, null | undefined>>>;
     prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
     escalate: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
@@ -78,11 +74,7 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
                 via: z.ZodString;
                 model: z.ZodString;
             }, z.core.$strip>>;
-            tier: z.ZodOptional<z.ZodEnum<{
-                cheap: "cheap";
-                mid: "mid";
-                frontier: "frontier";
-            }>>;
+            tier: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodNull>, z.ZodTransform<undefined, null | undefined>>>;
             prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
             escalate: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
@@ -219,6 +211,7 @@ export type ModeResolution = {
  *  already applied to cfg.routing.floors — route() consumes floors only and never sees the mode. */
 export declare function loadConfigWithMode(repoRoot: string, opts?: {
     globalDir?: string;
+    repoOverlayText?: string;
 }): {
     cfg: TickmarkrConfig;
     mode: ModeResolution;
@@ -226,6 +219,12 @@ export declare function loadConfigWithMode(repoRoot: string, opts?: {
 export declare function loadConfig(repoRoot: string, opts?: {
     globalDir?: string;
 }): TickmarkrConfig;
+/** v1.52 T2 write-time reload guard: run candidate repo-overlay bytes through the SAME production
+ *  loader path every later command uses (parse → merge → schema → mode resolution). Returns null
+ *  when the bytes load, else the loader's failure message — the caller must refuse the write. */
+export declare function overlayBytesLoadError(repoRoot: string, bytes: string, opts?: {
+    globalDir?: string;
+}): string | null;
 export type InitConfigOverlay = {
     concurrency?: number;
     driver?: TickmarkrConfig["driver"];

package/dist/config/config.js

@@ -20,9 +20,21 @@ const ModeEnum = z.enum(ROUTING_MODES, {
 // Integrity set (weak-oracle shapes, OBS-68..70 class): no mode may resolve these below frontier.
 // Only an explicit operator floor line can — and it draws a standing plan lint every load.
 export const INTEGRITY_FLOOR_SHAPES = ["plan", "spec", "migration", "ui"];
+// v1.52 T5: tier is no longer a map-entry band authority — routing.floors is the only tier
+// source left (v1.51 T3 deprecated this field with a promise to remove it here). Only the legacy
+// `tier: null` tombstone still parses (and normalizes to absent); any real value fails config
+// load fail-closed, naming routing.floors as the move target, so a band intent set here can never
+// silently vanish. The field stays in the schema/type as an always-undefined marker (not deleted
+// outright) so a map entry can never carry a real tier value again, structurally.
 export const MapEntrySchema = z.object({
     pin: z.object({ via: z.string(), model: z.string() }).optional(),
-    tier: TierEnum.optional(),
+    tier: z
+        .null({
+        error: (iss) => `routing.map entry tier ${JSON.stringify(iss.input)} is no longer a band authority — move this value to routing.floors.<shape> (only "tier: null" tombstones still parse)`,
+    })
+        .optional()
+        .transform(() => undefined)
+        .optional(),
     prefer: z.array(z.string()).optional(),
     escalate: z.boolean().optional(),
 });
@@ -167,11 +179,10 @@ export const DEFAULT_CONFIG = {
     taskTimeoutMinutes: 30,
     contextWarnTokens: 170_000, // v1.23 T2: overseer ctx-watch.sh proven threshold
     routing: {
-        // v1.51 T3 (round-2 consult): map entries carry preferences/pins only — band policy lives in
-        // routing.floors, the single tier authority. The dropped tiers (implement mid, tests cheap,
-        // docs cheap) were byte-equal to the floors below, so routing is unchanged. Overlay map tiers
-        // still parse but draw a move-to-floors lint in plan/doctor; MapEntrySchema.tier removal itself
-        // is deferred to the next version (tombstone grammar: tier: null).
+        // v1.51 T3 (round-2 consult) / v1.52 T5: map entries carry preferences/pins only — band
+        // policy lives in routing.floors, the single tier authority. A map entry can no longer carry
+        // a real tier value at all: MapEntrySchema fails config load fail-closed on one, naming
+        // routing.floors as the move target; only the legacy `tier: null` tombstone still parses.
         map: {
             plan: { pin: { via: "claude-code", model: "fable" } },
             spec: { pin: { via: "claude-code", model: "fable" } },
@@ -294,7 +305,9 @@ function deepMerge(base, over) {
             delete out[k]; // v1.1 tombstone: an explicit null in an overlay removes the key (e.g. stale tiers model ids)
             continue;
         }
-        out[k] = k in out ? deepMerge(out[k], v) : v;
+        // OBS-75 class: merge fresh-landing objects onto {} so nested tombstone nulls are pruned even when
+        // no lower layer set the key (a fleet-cleared deny writes {adapters: null} — the schema rejects raw null)
+        out[k] = k in out ? deepMerge(out[k], v) : deepMerge({}, v);
     }
     return out;
 }
@@ -393,7 +406,11 @@ function resolveRoutingMode(cfg, layers) {
  *  already applied to cfg.routing.floors — route() consumes floors only and never sees the mode. */
 export function loadConfigWithMode(repoRoot, opts = {}) {
     const globalCfg = readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml"));
-    const repoCfg = readYaml(join(repoRoot, stateDirName(repoRoot), "config.yaml"));
+    // v1.52 T2: repoOverlayText substitutes candidate bytes for the on-disk repo layer — the fleet
+    // write guard validates EXACTLY what it is about to write through this one loader path.
+    const repoCfg = opts.repoOverlayText === undefined
+        ? readYaml(join(repoRoot, stateDirName(repoRoot), "config.yaml"))
+        : parse(opts.repoOverlayText);
     const merged = deepMerge(deepMerge(structuredClone(DEFAULT_CONFIG), globalCfg), repoCfg);
     const r = TickmarkrConfigSchema.safeParse(merged);
     if (!r.success)
@@ -403,6 +420,18 @@ export function loadConfigWithMode(repoRoot, opts = {}) {
 export function loadConfig(repoRoot, opts = {}) {
     return loadConfigWithMode(repoRoot, opts).cfg;
 }
+/** v1.52 T2 write-time reload guard: run candidate repo-overlay bytes through the SAME production
+ *  loader path every later command uses (parse → merge → schema → mode resolution). Returns null
+ *  when the bytes load, else the loader's failure message — the caller must refuse the write. */
+export function overlayBytesLoadError(repoRoot, bytes, opts = {}) {
+    try {
+        loadConfigWithMode(repoRoot, { ...opts, repoOverlayText: bytes });
+        return null;
+    }
+    catch (e) {
+        return e.message;
+    }
+}
 export function configTemplate(overlay) {
     const base = `# tickmarkr config overlay — merges over built-in defaults (repo beats global beats defaults)
 # concurrency: 3
@@ -418,7 +447,7 @@ export function configTemplate(overlay) {
 #   map:                  # per-shape preferences/pins; band policy lives in routing.floors
 #     implement: { prefer: [cursor-agent, codex] }
 #     migration: { pin: { via: claude-code, model: fable } }
-#     tests: { tier: null }   # tombstone: null removes a legacy map tier (deprecated — move the band to routing.floors.tests; schema removal lands next version)
+#     tests: { tier: null }   # tombstone: null removes a legacy map tier (a real tier value now fails config load — move the band to routing.floors.tests)
 #   floors:               # tier authority — advisory minimum bands; 'tickmarkr plan' lints violations
 #     migration: frontier
 #   learned: on            # default ON (ROUTE-14); cold profile = exact v1.5 static routing, warms per workspace. Set 'off' to pin static routing; preview with 'tickmarkr plan'
@@ -656,7 +685,9 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}) {
             }
         }
         if (Object.keys(modelDelta).length) {
-            tiersOut[adapter] = { models: { ...tiersOut[adapter]?.models, ...modelDelta } };
+            // spread the existing entry so vendor/channel/windows survive the rewrite — dropping them
+            // makes the overlay unloadable for any adapter without a default seed (reload-guard class)
+            tiersOut[adapter] = { ...tiersOut[adapter], models: { ...tiersOut[adapter]?.models, ...modelDelta } };
             tiersTouched = true;
         }
     }
@@ -682,47 +713,58 @@ export function serializeFleetOverlay(overlay, provenance = {}) {
         return "";
     const lines = [];
     const today = new Date().toISOString().slice(0, 10);
+    // OBS-75: never glue stringify() output onto a key line — wrap the key into the object and
+    // re-indent the whole emitted block, so sequences/nested maps nest correctly and null
+    // tombstones/empty collections survive the serialize→parse round-trip.
+    const block = (obj, pad) => stringify(obj).trimEnd().split("\n").map((l) => `${pad}${l}`);
     const routing = overlay.routing;
     if (routing) {
         lines.push("routing:");
         const deny = routing.deny;
-        if (deny) {
+        if (deny && (deny.adapters !== undefined || deny.models !== undefined)) {
             lines.push("  deny:");
-            if (deny.adapters)
-                lines.push(`    adapters: ${stringify(deny.adapters).trim()}`);
-            if (deny.models)
-                lines.push(`    models: ${stringify(deny.models).trim()}`);
-        }
-        if (routing.map) {
-            lines.push("  map:");
-            for (const [shape, entry] of Object.entries(routing.map)) {
-                lines.push(`    ${shape}:`);
-                const body = stringify(entry, { indent: 2 }).trim().split("\n");
-                lines.push(...body.map((l) => `      ${l}`));
-            }
+            if (deny.adapters !== undefined)
+                lines.push(...block({ adapters: deny.adapters }, "    "));
+            if (deny.models !== undefined)
+                lines.push(...block({ models: deny.models }, "    "));
         }
+        if (routing.map)
+            lines.push(...block({ map: routing.map }, "  "));
         if (routing.floors)
-            lines.push(`  floors: ${stringify(routing.floors).trim().replace(/^/gm, "  ")}`);
+            lines.push(...block({ floors: routing.floors }, "  "));
     }
     const tiers = overlay.tiers;
-    if (tiers) {
+    if (tiers && Object.keys(tiers).length) {
         lines.push("tiers:");
         for (const [adapter, entry] of Object.entries(tiers)) {
-            lines.push(`  ${adapter}:`);
+            const body = [];
             if (entry.vendor)
-                lines.push(`    vendor: ${entry.vendor}`);
+                body.push(`    vendor: ${entry.vendor}`);
             if (entry.channel)
-                lines.push(`    channel: ${entry.channel}`);
-            lines.push("    models:");
-            for (const [model, tier] of Object.entries(entry.models ?? {})) {
-                if (tier === null)
-                    lines.push(`      ${model}: null`);
-                else {
-                    const note = provenance[adapter]?.[model];
-                    const suffix = note ? `  # ${note} — fleet ${today}` : "";
-                    lines.push(`      ${model}: ${tier}${suffix}`);
+                body.push(`    channel: ${entry.channel}`);
+            if (entry.windows)
+                body.push(...block({ windows: entry.windows }, "    "));
+            const models = Object.entries(entry.models ?? {});
+            if (models.length) {
+                body.push("    models:");
+                for (const [model, tier] of models) {
+                    if (tier === null)
+                        body.push(`      ${model}: null`);
+                    else {
+                        const note = provenance[adapter]?.[model];
+                        const suffix = note ? `  # ${note} — fleet ${today}` : "";
+                        body.push(`      ${model}: ${tier}${suffix}`);
+                    }
                 }
             }
+            else if (entry.models) {
+                body.push("    models: {}"); // present-but-empty: explicit {} — a childless header parses as null and the loader rejects it
+            }
+            // a bare `adapter:` line parses as a null tombstone and would DELETE the adapter's default seeds on merge
+            if (body.length)
+                lines.push(`  ${adapter}:`, ...body);
+            else
+                lines.push(`  ${adapter}: {}`);
         }
     }
     return `${lines.join("\n")}\n`;

package/dist/route/router.d.ts

@@ -32,6 +32,7 @@ export interface ExploreContext {
 }
 export declare const NO_EXPLORE_ENV = "TICKMARKR_NO_EXPLORE";
 export declare const QUALITY_ENV = "TICKMARKR_QUALITY";
+export declare const ROUTING_ENV_SEAMS: readonly ["TICKMARKR_QUALITY", "TICKMARKR_NO_EXPLORE"];
 export declare const raiseTier: (tier: Tier) => Tier;
 export declare class RoutingError extends Error {
     constructor(msg: string);

package/dist/route/router.js

@@ -4,6 +4,9 @@ import { disallowedBy } from "./preference.js";
 import { cellOf, EXPLORE_CAP, explorationBonus, learnedScore, MIN_SAMPLES } from "./profile.js";
 export const NO_EXPLORE_ENV = "TICKMARKR_NO_EXPLORE";
 export const QUALITY_ENV = "TICKMARKR_QUALITY";
+// OBS-74: every routing env seam, in one list — the spawn seam (src/run/git.ts) scrubs exactly
+// these from child env so gate/baseline/tip-verify children are hermetic by construction.
+export const ROUTING_ENV_SEAMS = [QUALITY_ENV, NO_EXPLORE_ENV];
 const exploreCap = (cfg) => cfg.routing.explore?.cap ?? EXPLORE_CAP;
 const qualityOn = (exploreCtx) => !!exploreCtx?.quality || process.env[QUALITY_ENV] === "1";
 export const raiseTier = (tier) => tier === "cheap" ? "mid" : tier === "mid" ? "frontier" : "frontier";
@@ -160,15 +163,13 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
         maybeSlaLint(lints, task, profile, slaMinutes, c);
         return { assignment: toAssignment(c), ladder: ladderFor(task, entry), lints, provenance: `${degraded}pin ${entry.pin.via}:${entry.pin.model} (config routing.map)` };
     }
-    const baseTier = entry?.tier ?? floor ?? "cheap";
+    const baseTier = floor ?? "cheap";
     let minTier = taskFloor && TIER_RANK[taskFloor] > TIER_RANK[baseTier] ? taskFloor : baseTier; // task floor is a hard >= constraint in all paths (D-04)
     if (quality && advisoryFloor) {
         const raised = raiseTier(advisoryFloor);
         if (TIER_RANK[raised] > TIER_RANK[minTier])
             minTier = raised;
     }
-    if (entry?.tier)
-        lintFloor(entry.tier, "map tier");
     if (prefActive)
         for (const p of prefer ?? [])
             preflightPrefer(p);
@@ -253,9 +254,8 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
     }
     const bound = qualityBound(quality, advisoryFloor, taskFloorRaw) ??
         (taskFloor && TIER_RANK[taskFloor] >= TIER_RANK[baseTier] ? `floor ${taskFloor} (task hint${src})` :
-            entry?.tier ? `tier ${entry.tier} (config routing.map)` :
-                floor ? `floor ${floor} (config floors)` :
-                    "tier cheap (default)");
+            floor ? `floor ${floor} (config floors)` :
+                "tier cheap (default)");
     // name the key that actually broke the tie: prefer outranks the marginal-cost/tier keys, so if the
     // winner matched a prefer entry, prefer decided it — not "cheapest sufficient tier" (ROUTE-03, WR-01)
     const preferVia = preferFromAuto(task.shape, preferCtx)

package/dist/run/git.d.ts

@@ -1,3 +1,5 @@
+import { ROUTING_ENV_SEAMS } from "../route/router.js";
+export { ROUTING_ENV_SEAMS };
 export interface ShResult {
     code: number;
     stdout: string;

package/dist/run/git.js

@@ -3,14 +3,23 @@ import { existsSync, lstatSync, readlinkSync, rmSync, symlinkSync } from "node:f
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
+import { ROUTING_ENV_SEAMS } from "../route/router.js";
+export { ROUTING_ENV_SEAMS };
 // stdin "ignore": same class as HARD-05 / SubprocessDriver — never leave an open pipe a child can block on
 // (pi -p / codex exec wait for stdin EOF). timedOut distinguishes SIGKILL-timeout from a real nonzero exit.
 function shell(cmd, cwd, timeoutMs, login) {
+    // OBS-74: scrub tickmarkr's own routing env seams from every child — a daemon carrying
+    // TICKMARKR_QUALITY leaked it into baseline/gate/tip-verify children, turning a dogfood
+    // repo's route() tests red inside the gates. Scrub a copy at this one choke point so
+    // children are hermetic by construction; the daemon's own process.env stays unchanged.
+    const env = { ...process.env };
+    for (const k of ROUTING_ENV_SEAMS)
+        delete env[k];
     return new Promise((resolve) => {
         // detached: bash gets its own process group so a timeout can kill the whole tree —
         // SIGKILLing bash alone orphans grandchildren (codex/pi) that hold the stdio pipes
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
-        const p = spawn("bash", [login ? "-lc" : "-c", cmd], { cwd, stdio: ["ignore", "pipe", "pipe"], detached: true });
+        const p = spawn("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
         let stdout = "", stderr = "";
         let timedOut = false, done = false;
         const finish = (code, err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.51.0",
+  "version": "1.52.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",