tickmarkr 1.51.0 → 1.53.0

package/dist/adapters/codex.js

@@ -126,6 +126,9 @@ export function hasCodexTrustedProject(text, root) {
 export const codex = {
     id: "codex",
     vendor: "openai",
+    // OBS-72: codex probes self-contend in one repo (v1.33.5: 4 concurrent → all 4 timed out;
+    // 2026-07-18: gpt-5.5 lost the concurrent pair every doctor sweep) — probe one model at a time.
+    probeConcurrency: 1,
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)

package/dist/adapters/kimi.d.ts

@@ -2,4 +2,5 @@ import { type WorkerAdapter, type WorkerResult } from "./types.js";
 export declare function kimiAuthed(credentialsText: string, nowMs: number): boolean;
 export declare function parseKimiModels(raw: string): string[];
 export declare function parseKimiResult(raw: string, nonce: string): WorkerResult;
+export declare function kimiSessionId(output: string): string | undefined;
 export declare const kimi: WorkerAdapter;

package/dist/adapters/kimi.js

@@ -46,6 +46,21 @@ export function parseKimiResult(raw, nonce) {
     const stripped = raw.split("\n").map((l) => l.replace(/^[\s]*[•*-]\s+/, "")).join("\n");
     return parseWorkerResult(stripped, nonce);
 }
+// v1.53 T3: session-id capture from the run-output trailer — every `kimi -p` run (fresh or resumed)
+// ends with `To resume this session: kimi -r session_<uuid>` (live probe 2026-07-18). Anchored full
+// line only: prompt/model prose can contain lookalike text, and the anchored charset keeps a
+// captured id shell-safe by construction (shq in resumeCommand is the second layer). Last valid
+// line wins — a run may echo stale resume lines mid-transcript.
+const RESUME_TRAILER_RE = /^\s*To resume this session: kimi -r (session_[0-9a-f-]+)\s*$/;
+export function kimiSessionId(output) {
+    let id;
+    for (const line of output.split("\n")) {
+        const m = RESUME_TRAILER_RE.exec(line);
+        if (m)
+            id = m[1];
+    }
+    return id;
+}
 export const kimi = {
     id: "kimi",
     vendor: "moonshot",
@@ -73,6 +88,15 @@ export const kimi = {
     // ("unknown command '…'", live-verified 2026-07-17, OBS-67) and -p is non-interactive-only.
     // null → the daemon's print fallback (types.ts:101) keeps kimi workers visible without a TUI.
     interactiveCommand: () => null,
+    // v1.53 T3 resume — live-probed 2026-07-18: `-p` + `-S <id>` compose cleanly (no OBS-67-class
+    // flag rejection) and the resumed session carries prior conversation state. `-S <id>` is the
+    // deterministic form; `-c` rejected as primary — cwd-keyed, nondeterministic under worktree
+    // recreation (probe finding 4). Never bare `-S` (it launches the interactive session picker).
+    resumeCommand: (sessionId, promptFile, model) => `kimi -S ${shq(sessionId)} -p "$(cat ${shq(promptFile)})" --model ${shq(model)} --output-format text`,
+    sessionIdFrom: kimiSessionId,
+    // KIMI-03: no contextUsage surface exists, so a known-context requirement would leave resume
+    // dead code — declare the unknown-context opt-in the daemon retry seam enforces.
+    resumeUnknownContext: true,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },

package/dist/adapters/model-lints.d.ts

@@ -17,7 +17,6 @@ export type RoutedAssignment = {
 /** Advisory only — absent windows config or undeclared model window ⇒ no lint. */
 export declare function contextWindowLints(tasks: ReadonlyArray<Task>, assignments: ReadonlyArray<RoutedAssignment>, cfg: TickmarkrConfig, repoRoot: string): string[];
 export declare function seedPreferLints(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], overlayPreferShapes?: ReadonlySet<string>): string[];
-export declare function mapTierLints(cfg: TickmarkrConfig): string[];
 export declare function modelLints(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], opts?: {
     tty?: boolean;
     stateDir?: string;

package/dist/adapters/model-lints.js

@@ -68,8 +68,8 @@ export function contextWindowLints(tasks, assignments, cfg, repoRoot) {
     return lints;
 }
 const adapterHasAuthedChannel = (adapterId, shape, cfg, health, adapters) => {
-    const entry = cfg.routing.map[shape];
-    const minTier = entry?.tier ?? cfg.routing.floors[shape] ?? "cheap";
+    // v1.52 T5: routing.floors is the only band authority — a map entry can no longer carry a tier.
+    const minTier = cfg.routing.floors[shape] ?? "cheap";
     const a = adapters.find((x) => x.id === adapterId);
     const h = health[adapterId];
     if (!a || !h?.installed || typeof a.channels !== "function")
@@ -95,14 +95,6 @@ export function seedPreferLints(cfg, health, adapters, overlayPreferShapes = new
     }
     return lints;
 }
-// v1.51 T3: built-in defaults no longer carry map tiers, so any tier surviving the merge came from an
-// overlay. Deprecated — routing.floors is the single band authority; MapEntrySchema.tier removal itself
-// is deferred to the next version. One lint per shape, identical text on every surface (plan + doctor).
-export function mapTierLints(cfg) {
-    return Object.entries(cfg.routing.map)
-        .filter(([, entry]) => entry.tier !== undefined)
-        .map(([shape, entry]) => `routing.map.${shape}.tier: ${entry.tier} is deprecated — move this value to routing.floors.${shape} (single band authority; tier removal deferred to next version)`);
-}
 // Diffs detected models (doctor.json) against configured tiers, both directions, per adapter id in cfg.tiers.
 // No `  ! ` prefix here — the consumer (doctor rows / plan lints) owns that. Pre-v1.5 doctor.json (models:[], no
 // modelsDetectedAt) is the compat baseline: `?.`/`?? []` everywhere, no zod (would reject old files).
@@ -145,7 +137,6 @@ export function modelLints(cfg, health, adapters, opts) {
         }
     }
     lints.push(...seedPreferLints(cfg, health, adapters, opts?.overlayPreferShapes));
-    lints.push(...mapTierLints(cfg)); // v1.51 T3: shared here so plan and doctor draw the exact same message
     return lints;
 }
 // T2/T6: one lint per exclusion, naming the probe reason and date. TTY truncates reasons to 60 chars and

package/dist/adapters/registry.js

@@ -82,8 +82,10 @@ function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TI
     if (timedOut)
         return `probe timed out after ${timeoutMs}ms`;
     const output = `${stderr}\n${stdout}`.trim().replace(/\s+/g, " ");
+    // OBS-72: TAIL, not head — the error lands at the END of CLI output; a head slice stores only the
+    // startup banner and hid the real "Not inside a trusted directory" failure for a day.
     return code !== 0 || QUOTA_RE.test(output) || AUTH_FAILURE_RE.test(output)
-        ? output.slice(0, 240) || `probe exited ${code}`
+        ? output.slice(-240) || `probe exited ${code}`
         : undefined;
 }
 export const pendingAutoPreferKey = Symbol.for("tickmarkr.pendingAutoPrefer");
@@ -97,8 +99,9 @@ export const DOCTOR_ROUTING_STALE_MS = 24 * 60 * 60 * 1000;
 export function deriveAutoPrefer(cfg, adapters, health, profile) {
     const derivedAt = new Date().toISOString();
     const out = { derivedAt };
-    for (const [shape, entry] of Object.entries(cfg.routing.map)) {
-        const minTier = entry?.tier ?? cfg.routing.floors[shape] ?? "cheap";
+    // v1.52 T5: routing.floors is the only band authority — a map entry can no longer carry a tier.
+    for (const shape of Object.keys(cfg.routing.map)) {
+        const minTier = cfg.routing.floors[shape] ?? "cheap";
         const ranked = [];
         for (const a of adapters) {
             const h = health[a.id];
@@ -153,54 +156,70 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
         const verdicts = {};
         const priorModelAuth = priorHealth?.[a.id]?.modelAuth;
         const probeRoot = a.probeCwd === "neutral" ? mkdtempSync(join(tmpdir(), "tickmarkr-probe-")) : repoRoot;
-        // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
-        // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
-        // Capped at MODEL_PROBE_CONCURRENCY per adapter (v1.33.5 regression: 4 concurrent codex exec
-        // in one repo made ALL 4 codex probes time out where sequential passed 2/4).
-        await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), MODEL_PROBE_CONCURRENCY, async (model) => {
+        const store = (model, verdict) => {
+            verdicts[model] = verdict;
+            onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
+        };
+        // One bounded probe call. verdict:null = a first-pass failure that earns the one serial retry
+        // (OBS-72: a failure inside the concurrent batch is indistinguishable from adapter self-contention
+        // until re-probed alone); a retry attempt always returns a final verdict.
+        const attempt = async (model, retry) => {
             const t0 = Date.now();
             const probedAt = new Date().toISOString();
-            const priorTimedOut = priorModelAuth?.[model]?.reason?.includes("timed out") === true;
-            let verdict;
+            const v = (authed, reason) => ({ authed, ...(reason !== undefined ? { reason } : {}), probedAt, durationMs: Date.now() - t0 });
             try {
-                if (typeof a.headlessCommand !== "function") {
-                    verdict = { authed: false, reason: "headless probe unavailable", probedAt, durationMs: Date.now() - t0 };
-                }
-                else {
-                    const promptFile = join(mkdtempSync(join(tmpdir(), "tickmarkr-auth-")), "probe.md");
-                    writeFileSync(promptFile, MODEL_PROBE_PROMPT);
-                    const r = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
-                    if (r.timedOut && priorTimedOut) {
-                        verdict = { authed: false, reason: `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`, probedAt, durationMs: Date.now() - t0 };
-                    }
-                    else if (r.timedOut) {
-                        const r2 = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
-                        if (r2.timedOut) {
-                            verdict = { authed: false, reason: `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`, probedAt, durationMs: Date.now() - t0 };
-                        }
-                        else {
-                            const reason = probeFailure(r2.code, r2.stdout, r2.stderr, r2.timedOut, MODEL_PROBE_TIMEOUT_MS);
-                            verdict = reason ? { authed: false, reason, probedAt, durationMs: Date.now() - t0 } : { authed: true, probedAt, durationMs: Date.now() - t0 };
-                        }
-                    }
-                    else {
-                        const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
-                        verdict = reason ? { authed: false, reason, probedAt, durationMs: Date.now() - t0 } : { authed: true, probedAt, durationMs: Date.now() - t0 };
-                    }
+                if (typeof a.headlessCommand !== "function")
+                    return { verdict: v(false, "headless probe unavailable"), timedOut: false };
+                const promptFile = join(mkdtempSync(join(tmpdir(), "tickmarkr-auth-")), "probe.md");
+                writeFileSync(promptFile, MODEL_PROBE_PROMPT);
+                const r = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
+                // T2 rule unchanged: a prior doctor.json timeout skips the retry — a persistently dead
+                // model (e.g. opencode glm-5.2) costs one attempt instead of two every run.
+                if (r.timedOut && !retry && priorModelAuth?.[model]?.reason?.includes("timed out") === true) {
+                    return { verdict: v(false, `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`), timedOut: true };
                 }
+                const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
+                if (!reason)
+                    return { verdict: v(true), timedOut: false };
+                if (!retry)
+                    return { verdict: null, timedOut: r.timedOut === true };
+                return {
+                    verdict: r.timedOut && retry.firstTimedOut ? v(false, `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`) : v(false, reason),
+                    timedOut: r.timedOut === true,
+                };
             }
             catch (e) {
-                verdict = { authed: false, reason: String(e), probedAt, durationMs: Date.now() - t0 };
+                return { verdict: retry ? v(false, String(e)) : null, timedOut: false };
             }
-            verdicts[model] = verdict;
-            onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
+        };
+        // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
+        // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
+        // Capped at MODEL_PROBE_CONCURRENCY per adapter unless the adapter declares its own cap
+        // (codex: 1 — OBS-72, its concurrent probes self-contend in one repo).
+        const retries = [];
+        await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), a.probeConcurrency ?? MODEL_PROBE_CONCURRENCY, async (model) => {
+            const first = await attempt(model);
+            if (first.verdict)
+                store(model, first.verdict);
+            else
+                retries.push({ model, firstTimedOut: first.timedOut });
         });
+        // OBS-72: re-probe each first-pass failure once with ONE probe in flight, only after the
+        // concurrent batch drained — an in-slot retry still races its concurrency partner. Success here
+        // was contention; a second failure is the real verdict. Successful first-pass probes stored
+        // above and never wait; cost is one extra call per genuinely dead model only.
+        for (const { model, firstTimedOut } of retries) {
+            const second = await attempt(model, { firstTimedOut });
+            if (second.verdict)
+                store(model, second.verdict);
+        }
         h.modelAuth = verdicts;
     }));
     health[pendingAutoPreferKey] = deriveAutoPrefer(cfg, adapters, health);
 }
 // T2: caps concurrent probes per adapter at 2 — v1.33.5 regression, 4 concurrent codex exec in one
 // repo made ALL 4 time out where sequential passed 2/4 (suspected CLI self-contention).
+// v1.52 T4: default only — an adapter's own probeConcurrency declaration wins (codex: 1).
 const MODEL_PROBE_CONCURRENCY = 2;
 async function mapLimit(items, limit, fn) {
     let i = 0;

package/dist/adapters/types.d.ts

@@ -73,11 +73,14 @@ export interface WorkerAdapter {
     id: string;
     vendor: string;
     probeCwd?: "repo" | "neutral";
+    probeConcurrency?: number;
     probe(): Promise<AuthHealth>;
     channels(cfg: TickmarkrConfig): BillingChannel[];
     headlessCommand(promptFile: string, model: string): string;
     interactiveCommand(promptFile: string, model: string): string | null;
     resumeCommand?(sessionId: string, promptFile: string, model: string): string;
+    sessionIdFrom?(output: string): string | undefined;
+    resumeUnknownContext?: boolean;
     invoke(task: Task, cwd: string, a: Assignment, ctx: {
         promptFile: string;
     }): Invocation;

package/dist/cli/commands/fleet.js

@@ -6,7 +6,7 @@ import { parseArgs } from "node:util";
 import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, readAutoPrefer } from "../../adapters/registry.js";
 import { fleetUnclassifiedModels } from "../../adapters/model-lints.js";
 import { GLYPHS, bold, legend as legendText, toggleActive, toggleInactive } from "../../brand.js";
-import { fleetEditableFromConfig, fleetEditableEquals, fleetRepoOverlayFromDelta, formatFleetPrint, globalConfigDir, overlayPreferShapes, readOverlayFile, repoOverlayPath, repoOverlayYaml, ROUTING_MODES, unifiedYamlDiff, } from "../../config/config.js";
+import { fleetEditableFromConfig, fleetEditableEquals, fleetRepoOverlayFromDelta, formatFleetPrint, globalConfigDir, overlayBytesLoadError, overlayPreferShapes, readOverlayFile, repoOverlayPath, repoOverlayYaml, ROUTING_MODES, unifiedYamlDiff, } from "../../config/config.js";
 import { SHAPES, TIERS } from "../../graph/schema.js";
 import { route } from "../../route/router.js";
 import { resolveRunMode } from "../../run/daemon.js";
@@ -140,6 +140,9 @@ function openTerm(input, output) {
             finally {
                 rl.close();
                 setRaw(true);
+                // rl.close() pauses the input stream — without a resume the next key() await has
+                // nothing keeping the event loop alive and the process silently exits 0 (OBS-77)
+                input.resume();
                 queue.splice(typedFrom);
                 prevLines = 0;
             }
@@ -357,7 +360,8 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             return `${shape}  →  ${now}${auto}`;
         });
         const shapesTitle = "step 5/5 · shape routing";
-        const shapesLegend = "↑↓/jk move · a auto · p pin · t tier · f prefer · enter next · esc/q quit";
+        // v1.52 T5: no map-tier editing action — routing.floors is the only band authority now.
+        const shapesLegend = "↑↓/jk move · a auto · p pin · f prefer · enter next · esc/q quit";
         let sCursor = 0;
         term.frame(listFrame(shapesTitle, shapesLegend, shapeRows(), sCursor));
         for (;;) {
@@ -388,15 +392,6 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 editable.map[shape] = { pin: { via: pin.slice(0, i), model: pin.slice(i + 1) } };
                 changed = true;
             }
-            else if (k.name === "t") {
-                const tier = (await term.askTyped(`tier (${TIERS.join("|")})> `));
-                if (!TIERS.includes(tier))
-                    return { out: `fleet: invalid tier ${tier}`, code: 1 };
-                const next = { ...entry, tier };
-                delete next.pin;
-                editable.map[shape] = next;
-                changed = true;
-            }
             else if (k.name === "f") {
                 const pref = await term.askTyped("prefer (comma-separated adapters or adapter:model)> ");
                 editable.map[shape] = { ...entry, prefer: pref.split(",").map((s) => s.trim()).filter(Boolean) };
@@ -424,6 +419,13 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         if (!/^y(?:es)?$/i.test(confirm))
             return "fleet: discarded overlay changes";
         const path = repoOverlayPath(cwd);
+        // v1.52 T2 reload guard: the exact bytes about to land must reload through the production
+        // loader path, or the write is refused and the existing overlay stays untouched (OBS-75 class:
+        // fleet must never persist a config that bricks every later command).
+        const loadError = overlayBytesLoadError(cwd, after, { globalDir });
+        if (loadError) {
+            return { out: `fleet: refusing to write ${path} — the config loader rejects the proposed overlay:\n${loadError}`, code: 1 };
+        }
         mkdirSync(dirname(path), { recursive: true });
         writeFileSync(path, after);
         return `fleet: wrote ${path}`;

package/dist/cli/commands/plan.js

@@ -2,7 +2,7 @@ import { allAdapters, discoverChannels, doctorAgeMs, modelAuthExclusions, probeA
 import { formatModelAuthLine, contextWindowLints, modelLints, ttyVisual } from "../../adapters/model-lints.js";
 import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
 import { parseArgs } from "node:util";
-import { collateralLints } from "../../compile/collateral.js";
+import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
 import { DEFAULT_CONFIG, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
 import { loadGraph } from "../../graph/graph.js";
 import { resolveRunMode } from "../../run/daemon.js";
@@ -170,8 +170,8 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters())
     const windowLints = contextWindowLints(g.tasks, routed, cfg, cwd);
     if (windowLints.length)
         lines.push("", "context window lints:", ...windowLints.map((l) => `  ! ${l}`));
-    // OBS-12/13/14/21: advisory only — never blocks --route-strict (run refuses on routing lints only)
-    const scopeLints = collateralLints(g.tasks, cwd);
+    // OBS-12/13/14/21 + OBS-76: advisory only — never blocks --route-strict (run refuses on routing lints only)
+    const scopeLints = [...collateralLints(g.tasks, cwd), ...sourceScopeLints(g.tasks, cwd)];
     if (scopeLints.length)
         lines.push("", "scope lints:", ...scopeLints.map((l) => `  ! ${l}`));
     return stylizePlan(lines.join("\n"));

package/dist/cli/commands/report.js

@@ -94,6 +94,14 @@ const wallClock = (start, end) => {
     return minutes ? `${minutes}m ${seconds % 60}s` : `${seconds}s`;
 };
 const detail = (value) => typeof value === "string" || typeof value === "number" ? String(value) : EM;
+// v1.53 T5: supersession is derived from the run's OWN journal only — `superseded by` from the
+// appended superseded event (last wins), `supersedes` from the run-start stamp. No cross-run scan.
+const supersession = (events) => {
+    const by = [...events].reverse().find((e) => e.event === "superseded" && typeof e.data.by === "string")?.data.by;
+    const start = events.find((e) => e.event === "run-start");
+    const supersedes = typeof start?.data.supersedes === "string" ? start.data.supersedes : undefined;
+    return { ...(typeof by === "string" ? { supersededBy: by } : {}), ...(supersedes ? { supersedes } : {}) };
+};
 const taskIds = (events) => {
     const seen = new Set();
     const out = [];
@@ -152,10 +160,13 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
     usageLines.push(...journalUsage(events, new Set(prices.map((row) => `${row.channel}:${row.adapter}:${row.model}`))));
     if (!usageLines.length)
         usageLines.push("- **not recorded:** attempts/windows: not measurable; tokens: not measurable; price: not measurable");
+    const sup = supersession(events);
     const lines = [
         `# tickmarkr engagement`,
         "",
         `- **runId:** ${runId}`,
+        ...(sup.supersededBy ? [`- **superseded by:** ${sup.supersededBy}`] : []),
+        ...(sup.supersedes ? [`- **supersedes:** ${sup.supersedes}`] : []),
         `- **base ref:** ${baseRef}`,
         `- **branch:** ${branch}`,
         `- **done:** ${count("done")}`,
@@ -269,8 +280,11 @@ function textReport(runId, events, rows, cwd) {
     const escalations = events.filter((e) => e.event === "escalation").length;
     const consults = events.filter((e) => e.event === "consult-verdict").length;
     const failovers = events.filter((e) => e.event === "quota-failover").length;
+    const sup = supersession(events);
     return [
         `tickmarkr engagement — ${runId}`,
+        ...(sup.supersededBy ? [`superseded by ${sup.supersededBy}`] : []),
+        ...(sup.supersedes ? [`supersedes ${sup.supersedes}`] : []),
         "",
         "engagement summary — audit trail:",
         ...[...groups.entries()].map(([k, g]) => `  ${k.padEnd(30)} tasks ${g.rows.length}, attempts ${g.rows.reduce((s, r) => s + r.attempts, 0)}, done ${g.rows.filter((r) => r.outcome === "done").length}`),

package/dist/cli/commands/run.js

@@ -39,6 +39,7 @@ export async function run(argv, cwd = process.cwd()) {
             "no-explore": { type: "boolean" },
             mode: { type: "string" },
             quality: { type: "boolean" },
+            supersedes: { type: "string" },
         },
     });
     if (values.concurrency !== undefined) {
@@ -83,6 +84,7 @@ export async function run(argv, cwd = process.cwd()) {
             concurrency: values.concurrency ? Number(values.concurrency) : undefined,
             driver: pickDriver(cfg, values.driver),
             mode: flagMode,
+            supersedes: values.supersedes,
             narrate: (event) => console.log(narrationLine(event)),
         });
         const out = `run ${s.runId} finished — ${formatSummary(s)} (merge to main is a human decision)`;

package/dist/cli/commands/status.js

@@ -120,9 +120,12 @@ const renderFrame = (cwd) => {
     let events = [];
     const contexts = new Map();
     let comparable = false;
+    let supersededBy; // v1.53 T5: this run is dead — a newer run replaced it
     if (runId) {
         const j = Journal.open(cwd, runId);
         events = j.read();
+        const sup = [...events].reverse().find((e) => e.event === "superseded" && typeof e.data.by === "string");
+        supersededBy = sup?.data.by;
         // T3 (Sol #2 / Fable F2): the SAME comparator resume uses (engagementComparable) — one decision,
         // two consumers. graphDefinitionHash (compiled task definitions only) survives status/evidence
         // mutation but changes when a task definition changes, so a recompiled graph is detected here too.
@@ -164,7 +167,7 @@ const renderFrame = (cwd) => {
             return `${prefix}${shortGoal(t.goal, Math.max(0, width - prefix.length - suffix.length))}${suffix}`;
         });
         const header = runId
-            ? `tickmarkr status${divider}run ${runId}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events).replaceAll(" · ", divider)}${divider}${done}/${g.tasks.length} done`
+            ? `tickmarkr status${divider}run ${runId}${supersededBy ? `${divider}superseded by ${supersededBy}` : ""}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events).replaceAll(" · ", divider)}${divider}${done}/${g.tasks.length} done`
             : `tickmarkr status${divider}no runs yet${divider}${done}/${g.tasks.length} done`;
         const legendLine = `  gates: ${GATE_NAMES.map((gate) => `${GATE_KEYS[gate]} ${gate}`).join(divider)}`;
         return [header, legendLine, ...rows].join("\n");
@@ -186,7 +189,7 @@ const renderFrame = (cwd) => {
     const tally = `${done}/${g.tasks.length} done`;
     const header = ` ${title(runId ? `run ${runId}` : "tickmarkr")}${dot}` +
         (runId
-            ? `${!comparable ? `${warn(NOT_COMPARABLE_NOTICE)}${dot}` : ""}${live}${dot}`
+            ? `${supersededBy ? `${warn(`superseded by ${supersededBy}`)}${dot}` : ""}${!comparable ? `${warn(NOT_COMPARABLE_NOTICE)}${dot}` : ""}${live}${dot}`
             : `no runs yet${dot}`) +
         `${gauge} ${done === g.tasks.length && g.tasks.length > 0 ? ok(tally) : tally}`;
     const hr = rule(Math.min(width, 100));

package/dist/compile/collateral.d.ts

@@ -1,6 +1,12 @@
-import type { Task } from "../graph/schema.js";
+import { type Task } from "../graph/schema.js";
 /**
  * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
  * Each line names the task id and at least one missing collateral test path.
  */
 export declare function collateralLints(tasks: ReadonlyArray<Pick<Task, "id" | "files">>, repoRoot: string): string[];
+/**
+ * OBS-76 class: sweep src/ for out-of-scope source files that reference a symbol the acceptance
+ * criteria name — the v1.52 router.ts omission, named at plan time instead of one judge round in.
+ * Advisory plan output only, same contract as collateralLints.
+ */
+export declare function sourceScopeLints(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>, repoRoot: string): string[];

package/dist/compile/collateral.js

@@ -1,10 +1,11 @@
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { extname, join, relative } from "node:path";
 import picomatch from "picomatch";
-// Advisory plan-time scan only (OBS-12/13/14/21). NEVER expands files[], fails compile, or
-// feeds the scope gate — a warning the author acts on. Plain-text (no AST), capped + sorted.
-/** Max test files walked under tests/ (sorted walk; rest ignored). */
-const MAX_TEST_FILES = 400;
+import { renderAcceptanceItem } from "../graph/schema.js";
+// Advisory plan-time scan only (OBS-12/13/14/21, OBS-76). NEVER expands files[], fails compile,
+// or feeds the scope gate — a warning the author acts on. Plain-text (no AST), capped + sorted.
+/** Max files walked per root (sorted walk; rest ignored). */
+const MAX_WALK_FILES = 400;
 /** Max collateral test paths listed per task. */
 const MAX_HITS_PER_TASK = 20;
 /** Skip giant fixtures / snapshots. */
@@ -22,23 +23,23 @@ function needlesFor(srcPath) {
     // repo-relative import forms that appear in tests (ESM often uses .js)
     return [...new Set([noExt, `${noExt}.js`, `${noExt}.ts`, n])].filter((s) => s.length > 0);
 }
-function walkTests(repoRoot) {
-    const root = join(repoRoot, "tests");
+function walkCode(repoRoot, subdir) {
+    const root = join(repoRoot, subdir);
     const out = [];
     const walk = (dir) => {
-        if (out.length >= MAX_TEST_FILES)
+        if (out.length >= MAX_WALK_FILES)
             return;
         let entries;
         try {
             entries = readdirSync(dir, { withFileTypes: true });
         }
         catch {
-            return; // no tests/ or unreadable — zero lints
+            return; // no such root or unreadable — zero lints
         }
         // deterministic order
         entries.sort((a, b) => a.name.localeCompare(b.name));
         for (const e of entries) {
-            if (out.length >= MAX_TEST_FILES)
+            if (out.length >= MAX_WALK_FILES)
                 return;
             if (e.name === "node_modules" || e.name === ".git" || e.name.startsWith("."))
                 continue;
@@ -70,17 +71,10 @@ function mentions(content, needles) {
     }
     return false;
 }
-/**
- * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
- * Each line names the task id and at least one missing collateral test path.
- */
-export function collateralLints(tasks, repoRoot) {
-    const testFiles = walkTests(repoRoot);
-    if (!testFiles.length)
-        return [];
-    // cache file bodies (one read per test path)
+// cache file bodies (one read per path)
+function makeReader(repoRoot) {
     const body = new Map();
-    const read = (rel) => {
+    return (rel) => {
         if (body.has(rel))
             return body.get(rel);
         try {
@@ -98,6 +92,16 @@ export function collateralLints(tasks, repoRoot) {
             return null;
         }
     };
+}
+/**
+ * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
+ * Each line names the task id and at least one missing collateral test path.
+ */
+export function collateralLints(tasks, repoRoot) {
+    const testFiles = walkCode(repoRoot, "tests");
+    if (!testFiles.length)
+        return [];
+    const read = makeReader(repoRoot);
     const lines = [];
     for (const t of tasks) {
         // OBS-22: scopeGate accepts picomatch globs; advisory collateral warnings must agree.
@@ -128,3 +132,56 @@ export function collateralLints(tasks, repoRoot) {
     }
     return lines;
 }
+// v1.53 T4 (OBS-76): needles are code-shaped tokens only (camelCase / snake_case) — plain prose
+// words never match, so prose-only criteria yield zero needles instead of alarm-fatigue noise.
+// ponytail: token heuristic, not AST symbol resolution — promote after a version of precision data.
+function criteriaSymbols(acceptance) {
+    const out = new Set();
+    for (const item of acceptance) {
+        for (const tok of renderAcceptanceItem(item).match(/\b[A-Za-z_][A-Za-z0-9_]*\b/g) ?? []) {
+            if (tok.includes("_") || /[a-z][A-Z]/.test(tok))
+                out.add(tok);
+        }
+    }
+    return [...out].sort();
+}
+/**
+ * OBS-76 class: sweep src/ for out-of-scope source files that reference a symbol the acceptance
+ * criteria name — the v1.52 router.ts omission, named at plan time instead of one judge round in.
+ * Advisory plan output only, same contract as collateralLints.
+ */
+export function sourceScopeLints(tasks, repoRoot) {
+    const perTask = tasks
+        .map((t) => ({ t, needles: criteriaSymbols(t.acceptance) }))
+        .filter((x) => x.needles.length);
+    if (!perTask.length)
+        return [];
+    const srcFiles = walkCode(repoRoot, "src");
+    if (!srcFiles.length)
+        return [];
+    const read = makeReader(repoRoot);
+    const lines = [];
+    for (const { t, needles } of perTask) {
+        // OBS-22: scopeGate accepts picomatch globs; advisory warnings must agree.
+        const scoped = picomatch(t.files.map((f) => f.replace(/^\.\//, "")), { dot: true });
+        // needles are word-chars by construction — no regex escaping needed; whole-word match only
+        const res = needles.map((n) => new RegExp(`\\b${n}\\b`));
+        const hits = [];
+        for (const sf of srcFiles) {
+            if (scoped(sf))
+                continue;
+            const text = read(sf);
+            if (text === null)
+                continue;
+            if (res.some((re) => re.test(text)))
+                hits.push(sf);
+        }
+        if (!hits.length)
+            continue;
+        hits.sort();
+        const listed = hits.slice(0, MAX_HITS_PER_TASK).join(", ");
+        const tail = hits.length > MAX_HITS_PER_TASK ? " (capped)" : "";
+        lines.push(`${t.id}: criteria implicate out-of-scope source not in files[]: ${listed}${tail}`);
+    }
+    return lines;
+}

package/dist/config/config.d.ts

@@ -20,11 +20,7 @@ export declare const MapEntrySchema: z.ZodObject<{
         via: z.ZodString;
         model: z.ZodString;
     }, z.core.$strip>>;
-    tier: z.ZodOptional<z.ZodEnum<{
-        cheap: "cheap";
-        mid: "mid";
-        frontier: "frontier";
-    }>>;
+    tier: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodNull>, z.ZodTransform<undefined, null | undefined>>>;
     prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
     escalate: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
@@ -78,11 +74,7 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
                 via: z.ZodString;
                 model: z.ZodString;
             }, z.core.$strip>>;
-            tier: z.ZodOptional<z.ZodEnum<{
-                cheap: "cheap";
-                mid: "mid";
-                frontier: "frontier";
-            }>>;
+            tier: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodNull>, z.ZodTransform<undefined, null | undefined>>>;
             prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
             escalate: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
@@ -176,6 +168,7 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
     review: z.ZodObject<{
         complexityThreshold: z.ZodNumber;
         required: z.ZodBoolean;
+        prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>;
     consult: z.ZodObject<{
         adapter: z.ZodString;
@@ -219,6 +212,7 @@ export type ModeResolution = {
  *  already applied to cfg.routing.floors — route() consumes floors only and never sees the mode. */
 export declare function loadConfigWithMode(repoRoot: string, opts?: {
     globalDir?: string;
+    repoOverlayText?: string;
 }): {
     cfg: TickmarkrConfig;
     mode: ModeResolution;
@@ -226,6 +220,12 @@ export declare function loadConfigWithMode(repoRoot: string, opts?: {
 export declare function loadConfig(repoRoot: string, opts?: {
     globalDir?: string;
 }): TickmarkrConfig;
+/** v1.52 T2 write-time reload guard: run candidate repo-overlay bytes through the SAME production
+ *  loader path every later command uses (parse → merge → schema → mode resolution). Returns null
+ *  when the bytes load, else the loader's failure message — the caller must refuse the write. */
+export declare function overlayBytesLoadError(repoRoot: string, bytes: string, opts?: {
+    globalDir?: string;
+}): string | null;
 export type InitConfigOverlay = {
     concurrency?: number;
     driver?: TickmarkrConfig["driver"];

package/dist/config/config.js

@@ -20,9 +20,21 @@ const ModeEnum = z.enum(ROUTING_MODES, {
 // Integrity set (weak-oracle shapes, OBS-68..70 class): no mode may resolve these below frontier.
 // Only an explicit operator floor line can — and it draws a standing plan lint every load.
 export const INTEGRITY_FLOOR_SHAPES = ["plan", "spec", "migration", "ui"];
+// v1.52 T5: tier is no longer a map-entry band authority — routing.floors is the only tier
+// source left (v1.51 T3 deprecated this field with a promise to remove it here). Only the legacy
+// `tier: null` tombstone still parses (and normalizes to absent); any real value fails config
+// load fail-closed, naming routing.floors as the move target, so a band intent set here can never
+// silently vanish. The field stays in the schema/type as an always-undefined marker (not deleted
+// outright) so a map entry can never carry a real tier value again, structurally.
 export const MapEntrySchema = z.object({
     pin: z.object({ via: z.string(), model: z.string() }).optional(),
-    tier: TierEnum.optional(),
+    tier: z
+        .null({
+        error: (iss) => `routing.map entry tier ${JSON.stringify(iss.input)} is no longer a band authority — move this value to routing.floors.<shape> (only "tier: null" tombstones still parse)`,
+    })
+        .optional()
+        .transform(() => undefined)
+        .optional(),
     prefer: z.array(z.string()).optional(),
     escalate: z.boolean().optional(),
 });
@@ -140,7 +152,9 @@ export const TickmarkrConfigSchema = z.object({
         allowDeviations: z.array(z.string()),
     }).partial().optional(),
     judge: z.object({ adapter: z.string(), model: z.string() }),
-    review: z.object({ complexityThreshold: z.number(), required: z.boolean() }),
+    // v1.53 T2: prefer — ordered reviewer preference (entry grammar: adapter | adapter:model, same as
+    // routing.map.prefer). Reorders diversity-eligible channels only; never widens or narrows eligibility.
+    review: z.object({ complexityThreshold: z.number(), required: z.boolean(), prefer: z.array(z.string()).optional() }),
     consult: z.object({ adapter: z.string(), model: z.string(), stallMinutes: z.number().positive() }),
     visibility: z.object({
         llm: z.enum(["pane", "headless"]),
@@ -167,11 +181,10 @@ export const DEFAULT_CONFIG = {
     taskTimeoutMinutes: 30,
     contextWarnTokens: 170_000, // v1.23 T2: overseer ctx-watch.sh proven threshold
     routing: {
-        // v1.51 T3 (round-2 consult): map entries carry preferences/pins only — band policy lives in
-        // routing.floors, the single tier authority. The dropped tiers (implement mid, tests cheap,
-        // docs cheap) were byte-equal to the floors below, so routing is unchanged. Overlay map tiers
-        // still parse but draw a move-to-floors lint in plan/doctor; MapEntrySchema.tier removal itself
-        // is deferred to the next version (tombstone grammar: tier: null).
+        // v1.51 T3 (round-2 consult) / v1.52 T5: map entries carry preferences/pins only — band
+        // policy lives in routing.floors, the single tier authority. A map entry can no longer carry
+        // a real tier value at all: MapEntrySchema fails config load fail-closed on one, naming
+        // routing.floors as the move target; only the legacy `tier: null` tombstone still parses.
         map: {
             plan: { pin: { via: "claude-code", model: "fable" } },
             spec: { pin: { via: "claude-code", model: "fable" } },
@@ -294,7 +307,9 @@ function deepMerge(base, over) {
             delete out[k]; // v1.1 tombstone: an explicit null in an overlay removes the key (e.g. stale tiers model ids)
             continue;
         }
-        out[k] = k in out ? deepMerge(out[k], v) : v;
+        // OBS-75 class: merge fresh-landing objects onto {} so nested tombstone nulls are pruned even when
+        // no lower layer set the key (a fleet-cleared deny writes {adapters: null} — the schema rejects raw null)
+        out[k] = k in out ? deepMerge(out[k], v) : deepMerge({}, v);
     }
     return out;
 }
@@ -393,7 +408,11 @@ function resolveRoutingMode(cfg, layers) {
  *  already applied to cfg.routing.floors — route() consumes floors only and never sees the mode. */
 export function loadConfigWithMode(repoRoot, opts = {}) {
     const globalCfg = readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml"));
-    const repoCfg = readYaml(join(repoRoot, stateDirName(repoRoot), "config.yaml"));
+    // v1.52 T2: repoOverlayText substitutes candidate bytes for the on-disk repo layer — the fleet
+    // write guard validates EXACTLY what it is about to write through this one loader path.
+    const repoCfg = opts.repoOverlayText === undefined
+        ? readYaml(join(repoRoot, stateDirName(repoRoot), "config.yaml"))
+        : parse(opts.repoOverlayText);
     const merged = deepMerge(deepMerge(structuredClone(DEFAULT_CONFIG), globalCfg), repoCfg);
     const r = TickmarkrConfigSchema.safeParse(merged);
     if (!r.success)
@@ -403,6 +422,18 @@ export function loadConfigWithMode(repoRoot, opts = {}) {
 export function loadConfig(repoRoot, opts = {}) {
     return loadConfigWithMode(repoRoot, opts).cfg;
 }
+/** v1.52 T2 write-time reload guard: run candidate repo-overlay bytes through the SAME production
+ *  loader path every later command uses (parse → merge → schema → mode resolution). Returns null
+ *  when the bytes load, else the loader's failure message — the caller must refuse the write. */
+export function overlayBytesLoadError(repoRoot, bytes, opts = {}) {
+    try {
+        loadConfigWithMode(repoRoot, { ...opts, repoOverlayText: bytes });
+        return null;
+    }
+    catch (e) {
+        return e.message;
+    }
+}
 export function configTemplate(overlay) {
     const base = `# tickmarkr config overlay — merges over built-in defaults (repo beats global beats defaults)
 # concurrency: 3
@@ -418,7 +449,7 @@ export function configTemplate(overlay) {
 #   map:                  # per-shape preferences/pins; band policy lives in routing.floors
 #     implement: { prefer: [cursor-agent, codex] }
 #     migration: { pin: { via: claude-code, model: fable } }
-#     tests: { tier: null }   # tombstone: null removes a legacy map tier (deprecated — move the band to routing.floors.tests; schema removal lands next version)
+#     tests: { tier: null }   # tombstone: null removes a legacy map tier (a real tier value now fails config load — move the band to routing.floors.tests)
 #   floors:               # tier authority — advisory minimum bands; 'tickmarkr plan' lints violations
 #     migration: frontier
 #   learned: on            # default ON (ROUTE-14); cold profile = exact v1.5 static routing, warms per workspace. Set 'off' to pin static routing; preview with 'tickmarkr plan'
@@ -445,7 +476,9 @@ export function configTemplate(overlay) {
 #   test: npm test
 #   byShape:
 #     docs: { acceptance: false, review: false }  # baseline, evidence, and scope are mandatory
-# review: { complexityThreshold: 7, required: true }
+# review: { complexityThreshold: 7, required: true, prefer: [codex:gpt-5.6-sol, kimi] }
+#                         # prefer: ordered reviewer seat preference (adapter | adapter:model); ranks
+#                         # diversity-eligible channels only — never admits a same-vendor/same-model reviewer
 # consult: { adapter: claude-code, model: fable, stallMinutes: 15 }
 # cost:                   # v1.20 REC-02 — OPTIONAL price table for the usage/cost report. Absent ⇒ every
 #                         # channel reports "not measurable" (never a crash or a fake $0). Two economics,
@@ -656,7 +689,9 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}) {
             }
         }
         if (Object.keys(modelDelta).length) {
-            tiersOut[adapter] = { models: { ...tiersOut[adapter]?.models, ...modelDelta } };
+            // spread the existing entry so vendor/channel/windows survive the rewrite — dropping them
+            // makes the overlay unloadable for any adapter without a default seed (reload-guard class)
+            tiersOut[adapter] = { ...tiersOut[adapter], models: { ...tiersOut[adapter]?.models, ...modelDelta } };
             tiersTouched = true;
         }
     }
@@ -682,47 +717,58 @@ export function serializeFleetOverlay(overlay, provenance = {}) {
         return "";
     const lines = [];
     const today = new Date().toISOString().slice(0, 10);
+    // OBS-75: never glue stringify() output onto a key line — wrap the key into the object and
+    // re-indent the whole emitted block, so sequences/nested maps nest correctly and null
+    // tombstones/empty collections survive the serialize→parse round-trip.
+    const block = (obj, pad) => stringify(obj).trimEnd().split("\n").map((l) => `${pad}${l}`);
     const routing = overlay.routing;
     if (routing) {
         lines.push("routing:");
         const deny = routing.deny;
-        if (deny) {
+        if (deny && (deny.adapters !== undefined || deny.models !== undefined)) {
             lines.push("  deny:");
-            if (deny.adapters)
-                lines.push(`    adapters: ${stringify(deny.adapters).trim()}`);
-            if (deny.models)
-                lines.push(`    models: ${stringify(deny.models).trim()}`);
-        }
-        if (routing.map) {
-            lines.push("  map:");
-            for (const [shape, entry] of Object.entries(routing.map)) {
-                lines.push(`    ${shape}:`);
-                const body = stringify(entry, { indent: 2 }).trim().split("\n");
-                lines.push(...body.map((l) => `      ${l}`));
-            }
+            if (deny.adapters !== undefined)
+                lines.push(...block({ adapters: deny.adapters }, "    "));
+            if (deny.models !== undefined)
+                lines.push(...block({ models: deny.models }, "    "));
         }
+        if (routing.map)
+            lines.push(...block({ map: routing.map }, "  "));
         if (routing.floors)
-            lines.push(`  floors: ${stringify(routing.floors).trim().replace(/^/gm, "  ")}`);
+            lines.push(...block({ floors: routing.floors }, "  "));
     }
     const tiers = overlay.tiers;
-    if (tiers) {
+    if (tiers && Object.keys(tiers).length) {
         lines.push("tiers:");
         for (const [adapter, entry] of Object.entries(tiers)) {
-            lines.push(`  ${adapter}:`);
+            const body = [];
             if (entry.vendor)
-                lines.push(`    vendor: ${entry.vendor}`);
+                body.push(`    vendor: ${entry.vendor}`);
             if (entry.channel)
-                lines.push(`    channel: ${entry.channel}`);
-            lines.push("    models:");
-            for (const [model, tier] of Object.entries(entry.models ?? {})) {
-                if (tier === null)
-                    lines.push(`      ${model}: null`);
-                else {
-                    const note = provenance[adapter]?.[model];
-                    const suffix = note ? `  # ${note} — fleet ${today}` : "";
-                    lines.push(`      ${model}: ${tier}${suffix}`);
+                body.push(`    channel: ${entry.channel}`);
+            if (entry.windows)
+                body.push(...block({ windows: entry.windows }, "    "));
+            const models = Object.entries(entry.models ?? {});
+            if (models.length) {
+                body.push("    models:");
+                for (const [model, tier] of models) {
+                    if (tier === null)
+                        body.push(`      ${model}: null`);
+                    else {
+                        const note = provenance[adapter]?.[model];
+                        const suffix = note ? `  # ${note} — fleet ${today}` : "";
+                        body.push(`      ${model}: ${tier}${suffix}`);
+                    }
                 }
             }
+            else if (entry.models) {
+                body.push("    models: {}"); // present-but-empty: explicit {} — a childless header parses as null and the loader rejects it
+            }
+            // a bare `adapter:` line parses as a null tombstone and would DELETE the adapter's default seeds on merge
+            if (body.length)
+                lines.push(`  ${adapter}:`, ...body);
+            else
+                lines.push(`  ${adapter}: {}`);
         }
     }
     return `${lines.join("\n")}\n`;

package/dist/gates/review.d.ts

@@ -15,5 +15,6 @@ export declare function checkDiffCap(gate: string, measured: number, cap: number
 export declare function isDiffCapPark(result: GateResult): boolean;
 export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
-export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[]): BillingChannel | null;
+export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
+prefer?: string[]): BillingChannel | null;
 export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[]): Promise<GateResult>;

package/dist/gates/review.js

@@ -39,7 +39,15 @@ export function diffCapParkReason(results) {
 export function modelId(model) {
     return model.slice(model.lastIndexOf("/") + 1);
 }
-export function pickReviewer(author, channels, exclude = []) {
+// v1.53 T2: same entry grammar as routing.map.prefer (router.ts preferIndex — router is out of this
+// module's dependency direction for a private fn, so the 3 lines live here too): `adapter` matches
+// every channel of that adapter, `adapter:model` exactly one; unmatched channels sort after all entries.
+function reviewPreferIndex(c, prefer) {
+    const i = prefer.findIndex((p) => p === c.adapter || p === channelKey(c));
+    return i === -1 ? prefer.length : i;
+}
+export function pickReviewer(author, channels, exclude = [], // v1.1 failover: reviewer channels that already produced garbage for this task
+prefer = []) {
     // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
     // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
     // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
@@ -49,15 +57,16 @@ export function pickReviewer(author, channels, exclude = []) {
         return null;
     return (channels
         // two independent axes: different vendor AND different base-model identity (ADDED TO the vendor
-        // rule, never replacing it — a future edit can't silently drop either).
+        // rule, never replacing it — a future edit can't silently drop either). The diversity filter runs
+        // BEFORE preference ranking: prefer sorts survivors only, so no entry can resurrect an excluded channel.
         .filter((c) => c.vendor !== authorChannel.vendor && modelId(c.model) !== modelId(author.model) && !exclude.includes(channelKey(c)))
-        .sort((a, b) => TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
+        .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
 }
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers) {
     if (task.complexity < cfg.review.complexityThreshold) {
         return { gate: "review", pass: true, details: `skipped — complexity ${task.complexity} < threshold ${cfg.review.complexityThreshold}`, meta: { skipped: true } };
     }
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? []);
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? []);
     if (!reviewer) {
         return cfg.review.required
             ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive" }

package/dist/route/router.d.ts

@@ -32,6 +32,7 @@ export interface ExploreContext {
 }
 export declare const NO_EXPLORE_ENV = "TICKMARKR_NO_EXPLORE";
 export declare const QUALITY_ENV = "TICKMARKR_QUALITY";
+export declare const ROUTING_ENV_SEAMS: readonly ["TICKMARKR_QUALITY", "TICKMARKR_NO_EXPLORE"];
 export declare const raiseTier: (tier: Tier) => Tier;
 export declare class RoutingError extends Error {
     constructor(msg: string);

package/dist/route/router.js

@@ -4,6 +4,9 @@ import { disallowedBy } from "./preference.js";
 import { cellOf, EXPLORE_CAP, explorationBonus, learnedScore, MIN_SAMPLES } from "./profile.js";
 export const NO_EXPLORE_ENV = "TICKMARKR_NO_EXPLORE";
 export const QUALITY_ENV = "TICKMARKR_QUALITY";
+// OBS-74: every routing env seam, in one list — the spawn seam (src/run/git.ts) scrubs exactly
+// these from child env so gate/baseline/tip-verify children are hermetic by construction.
+export const ROUTING_ENV_SEAMS = [QUALITY_ENV, NO_EXPLORE_ENV];
 const exploreCap = (cfg) => cfg.routing.explore?.cap ?? EXPLORE_CAP;
 const qualityOn = (exploreCtx) => !!exploreCtx?.quality || process.env[QUALITY_ENV] === "1";
 export const raiseTier = (tier) => tier === "cheap" ? "mid" : tier === "mid" ? "frontier" : "frontier";
@@ -160,15 +163,13 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
         maybeSlaLint(lints, task, profile, slaMinutes, c);
         return { assignment: toAssignment(c), ladder: ladderFor(task, entry), lints, provenance: `${degraded}pin ${entry.pin.via}:${entry.pin.model} (config routing.map)` };
     }
-    const baseTier = entry?.tier ?? floor ?? "cheap";
+    const baseTier = floor ?? "cheap";
     let minTier = taskFloor && TIER_RANK[taskFloor] > TIER_RANK[baseTier] ? taskFloor : baseTier; // task floor is a hard >= constraint in all paths (D-04)
     if (quality && advisoryFloor) {
         const raised = raiseTier(advisoryFloor);
         if (TIER_RANK[raised] > TIER_RANK[minTier])
             minTier = raised;
     }
-    if (entry?.tier)
-        lintFloor(entry.tier, "map tier");
     if (prefActive)
         for (const p of prefer ?? [])
             preflightPrefer(p);
@@ -253,9 +254,8 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
     }
     const bound = qualityBound(quality, advisoryFloor, taskFloorRaw) ??
         (taskFloor && TIER_RANK[taskFloor] >= TIER_RANK[baseTier] ? `floor ${taskFloor} (task hint${src})` :
-            entry?.tier ? `tier ${entry.tier} (config routing.map)` :
-                floor ? `floor ${floor} (config floors)` :
-                    "tier cheap (default)");
+            floor ? `floor ${floor} (config floors)` :
+                "tier cheap (default)");
     // name the key that actually broke the tie: prefer outranks the marginal-cost/tier keys, so if the
     // winner matched a prefer entry, prefer decided it — not "cheapest sufficient tier" (ROUTE-03, WR-01)
     const preferVia = preferFromAuto(task.shape, preferCtx)

package/dist/run/daemon.d.ts

@@ -5,6 +5,7 @@ import { type JournalEvent } from "./journal.js";
 export interface RunOptions {
     runId?: string;
     resume?: boolean;
+    supersedes?: string;
     graphChanged?: boolean;
     concurrency?: number;
     driver?: ExecutorDriver;

package/dist/run/daemon.js

@@ -98,6 +98,10 @@ export async function runDaemon(repoRoot, opts = {}) {
     // HARD-01/02: hold the run lock across the whole read-modify-write of graph.json. Acquire
     // BEFORE loadGraph; release in the finally below (every exit path, incl. throws).
     const runId = opts.runId ?? newRunId();
+    // v1.53 T5: an unknown --supersedes id must fail BEFORE any run starts — Journal.open throws and
+    // no lock, journal, or baseline for the new run has been created yet. Opened without a narrate
+    // sink: the prior journal append below is silent bookkeeping, not this run's narration.
+    const prior = opts.supersedes !== undefined ? Journal.open(repoRoot, opts.supersedes) : undefined;
     // T6 narrator: one live status surface per run (herdr only — driver.narrator is undefined on
     // subprocess, so the optional-chain open below is a no-op there). Cosmetic-only: any failure is
     // swallowed (never affects the run); the operator closes a surviving watch pane.
@@ -140,6 +144,11 @@ export async function runDaemon(repoRoot, opts = {}) {
         // equivalence to the router.ts:194 profile⇒undefined pattern: no map entry ⇒ today's literal.
         const resume = opts.resume ? journal.replayResumeState() : new Map();
         if (opts.resume) {
+            // v1.53 T5: a superseded run is dead — resuming it beside its successor is the exact
+            // two-concurrent-runs hazard supersession exists to prevent. Fail closed, naming the successor.
+            const superseded = [...journal.read()].reverse().find((e) => e.event === "superseded" && typeof e.data.by === "string");
+            if (superseded)
+                throw new Error(`refusing to resume ${runId}: superseded by ${superseded.data.by}`);
             const start = journal.read().find((e) => e.event === "run-start");
             if (!start)
                 throw new Error(`journal for ${runId} has no run-start event`);
@@ -175,7 +184,10 @@ export async function runDaemon(repoRoot, opts = {}) {
             baseRef = await gitHead(repoRoot);
             baseline = await captureBaseline(repoRoot, commands);
             writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(baseline, null, 2));
-            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphDefinitionHash: graphDefinitionHash(graph), mode: rm.mode.mode, modeSource: rm.source }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness; mode/modeSource: v1.51 T2
+            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphDefinitionHash: graphDefinitionHash(graph), mode: rm.mode.mode, modeSource: rm.source, ...(prior ? { supersedes: prior.runId } : {}) }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness; mode/modeSource: v1.51 T2; supersedes: v1.53 T5
+            // v1.53 T5: mark the prior run AFTER this run's run-start exists, so the prior journal never
+            // names a successor that has no journal. Append-only — the prior journal is never rewritten.
+            prior?.append("superseded", undefined, { by: runId });
         }
         // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
         // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
@@ -412,13 +424,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                 }
                 // v1.29: consume the prior gate-failed session once. Same channel + known under-threshold context
                 // + adapter capability resumes; every other path is today's fresh dispatch.
+                // v1.53 T3: an adapter with no context surface at all (kimi, KIMI-03) may declare
+                // resumeUnknownContext to loosen ONLY the contextTokens-known requirement — a KNOWN
+                // over-threshold context still forces fresh, and the escalation ladder bounds the chain.
                 const priorSession = retrySession;
                 retrySession = undefined;
+                const retryAdapter = adapters.find((a) => a.id === assignment.adapter);
                 retryMode = priorSession
                     && priorSession.channel === channelKey(assignment)
-                    && priorSession.contextTokens !== undefined
-                    && priorSession.contextTokens < cfg.contextWarnTokens
-                    && adapters.find((a) => a.id === assignment.adapter)?.resumeCommand
+                    && (priorSession.contextTokens !== undefined
+                        ? priorSession.contextTokens < cfg.contextWarnTokens
+                        : retryAdapter?.resumeUnknownContext === true)
+                    && retryAdapter?.resumeCommand
                     ? "resume"
                     : "fresh";
                 // v1.23 T3: over-threshold context still forces fresh at the retry boundary; never interrupt a
@@ -854,7 +871,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     break gateLoop;
                 }
                 gateFails++; // this attempt's gates failed — the one place quality degradation is verified (never inferred from attempts)
-                retrySession = { channel: channelKey(assignment), id: sessionId, contextTokens };
+                // v1.53 T3: prefer the CLI's own session id captured from this attempt's output (kimi's resume
+                // trailer) over the harness slot name; absent hook or no capture keeps today's slot-name id.
+                retrySession = { channel: channelKey(assignment), id: adapter.sessionIdFrom?.(output) ?? sessionId, contextTokens };
                 feedback = results.filter((g) => !g.pass).map((g) => `${g.gate}: ${g.details}`).join("\n\n");
                 const step = r.ladder[Math.min(ladderIdx++, r.ladder.length - 1)];
                 journal.append("escalation", t.id, { step, attempt: attempt + 1 });

package/dist/run/git.d.ts

@@ -1,3 +1,5 @@
+import { ROUTING_ENV_SEAMS } from "../route/router.js";
+export { ROUTING_ENV_SEAMS };
 export interface ShResult {
     code: number;
     stdout: string;

package/dist/run/git.js

@@ -3,14 +3,23 @@ import { existsSync, lstatSync, readlinkSync, rmSync, symlinkSync } from "node:f
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
+import { ROUTING_ENV_SEAMS } from "../route/router.js";
+export { ROUTING_ENV_SEAMS };
 // stdin "ignore": same class as HARD-05 / SubprocessDriver — never leave an open pipe a child can block on
 // (pi -p / codex exec wait for stdin EOF). timedOut distinguishes SIGKILL-timeout from a real nonzero exit.
 function shell(cmd, cwd, timeoutMs, login) {
+    // OBS-74: scrub tickmarkr's own routing env seams from every child — a daemon carrying
+    // TICKMARKR_QUALITY leaked it into baseline/gate/tip-verify children, turning a dogfood
+    // repo's route() tests red inside the gates. Scrub a copy at this one choke point so
+    // children are hermetic by construction; the daemon's own process.env stays unchanged.
+    const env = { ...process.env };
+    for (const k of ROUTING_ENV_SEAMS)
+        delete env[k];
     return new Promise((resolve) => {
         // detached: bash gets its own process group so a timeout can kill the whole tree —
         // SIGKILLing bash alone orphans grandchildren (codex/pi) that hold the stdio pipes
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
-        const p = spawn("bash", [login ? "-lc" : "-c", cmd], { cwd, stdio: ["ignore", "pipe", "pipe"], detached: true });
+        const p = spawn("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
         let stdout = "", stderr = "";
         let timedOut = false, done = false;
         const finish = (code, err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.51.0",
+  "version": "1.53.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",