tickmarkr 1.52.0 → 1.54.0

package/dist/adapters/kimi.d.ts

@@ -2,4 +2,5 @@ import { type WorkerAdapter, type WorkerResult } from "./types.js";
 export declare function kimiAuthed(credentialsText: string, nowMs: number): boolean;
 export declare function parseKimiModels(raw: string): string[];
 export declare function parseKimiResult(raw: string, nonce: string): WorkerResult;
+export declare function kimiSessionId(output: string): string | undefined;
 export declare const kimi: WorkerAdapter;

package/dist/adapters/kimi.js

@@ -46,6 +46,21 @@ export function parseKimiResult(raw, nonce) {
     const stripped = raw.split("\n").map((l) => l.replace(/^[\s]*[•*-]\s+/, "")).join("\n");
     return parseWorkerResult(stripped, nonce);
 }
+// v1.53 T3: session-id capture from the run-output trailer — every `kimi -p` run (fresh or resumed)
+// ends with `To resume this session: kimi -r session_<uuid>` (live probe 2026-07-18). Anchored full
+// line only: prompt/model prose can contain lookalike text, and the anchored charset keeps a
+// captured id shell-safe by construction (shq in resumeCommand is the second layer). Last valid
+// line wins — a run may echo stale resume lines mid-transcript.
+const RESUME_TRAILER_RE = /^\s*To resume this session: kimi -r (session_[0-9a-f-]+)\s*$/;
+export function kimiSessionId(output) {
+    let id;
+    for (const line of output.split("\n")) {
+        const m = RESUME_TRAILER_RE.exec(line);
+        if (m)
+            id = m[1];
+    }
+    return id;
+}
 export const kimi = {
     id: "kimi",
     vendor: "moonshot",
@@ -73,6 +88,15 @@ export const kimi = {
     // ("unknown command '…'", live-verified 2026-07-17, OBS-67) and -p is non-interactive-only.
     // null → the daemon's print fallback (types.ts:101) keeps kimi workers visible without a TUI.
     interactiveCommand: () => null,
+    // v1.53 T3 resume — live-probed 2026-07-18: `-p` + `-S <id>` compose cleanly (no OBS-67-class
+    // flag rejection) and the resumed session carries prior conversation state. `-S <id>` is the
+    // deterministic form; `-c` rejected as primary — cwd-keyed, nondeterministic under worktree
+    // recreation (probe finding 4). Never bare `-S` (it launches the interactive session picker).
+    resumeCommand: (sessionId, promptFile, model) => `kimi -S ${shq(sessionId)} -p "$(cat ${shq(promptFile)})" --model ${shq(model)} --output-format text`,
+    sessionIdFrom: kimiSessionId,
+    // KIMI-03: no contextUsage surface exists, so a known-context requirement would leave resume
+    // dead code — declare the unknown-context opt-in the daemon retry seam enforces.
+    resumeUnknownContext: true,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },

package/dist/adapters/model-lints.d.ts

@@ -17,6 +17,7 @@ export type RoutedAssignment = {
 /** Advisory only — absent windows config or undeclared model window ⇒ no lint. */
 export declare function contextWindowLints(tasks: ReadonlyArray<Task>, assignments: ReadonlyArray<RoutedAssignment>, cfg: TickmarkrConfig, repoRoot: string): string[];
 export declare function seedPreferLints(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], overlayPreferShapes?: ReadonlySet<string>): string[];
+export declare function preferEntryLints(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, mapShapes?: ReadonlySet<string>): string[];
 export declare function modelLints(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], opts?: {
     tty?: boolean;
     stateDir?: string;

package/dist/adapters/model-lints.js

@@ -95,6 +95,33 @@ export function seedPreferLints(cfg, health, adapters, overlayPreferShapes = new
     }
     return lints;
 }
+// v1.54 T3: dead-steering sweep — operator prefer entries (routing.map overlay shapes, review.prefer,
+// consult.prefer) that can never match an installed channel are named at plan time; v1.53 T2 pins the
+// no-match case as a silent no-op, which makes a typo invisible. Advisory only: reads config + doctor
+// health (no live probes), never touches routing. Seed map prefers stay seedPreferLints' turf (auto-prefer
+// routes around dead seeds) — mapShapes limits this sweep to operator-authored entries so a bare default
+// fleet isn't double-linted. Entry grammar mirrors preferIndex: adapter | adapter:model (first colon).
+export function preferEntryLints(cfg, health, mapShapes = new Set()) {
+    const lints = [];
+    const sweep = (surface, entries) => {
+        for (const entry of entries ?? []) {
+            const i = entry.indexOf(":");
+            const adapter = i < 0 ? entry : entry.slice(0, i);
+            const model = i < 0 ? undefined : entry.slice(i + 1);
+            if (!health[adapter]?.installed) {
+                lints.push(`${surface} '${entry}' names uninstalled adapter '${adapter}' — dead steering (entry can never match)`);
+            }
+            else if (model !== undefined && !(model in (cfg.tiers[adapter]?.models ?? {}))) {
+                lints.push(`${surface} '${entry}' names model '${model}' absent from ${adapter}'s configured channels — dead steering (entry can never match)`);
+            }
+        }
+    };
+    for (const shape of mapShapes)
+        sweep(`routing.map.${shape}.prefer`, cfg.routing.map[shape]?.prefer);
+    sweep("review.prefer", cfg.review.prefer);
+    sweep("consult.prefer", cfg.consult.prefer);
+    return lints;
+}
 // Diffs detected models (doctor.json) against configured tiers, both directions, per adapter id in cfg.tiers.
 // No `  ! ` prefix here — the consumer (doctor rows / plan lints) owns that. Pre-v1.5 doctor.json (models:[], no
 // modelsDetectedAt) is the compat baseline: `?.`/`?? []` everywhere, no zod (would reject old files).

package/dist/adapters/types.d.ts

@@ -79,6 +79,8 @@ export interface WorkerAdapter {
     headlessCommand(promptFile: string, model: string): string;
     interactiveCommand(promptFile: string, model: string): string | null;
     resumeCommand?(sessionId: string, promptFile: string, model: string): string;
+    sessionIdFrom?(output: string): string | undefined;
+    resumeUnknownContext?: boolean;
     invoke(task: Task, cwd: string, a: Assignment, ctx: {
         promptFile: string;
     }): Invocation;

package/dist/cli/commands/fleet.js

@@ -140,6 +140,9 @@ function openTerm(input, output) {
             finally {
                 rl.close();
                 setRaw(true);
+                // rl.close() pauses the input stream — without a resume the next key() await has
+                // nothing keeping the event loop alive and the process silently exits 0 (OBS-77)
+                input.resume();
                 queue.splice(typedFrom);
                 prevLines = 0;
             }
@@ -191,9 +194,9 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
     const health = cached;
     const term = openTerm(input, output);
     try {
-        // step 1/5 — probe data
+        // step 1/6 — probe data
         const ageLine = formatAge(doctorAgeMs(cwd));
-        term.frame(listFrame("step 1/5 · probe data", "enter continue · r refresh via doctor · esc/q quit", [`probe data: ${ageLine} (.tickmarkr/doctor.json)`], 0));
+        term.frame(listFrame("step 1/6 · probe data", "enter continue · r refresh via doctor · esc/q quit", [`probe data: ${ageLine} (.tickmarkr/doctor.json)`], 0));
         for (;;) {
             const k = await term.key();
             if (isAbort(k))
@@ -204,7 +207,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             if (isNext(k))
                 break;
         }
-        // step 2/5 — agent CLIs (space toggles adapter deny)
+        // step 2/6 — agent CLIs (space toggles adapter deny)
         const installed = adapters.filter((a) => health[a.id]?.installed);
         const adapterRows = () => installed.map((a) => {
             const h = health[a.id];
@@ -213,7 +216,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         });
         const listLegend = "↑↓/jk move · space toggle · enter next · esc/q quit";
         let aCursor = 0;
-        term.frame(listFrame("step 2/5 · agent CLIs", listLegend, adapterRows(), aCursor));
+        term.frame(listFrame("step 2/6 · agent CLIs", listLegend, adapterRows(), aCursor));
         for (;;) {
             const k = await term.key();
             if (isAbort(k))
@@ -237,9 +240,9 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 changed = true;
             }
             if (changed)
-                term.frame(listFrame("step 2/5 · agent CLIs", listLegend, adapterRows(), aCursor));
+                term.frame(listFrame("step 2/6 · agent CLIs", listLegend, adapterRows(), aCursor));
         }
-        // step 3/5 — models per enabled adapter (space toggles deny, t assigns tier from the row)
+        // step 3/6 — models per enabled adapter (space toggles deny, t assigns tier from the row)
         const enabledAdapters = installed.filter((a) => !isDeniedAdapter(a.id, editable));
         for (const a of enabledAdapters) {
             const unclassifiedAll = fleetUnclassifiedModels(cfg, health, adapters).filter((u) => u.adapter === a.id);
@@ -257,7 +260,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 const denied = isDeniedModel(a.id, r.model, editable);
                 return `${denied ? toggleInactive() : toggleActive()} ${r.model}  ${tier?.tier ?? "???"}  ${denied ? "denied" : "allowed"}`;
             });
-            const title = `step 3/5 · models · ${a.id}`;
+            const title = `step 3/6 · models · ${a.id}`;
             const modelsLegend = "↑↓/jk move · space toggle · t tier · enter next · esc/q quit";
             let mCursor = 0;
             term.frame(listFrame(title, modelsLegend, renderRows(rowsData()), mCursor));
@@ -302,7 +305,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                     term.frame(listFrame(title, modelsLegend, renderRows(rowsData()), mCursor));
             }
         }
-        // step 4/5 — routing mode (selection is in-memory; the write happens only through the diff confirm).
+        // step 4/6 — routing mode (selection is in-memory; the write happens only through the diff confirm).
         // Candidate floor tables come from the ONE preset compiler via resolveRunMode — no mode math here.
         const modeCfgs = Object.fromEntries(ROUTING_MODES.map((m) => [m, m === rm.mode.mode ? rm : resolveRunMode(cwd, { flag: m, globalDir })]));
         const modeRows = () => ROUTING_MODES.map((m) => `${m === rm.mode.mode ? toggleActive() : " "} ${m.padEnd(11)}  ${MODE_GLOSS[m]}`);
@@ -318,7 +321,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 ...(changed.length ? changed.map((s) => `    ${s}: ${cur[s]} → ${next[s]}`) : ["    (no floor changes)"]),
             ];
         };
-        const modeTitle = "step 4/5 · routing mode";
+        const modeTitle = "step 4/6 · routing mode";
         const modeLegend = "↑↓/jk move · enter select · esc/q quit";
         let modeCursor = ROUTING_MODES.indexOf(rm.mode.mode);
         let selectedMode = rm.mode.mode;
@@ -338,7 +341,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 term.frame(modeFrame());
             }
         }
-        // step 5/5 — shape routing (typed entry for pin/tier/prefer from the highlighted row);
+        // step 5/6 — shape routing (typed entry for pin/tier/prefer from the highlighted row);
         // previews route under the SELECTED mode's resolved floors, never a floor edit of its own
         const channels = discoverChannels(cfg, adapters, health);
         const profile = loadRoutingProfile(cwd, cfg, { preview: true });
@@ -356,7 +359,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             const auto = autoPrefer?.[shape] && !overlayShapes.has(shape) ? "  (auto-prefer active)" : "";
             return `${shape}  →  ${now}${auto}`;
         });
-        const shapesTitle = "step 5/5 · shape routing";
+        const shapesTitle = "step 5/6 · shape routing";
         // v1.52 T5: no map-tier editing action — routing.floors is the only band authority now.
         const shapesLegend = "↑↓/jk move · a auto · p pin · f prefer · enter next · esc/q quit";
         let sCursor = 0;
@@ -397,6 +400,43 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             if (changed)
                 term.frame(listFrame(shapesTitle, shapesLegend, shapeRows(), sCursor));
         }
+        // step 6/6 — steering (v1.54 T4): review.prefer + consult.prefer via the same typed-entry
+        // pattern as the shape prefer action; edits are in-memory only and land on the merged overlay
+        // below, so they ride the ONE diff-confirm + reload-guard write path (never a second writer)
+        const STEER_KEYS = ["review", "consult"];
+        const initialSteering = {
+            review: cfg.review.prefer?.slice(),
+            consult: cfg.consult.prefer?.slice(),
+        };
+        const steering = structuredClone(initialSteering);
+        const steerRows = () => STEER_KEYS.map((k) => `${k}.prefer  →  ${steering[k]?.join(", ") ?? "(none)"}`);
+        const steerTitle = "step 6/6 · steering";
+        const steerLegend = "↑↓/jk move · f prefer · enter next · esc/q quit";
+        let stCursor = 0;
+        term.frame(listFrame(steerTitle, steerLegend, steerRows(), stCursor));
+        for (;;) {
+            const k = await term.key();
+            if (isAbort(k))
+                return QUIT;
+            if (isNext(k))
+                break;
+            let changed = false;
+            const moved = moveCursor(k, stCursor, STEER_KEYS.length);
+            if (moved !== stCursor) {
+                stCursor = moved;
+                changed = true;
+            }
+            else if (k.name === "f") {
+                const which = STEER_KEYS[stCursor];
+                const grammar = which === "consult" ? "adapter:model seats" : "adapters or adapter:model";
+                const raw = await term.askTyped(`${which}.prefer (comma-separated ${grammar}, empty clears)> `);
+                const list = raw.split(",").map((s) => s.trim()).filter(Boolean);
+                steering[which] = list.length ? list : undefined;
+                changed = true;
+            }
+            if (changed)
+                term.frame(listFrame(steerTitle, steerLegend, steerRows(), stCursor));
+        }
         // review — unified diff + typed confirm (the ONLY write path; the mode screen funnels through here)
         const before = currentRepoOverlayText(cwd);
         const existing = readOverlayFile(repoOverlayPath(cwd));
@@ -406,8 +446,25 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         const merged = fleetEditableEquals(initial, editable)
             ? structuredClone(existing)
             : fleetRepoOverlayFromDelta(initial, editable, existing);
+        // steering lands on the merged object and serializes via repoOverlayYaml's non-fleet
+        // passthrough; clearing removes the prefer key (and an emptied parent block) from the overlay
+        let steeringChanged = false;
+        for (const key of STEER_KEYS) {
+            if (JSON.stringify(steering[key]) === JSON.stringify(initialSteering[key]))
+                continue;
+            steeringChanged = true;
+            const block = { ...merged[key] };
+            if (steering[key])
+                block.prefer = steering[key];
+            else
+                delete block.prefer;
+            if (Object.keys(block).length)
+                merged[key] = block;
+            else
+                delete merged[key];
+        }
         const after = withModeLine(repoOverlayYaml(merged, provenanceMap(editable)), writeMode);
-        if ((!modeChanged && fleetEditableEquals(initial, editable)) || before === after) {
+        if ((!modeChanged && !steeringChanged && fleetEditableEquals(initial, editable)) || before === after) {
             return "fleet: no overlay changes (empty diff)";
         }
         const diff = unifiedYamlDiff(before, after, repoOverlayPath(cwd));

package/dist/cli/commands/plan.js

@@ -1,9 +1,9 @@
 import { allAdapters, discoverChannels, doctorAgeMs, modelAuthExclusions, probeAll, readDoctor, servableExclusions, servabilityLine } from "../../adapters/registry.js";
-import { formatModelAuthLine, contextWindowLints, modelLints, ttyVisual } from "../../adapters/model-lints.js";
+import { formatModelAuthLine, contextWindowLints, modelLints, preferEntryLints, ttyVisual } from "../../adapters/model-lints.js";
 import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
 import { parseArgs } from "node:util";
-import { collateralLints } from "../../compile/collateral.js";
-import { DEFAULT_CONFIG, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
+import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
+import { DEFAULT_CONFIG, overlayPreferShapes, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
 import { loadGraph } from "../../graph/graph.js";
 import { resolveRunMode } from "../../run/daemon.js";
 import { excludedChannels, exclusionLine } from "../../route/preference.js";
@@ -121,6 +121,8 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters())
             lints.push(`${role}: ${sel.adapter}:${sel.model} not installed — that gate/consult will fail closed`);
     }
     lints.push(...modelLints(cfg, health, adapters, { tty: ttyVisual() })); // health may be pre-v1.5/probeAll-fallback — no-detection branch covers both
+    // v1.54 T3: dead-steering sweep — advisory only, renders with the routing lints, never alters routing.
+    lints.push(...preferEntryLints(cfg, health, overlayPreferShapes(cwd)));
     if (cfg.review.required && channels.length && !fleetCanCrossVendorReview(channels)) {
         lints.push("review: no cross-vendor reviewer pair in fleet — set review.required: false to waive");
     }
@@ -170,8 +172,8 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters())
     const windowLints = contextWindowLints(g.tasks, routed, cfg, cwd);
     if (windowLints.length)
         lines.push("", "context window lints:", ...windowLints.map((l) => `  ! ${l}`));
-    // OBS-12/13/14/21: advisory only — never blocks --route-strict (run refuses on routing lints only)
-    const scopeLints = collateralLints(g.tasks, cwd);
+    // OBS-12/13/14/21 + OBS-76: advisory only — never blocks --route-strict (run refuses on routing lints only)
+    const scopeLints = [...collateralLints(g.tasks, cwd), ...sourceScopeLints(g.tasks, cwd)];
     if (scopeLints.length)
         lines.push("", "scope lints:", ...scopeLints.map((l) => `  ! ${l}`));
     return stylizePlan(lines.join("\n"));

package/dist/cli/commands/report.js

@@ -94,6 +94,14 @@ const wallClock = (start, end) => {
     return minutes ? `${minutes}m ${seconds % 60}s` : `${seconds}s`;
 };
 const detail = (value) => typeof value === "string" || typeof value === "number" ? String(value) : EM;
+// v1.53 T5: supersession is derived from the run's OWN journal only — `superseded by` from the
+// appended superseded event (last wins), `supersedes` from the run-start stamp. No cross-run scan.
+const supersession = (events) => {
+    const by = [...events].reverse().find((e) => e.event === "superseded" && typeof e.data.by === "string")?.data.by;
+    const start = events.find((e) => e.event === "run-start");
+    const supersedes = typeof start?.data.supersedes === "string" ? start.data.supersedes : undefined;
+    return { ...(typeof by === "string" ? { supersededBy: by } : {}), ...(supersedes ? { supersedes } : {}) };
+};
 const taskIds = (events) => {
     const seen = new Set();
     const out = [];
@@ -152,10 +160,13 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
     usageLines.push(...journalUsage(events, new Set(prices.map((row) => `${row.channel}:${row.adapter}:${row.model}`))));
     if (!usageLines.length)
         usageLines.push("- **not recorded:** attempts/windows: not measurable; tokens: not measurable; price: not measurable");
+    const sup = supersession(events);
     const lines = [
         `# tickmarkr engagement`,
         "",
         `- **runId:** ${runId}`,
+        ...(sup.supersededBy ? [`- **superseded by:** ${sup.supersededBy}`] : []),
+        ...(sup.supersedes ? [`- **supersedes:** ${sup.supersedes}`] : []),
         `- **base ref:** ${baseRef}`,
         `- **branch:** ${branch}`,
         `- **done:** ${count("done")}`,
@@ -269,8 +280,11 @@ function textReport(runId, events, rows, cwd) {
     const escalations = events.filter((e) => e.event === "escalation").length;
     const consults = events.filter((e) => e.event === "consult-verdict").length;
     const failovers = events.filter((e) => e.event === "quota-failover").length;
+    const sup = supersession(events);
     return [
         `tickmarkr engagement — ${runId}`,
+        ...(sup.supersededBy ? [`superseded by ${sup.supersededBy}`] : []),
+        ...(sup.supersedes ? [`supersedes ${sup.supersedes}`] : []),
         "",
         "engagement summary — audit trail:",
         ...[...groups.entries()].map(([k, g]) => `  ${k.padEnd(30)} tasks ${g.rows.length}, attempts ${g.rows.reduce((s, r) => s + r.attempts, 0)}, done ${g.rows.filter((r) => r.outcome === "done").length}`),

package/dist/cli/commands/run.js

@@ -39,6 +39,7 @@ export async function run(argv, cwd = process.cwd()) {
             "no-explore": { type: "boolean" },
             mode: { type: "string" },
             quality: { type: "boolean" },
+            supersedes: { type: "string" },
         },
     });
     if (values.concurrency !== undefined) {
@@ -83,6 +84,7 @@ export async function run(argv, cwd = process.cwd()) {
             concurrency: values.concurrency ? Number(values.concurrency) : undefined,
             driver: pickDriver(cfg, values.driver),
             mode: flagMode,
+            supersedes: values.supersedes,
             narrate: (event) => console.log(narrationLine(event)),
         });
         const out = `run ${s.runId} finished — ${formatSummary(s)} (merge to main is a human decision)`;

package/dist/cli/commands/status.js

@@ -120,9 +120,12 @@ const renderFrame = (cwd) => {
     let events = [];
     const contexts = new Map();
     let comparable = false;
+    let supersededBy; // v1.53 T5: this run is dead — a newer run replaced it
     if (runId) {
         const j = Journal.open(cwd, runId);
         events = j.read();
+        const sup = [...events].reverse().find((e) => e.event === "superseded" && typeof e.data.by === "string");
+        supersededBy = sup?.data.by;
         // T3 (Sol #2 / Fable F2): the SAME comparator resume uses (engagementComparable) — one decision,
         // two consumers. graphDefinitionHash (compiled task definitions only) survives status/evidence
         // mutation but changes when a task definition changes, so a recompiled graph is detected here too.
@@ -164,7 +167,7 @@ const renderFrame = (cwd) => {
             return `${prefix}${shortGoal(t.goal, Math.max(0, width - prefix.length - suffix.length))}${suffix}`;
         });
         const header = runId
-            ? `tickmarkr status${divider}run ${runId}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events).replaceAll(" · ", divider)}${divider}${done}/${g.tasks.length} done`
+            ? `tickmarkr status${divider}run ${runId}${supersededBy ? `${divider}superseded by ${supersededBy}` : ""}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events).replaceAll(" · ", divider)}${divider}${done}/${g.tasks.length} done`
             : `tickmarkr status${divider}no runs yet${divider}${done}/${g.tasks.length} done`;
         const legendLine = `  gates: ${GATE_NAMES.map((gate) => `${GATE_KEYS[gate]} ${gate}`).join(divider)}`;
         return [header, legendLine, ...rows].join("\n");
@@ -186,7 +189,7 @@ const renderFrame = (cwd) => {
     const tally = `${done}/${g.tasks.length} done`;
     const header = ` ${title(runId ? `run ${runId}` : "tickmarkr")}${dot}` +
         (runId
-            ? `${!comparable ? `${warn(NOT_COMPARABLE_NOTICE)}${dot}` : ""}${live}${dot}`
+            ? `${supersededBy ? `${warn(`superseded by ${supersededBy}`)}${dot}` : ""}${!comparable ? `${warn(NOT_COMPARABLE_NOTICE)}${dot}` : ""}${live}${dot}`
             : `no runs yet${dot}`) +
         `${gauge} ${done === g.tasks.length && g.tasks.length > 0 ? ok(tally) : tally}`;
     const hr = rule(Math.min(width, 100));

package/dist/compile/collateral.d.ts

@@ -1,6 +1,12 @@
-import type { Task } from "../graph/schema.js";
+import { type Task } from "../graph/schema.js";
 /**
  * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
  * Each line names the task id and at least one missing collateral test path.
  */
 export declare function collateralLints(tasks: ReadonlyArray<Pick<Task, "id" | "files">>, repoRoot: string): string[];
+/**
+ * OBS-76 class: sweep src/ for out-of-scope source files that reference a symbol the acceptance
+ * criteria name — the v1.52 router.ts omission, named at plan time instead of one judge round in.
+ * Advisory plan output only, same contract as collateralLints.
+ */
+export declare function sourceScopeLints(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>, repoRoot: string): string[];

package/dist/compile/collateral.js

@@ -1,10 +1,11 @@
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { extname, join, relative } from "node:path";
 import picomatch from "picomatch";
-// Advisory plan-time scan only (OBS-12/13/14/21). NEVER expands files[], fails compile, or
-// feeds the scope gate — a warning the author acts on. Plain-text (no AST), capped + sorted.
-/** Max test files walked under tests/ (sorted walk; rest ignored). */
-const MAX_TEST_FILES = 400;
+import { renderAcceptanceItem } from "../graph/schema.js";
+// Advisory plan-time scan only (OBS-12/13/14/21, OBS-76). NEVER expands files[], fails compile,
+// or feeds the scope gate — a warning the author acts on. Plain-text (no AST), capped + sorted.
+/** Max files walked per root (sorted walk; rest ignored). */
+const MAX_WALK_FILES = 400;
 /** Max collateral test paths listed per task. */
 const MAX_HITS_PER_TASK = 20;
 /** Skip giant fixtures / snapshots. */
@@ -22,23 +23,23 @@ function needlesFor(srcPath) {
     // repo-relative import forms that appear in tests (ESM often uses .js)
     return [...new Set([noExt, `${noExt}.js`, `${noExt}.ts`, n])].filter((s) => s.length > 0);
 }
-function walkTests(repoRoot) {
-    const root = join(repoRoot, "tests");
+function walkCode(repoRoot, subdir) {
+    const root = join(repoRoot, subdir);
     const out = [];
     const walk = (dir) => {
-        if (out.length >= MAX_TEST_FILES)
+        if (out.length >= MAX_WALK_FILES)
             return;
         let entries;
         try {
             entries = readdirSync(dir, { withFileTypes: true });
         }
         catch {
-            return; // no tests/ or unreadable — zero lints
+            return; // no such root or unreadable — zero lints
         }
         // deterministic order
         entries.sort((a, b) => a.name.localeCompare(b.name));
         for (const e of entries) {
-            if (out.length >= MAX_TEST_FILES)
+            if (out.length >= MAX_WALK_FILES)
                 return;
             if (e.name === "node_modules" || e.name === ".git" || e.name.startsWith("."))
                 continue;
@@ -70,17 +71,10 @@ function mentions(content, needles) {
     }
     return false;
 }
-/**
- * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
- * Each line names the task id and at least one missing collateral test path.
- */
-export function collateralLints(tasks, repoRoot) {
-    const testFiles = walkTests(repoRoot);
-    if (!testFiles.length)
-        return [];
-    // cache file bodies (one read per test path)
+// cache file bodies (one read per path)
+function makeReader(repoRoot) {
     const body = new Map();
-    const read = (rel) => {
+    return (rel) => {
         if (body.has(rel))
             return body.get(rel);
         try {
@@ -98,6 +92,16 @@ export function collateralLints(tasks, repoRoot) {
             return null;
         }
     };
+}
+/**
+ * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
+ * Each line names the task id and at least one missing collateral test path.
+ */
+export function collateralLints(tasks, repoRoot) {
+    const testFiles = walkCode(repoRoot, "tests");
+    if (!testFiles.length)
+        return [];
+    const read = makeReader(repoRoot);
     const lines = [];
     for (const t of tasks) {
         // OBS-22: scopeGate accepts picomatch globs; advisory collateral warnings must agree.
@@ -128,3 +132,56 @@ export function collateralLints(tasks, repoRoot) {
     }
     return lines;
 }
+// v1.53 T4 (OBS-76): needles are code-shaped tokens only (camelCase / snake_case) — plain prose
+// words never match, so prose-only criteria yield zero needles instead of alarm-fatigue noise.
+// ponytail: token heuristic, not AST symbol resolution — promote after a version of precision data.
+function criteriaSymbols(acceptance) {
+    const out = new Set();
+    for (const item of acceptance) {
+        for (const tok of renderAcceptanceItem(item).match(/\b[A-Za-z_][A-Za-z0-9_]*\b/g) ?? []) {
+            if (tok.includes("_") || /[a-z][A-Z]/.test(tok))
+                out.add(tok);
+        }
+    }
+    return [...out].sort();
+}
+/**
+ * OBS-76 class: sweep src/ for out-of-scope source files that reference a symbol the acceptance
+ * criteria name — the v1.52 router.ts omission, named at plan time instead of one judge round in.
+ * Advisory plan output only, same contract as collateralLints.
+ */
+export function sourceScopeLints(tasks, repoRoot) {
+    const perTask = tasks
+        .map((t) => ({ t, needles: criteriaSymbols(t.acceptance) }))
+        .filter((x) => x.needles.length);
+    if (!perTask.length)
+        return [];
+    const srcFiles = walkCode(repoRoot, "src");
+    if (!srcFiles.length)
+        return [];
+    const read = makeReader(repoRoot);
+    const lines = [];
+    for (const { t, needles } of perTask) {
+        // OBS-22: scopeGate accepts picomatch globs; advisory warnings must agree.
+        const scoped = picomatch(t.files.map((f) => f.replace(/^\.\//, "")), { dot: true });
+        // needles are word-chars by construction — no regex escaping needed; whole-word match only
+        const res = needles.map((n) => new RegExp(`\\b${n}\\b`));
+        const hits = [];
+        for (const sf of srcFiles) {
+            if (scoped(sf))
+                continue;
+            const text = read(sf);
+            if (text === null)
+                continue;
+            if (res.some((re) => re.test(text)))
+                hits.push(sf);
+        }
+        if (!hits.length)
+            continue;
+        hits.sort();
+        const listed = hits.slice(0, MAX_HITS_PER_TASK).join(", ");
+        const tail = hits.length > MAX_HITS_PER_TASK ? " (capped)" : "";
+        lines.push(`${t.id}: criteria implicate out-of-scope source not in files[]: ${listed}${tail}`);
+    }
+    return lines;
+}

package/dist/config/config.d.ts

@@ -168,11 +168,13 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
     review: z.ZodObject<{
         complexityThreshold: z.ZodNumber;
         required: z.ZodBoolean;
+        prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>;
     consult: z.ZodObject<{
         adapter: z.ZodString;
         model: z.ZodString;
         stallMinutes: z.ZodNumber;
+        prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>;
     visibility: z.ZodObject<{
         llm: z.ZodEnum<{

package/dist/config/config.js

@@ -152,8 +152,21 @@ export const TickmarkrConfigSchema = z.object({
         allowDeviations: z.array(z.string()),
     }).partial().optional(),
     judge: z.object({ adapter: z.string(), model: z.string() }),
-    review: z.object({ complexityThreshold: z.number(), required: z.boolean() }),
-    consult: z.object({ adapter: z.string(), model: z.string(), stallMinutes: z.number().positive() }),
+    // v1.53 T2: prefer — ordered reviewer preference (entry grammar: adapter | adapter:model, same as
+    // routing.map.prefer). Reorders diversity-eligible channels only; never widens or narrows eligibility.
+    review: z.object({ complexityThreshold: z.number(), required: z.boolean(), prefer: z.array(z.string()).optional() }),
+    // v1.54 T1: prefer — ranked consult seat failover. Entries MUST be adapter:model (unlike
+    // review.prefer's adapter|adapter:model grammar): a consult seat has no channel to inherit a
+    // model from, so a bare adapter is meaningless and fails config load fail-closed. The pinned
+    // adapter/model pair below stays the final fallback seat; an absent list is byte-identical.
+    consult: z.object({
+        adapter: z.string(),
+        model: z.string(),
+        stallMinutes: z.number().positive(),
+        prefer: z
+            .array(z.string().regex(/^[^:]+:.+$/, "consult.prefer entries must be adapter:model — a bare adapter has no model to run the seat with"))
+            .optional(),
+    }),
     visibility: z.object({
         llm: z.enum(["pane", "headless"]),
         keepPanes: z.enum(["run", "attempt", "forever"]),
@@ -474,8 +487,14 @@ export function configTemplate(overlay) {
 #   test: npm test
 #   byShape:
 #     docs: { acceptance: false, review: false }  # baseline, evidence, and scope are mandatory
-# review: { complexityThreshold: 7, required: true }
-# consult: { adapter: claude-code, model: fable, stallMinutes: 15 }
+# review: { complexityThreshold: 7, required: true, prefer: [codex:gpt-5.6-sol, kimi] }
+#                         # prefer: ordered reviewer seat preference (adapter | adapter:model); ranks
+#                         # diversity-eligible channels only — never admits a same-vendor/same-model reviewer
+# consult: { adapter: claude-code, model: fable, stallMinutes: 15, prefer: [codex:gpt-5.6-sol, kimi:kimi-code/k3] }
+#                         # prefer: ranked consult seat failover — entries are adapter:model ONLY (a
+#                         # consult seat has no channel to inherit a model from). The seat walks the
+#                         # list to the first live adapter; a failed seat or unparseable verdict falls
+#                         # to the next entry; the pinned adapter/model above is always the final seat
 # cost:                   # v1.20 REC-02 — OPTIONAL price table for the usage/cost report. Absent ⇒ every
 #                         # channel reports "not measurable" (never a crash or a fake $0). Two economics,
 #                         # never conflated: API = tokens × per-Mtok rate; sub = flat plan amortized over a

package/dist/gates/review.d.ts

@@ -15,5 +15,6 @@ export declare function checkDiffCap(gate: string, measured: number, cap: number
 export declare function isDiffCapPark(result: GateResult): boolean;
 export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
-export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[]): BillingChannel | null;
+export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
+prefer?: string[]): BillingChannel | null;
 export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[]): Promise<GateResult>;

package/dist/gates/review.js

@@ -39,7 +39,15 @@ export function diffCapParkReason(results) {
 export function modelId(model) {
     return model.slice(model.lastIndexOf("/") + 1);
 }
-export function pickReviewer(author, channels, exclude = []) {
+// v1.53 T2: same entry grammar as routing.map.prefer (router.ts preferIndex — router is out of this
+// module's dependency direction for a private fn, so the 3 lines live here too): `adapter` matches
+// every channel of that adapter, `adapter:model` exactly one; unmatched channels sort after all entries.
+function reviewPreferIndex(c, prefer) {
+    const i = prefer.findIndex((p) => p === c.adapter || p === channelKey(c));
+    return i === -1 ? prefer.length : i;
+}
+export function pickReviewer(author, channels, exclude = [], // v1.1 failover: reviewer channels that already produced garbage for this task
+prefer = []) {
     // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
     // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
     // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
@@ -49,15 +57,16 @@ export function pickReviewer(author, channels, exclude = []) {
         return null;
     return (channels
         // two independent axes: different vendor AND different base-model identity (ADDED TO the vendor
-        // rule, never replacing it — a future edit can't silently drop either).
+        // rule, never replacing it — a future edit can't silently drop either). The diversity filter runs
+        // BEFORE preference ranking: prefer sorts survivors only, so no entry can resurrect an excluded channel.
         .filter((c) => c.vendor !== authorChannel.vendor && modelId(c.model) !== modelId(author.model) && !exclude.includes(channelKey(c)))
-        .sort((a, b) => TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
+        .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
 }
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers) {
     if (task.complexity < cfg.review.complexityThreshold) {
         return { gate: "review", pass: true, details: `skipped — complexity ${task.complexity} < threshold ${cfg.review.complexityThreshold}`, meta: { skipped: true } };
     }
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? []);
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? []);
     if (!reviewer) {
         return cfg.review.required
             ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive" }

package/dist/run/consult.d.ts

@@ -28,4 +28,7 @@ export declare function consult(d: Dossier, cfg: TickmarkrConfig, adapters: Work
     keep?: boolean;
     onSlot?: (slot: Slot) => void;
     runId?: string;
+    channels?: Array<{
+        adapter: string;
+    }>;
 }): Promise<ConsultVerdict>;

package/dist/run/consult.js

@@ -92,6 +92,8 @@ let consultSeq = 0;
 export async function consult(d, cfg, adapters, driver, cwd, runDir, 
 // T2 ownership contract: runId names the consult pane canonically (tickmarkr:consult:<task>:0:<runId>)
 // via SlotOpts.owned; without it the legacy gatePaneName shape survives (non-daemon callers/tests).
+// v1.54 T1: channels — the daemon's doctor-filtered live channel list; prefer-seat liveness is
+// judged against it only (never rebuilt from config, which would select installed-but-unauthed seats).
 opts = {}) {
     const n = ++consultSeq;
     const nonce = generateVerdictNonce();
@@ -99,54 +101,82 @@ opts = {}) {
     mkdirSync(dir, { recursive: true });
     const promptFile = join(dir, `${d.taskId}-${n}.md`);
     writeFileSync(promptFile, buildDossierPrompt(d, nonce));
-    const adapter = getAdapter(cfg.consult.adapter, adapters);
-    let out;
-    if (cfg.visibility.llm === "headless") {
-        const r = await sh(adapter.headlessCommand(promptFile, cfg.consult.model), cwd, cfg.consult.stallMinutes * 60_000);
-        out = r.stdout + r.stderr;
-        out = augmentFakeVerdictOutput(adapter, out, nonce);
-    }
-    else {
-        // T8: role-first pane name for fleet visibility (consult · T2); consultSeq stays on the dossier artifact only
-        const slot = await driver.slot(cwd, gatePaneName("consult", d.taskId), {
-            label: `CONSULT ${d.taskId}`,
-            ...(opts.runId ? { owned: { role: "consult", taskId: d.taskId, attempt: 0, runId: opts.runId } } : {}),
-        });
-        opts.onSlot?.(slot);
-        const scriptPath = join(dir, `${d.taskId}-${n}.sh`);
-        // OBS-50: visible consult panes get the brand banner; headless path above stays banner-free (machine-parsed stdout)
-        writeFileSync(scriptPath, [
-            "export BASH_SILENCE_DEPRECATION_WARNING=1",
-            bannerShell(),
-            adapter.headlessCommand(promptFile, cfg.consult.model),
-            gateExitTrailer(nonce),
-        ].join("\n"));
-        await driver.run(slot, paneDispatchCommand(scriptPath));
-        // nonce-suffixed exit only: a dossier quoting tickmarkr's own exit literal must not false-complete.
-        await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, cfg.consult.stallMinutes * 60_000, { regex: true });
-        out = await driver.read(slot, 300);
-        if (!opts.keep)
-            await driver.close(slot);
+    // One seat = the WHOLE invoke-and-parse unit, both visibility branches (OBS-69 class: a headless-only
+    // failover would leave the production pane path hard-failing on seat one). null = no parseable verdict.
+    const invokeSeat = async (seatAdapter, seatModel, seatIdx) => {
+        const adapter = getAdapter(seatAdapter, adapters);
+        let out;
+        if (cfg.visibility.llm === "headless") {
+            const r = await sh(adapter.headlessCommand(promptFile, seatModel), cwd, cfg.consult.stallMinutes * 60_000);
+            out = r.stdout + r.stderr;
+        }
+        else {
+            // T8: role-first pane name for fleet visibility (consult · T2); consultSeq stays on the dossier artifact only
+            const slot = await driver.slot(cwd, gatePaneName("consult", d.taskId), {
+                label: `CONSULT ${d.taskId}`,
+                ...(opts.runId ? { owned: { role: "consult", taskId: d.taskId, attempt: 0, runId: opts.runId } } : {}),
+            });
+            opts.onSlot?.(slot);
+            const scriptPath = join(dir, `${d.taskId}-${n}${seatIdx > 0 ? `-s${seatIdx}` : ""}.sh`);
+            // OBS-50: visible consult panes get the brand banner; headless path above stays banner-free (machine-parsed stdout)
+            writeFileSync(scriptPath, [
+                "export BASH_SILENCE_DEPRECATION_WARNING=1",
+                bannerShell(),
+                adapter.headlessCommand(promptFile, seatModel),
+                gateExitTrailer(nonce),
+            ].join("\n"));
+            try {
+                await driver.run(slot, paneDispatchCommand(scriptPath));
+                // nonce-suffixed exit only: a dossier quoting tickmarkr's own exit literal must not false-complete.
+                await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, cfg.consult.stallMinutes * 60_000, { regex: true });
+                out = await driver.read(slot, 300);
+            }
+            finally {
+                // a failed seat must not leak its pane before the next seat opens under the same name
+                if (!opts.keep)
+                    await driver.close(slot);
+            }
+        }
         out = augmentFakeVerdictOutput(adapter, out, nonce);
-    }
-    const v = extractVerdictJson(out, nonce);
-    if (!v || !ACTIONS.includes(v.action)) {
-        return { action: "human", notes: "consult verdict unparseable — failing safe to human" };
-    }
-    // fail-closed exclusion: only a non-empty string survives. Malformed values (number/array/object/
-    // empty) are dropped — the verdict stays a normal channel-level reroute/retry/…, never a crash
-    // and never silently forced to human. Unknown adapter ids pass through; the daemon treats a
-    // zero-match expansion as channel-level reroute.
-    const raw = v.excludeAdapter;
-    const excludeAdapter = typeof raw === "string" && raw.length > 0 ? raw : undefined;
-    const reason = typeof v.reason === "string" ? v.reason : undefined;
-    const guidance = typeof v.guidance === "string" ? v.guidance : undefined;
-    const notes = String(v.notes ?? guidance ?? reason ?? "");
-    return {
-        action: v.action,
-        notes,
-        ...(reason ? { reason } : {}),
-        ...(guidance ? { guidance } : {}),
-        ...(excludeAdapter ? { excludeAdapter } : {}),
+        const v = extractVerdictJson(out, nonce);
+        if (!v || !ACTIONS.includes(v.action))
+            return null;
+        // fail-closed exclusion: only a non-empty string survives. Malformed values (number/array/object/
+        // empty) are dropped — the verdict stays a normal channel-level reroute/retry/…, never a crash
+        // and never silently forced to human. Unknown adapter ids pass through; the daemon treats a
+        // zero-match expansion as channel-level reroute.
+        const raw = v.excludeAdapter;
+        const excludeAdapter = typeof raw === "string" && raw.length > 0 ? raw : undefined;
+        const reason = typeof v.reason === "string" ? v.reason : undefined;
+        const guidance = typeof v.guidance === "string" ? v.guidance : undefined;
+        const notes = String(v.notes ?? guidance ?? reason ?? "");
+        return {
+            action: v.action,
+            notes,
+            ...(reason ? { reason } : {}),
+            ...(guidance ? { guidance } : {}),
+            ...(excludeAdapter ? { excludeAdapter } : {}),
+        };
     };
+    // v1.54 T1: ranked seat failover. Walk consult.prefer (adapter:model entries) to the first entry
+    // whose adapter is in the live channel set; a failed seat or unparseable verdict falls to the next;
+    // the pinned consult.adapter/model is always the final seat. No channels provided (non-daemon
+    // callers) ⇒ empty live set ⇒ pin only, byte-identical to pre-v1.54 behavior. Failover changes
+    // only WHICH seat answers — per-seat parsing and the fail-safe human action below are untouched.
+    const live = new Set((opts.channels ?? []).map((c) => c.adapter));
+    const seats = (cfg.consult.prefer ?? [])
+        .map((entry) => ({ adapter: entry.slice(0, entry.indexOf(":")), model: entry.slice(entry.indexOf(":") + 1) }))
+        .filter((s) => live.has(s.adapter));
+    seats.push({ adapter: cfg.consult.adapter, model: cfg.consult.model });
+    for (const [i, seat] of seats.entries()) {
+        try {
+            const v = await invokeSeat(seat.adapter, seat.model, i);
+            if (v)
+                return v;
+        }
+        catch {
+            // failed seat (unknown adapter, dead driver/pane, shell error) — fall to the next entry
+        }
+    }
+    return { action: "human", notes: "consult verdict unparseable — failing safe to human" };
 }

package/dist/run/daemon.d.ts

@@ -5,6 +5,7 @@ import { type JournalEvent } from "./journal.js";
 export interface RunOptions {
     runId?: string;
     resume?: boolean;
+    supersedes?: string;
     graphChanged?: boolean;
     concurrency?: number;
     driver?: ExecutorDriver;
@@ -12,6 +13,7 @@ export interface RunOptions {
     globalDir?: string;
     mode?: RoutingMode;
     narrate?: (event: JournalEvent) => void;
+    exit?: (code: number) => void;
 }
 export type ModeSource = "run flag" | "spec" | "repo config" | "global config" | "default";
 export interface ResolvedRunMode {

package/dist/run/daemon.js

@@ -98,10 +98,17 @@ export async function runDaemon(repoRoot, opts = {}) {
     // HARD-01/02: hold the run lock across the whole read-modify-write of graph.json. Acquire
     // BEFORE loadGraph; release in the finally below (every exit path, incl. throws).
     const runId = opts.runId ?? newRunId();
+    // v1.53 T5: an unknown --supersedes id must fail BEFORE any run starts — Journal.open throws and
+    // no lock, journal, or baseline for the new run has been created yet. Opened without a narrate
+    // sink: the prior journal append below is silent bookkeeping, not this run's narration.
+    const prior = opts.supersedes !== undefined ? Journal.open(repoRoot, opts.supersedes) : undefined;
     // T6 narrator: one live status surface per run (herdr only — driver.narrator is undefined on
     // subprocess, so the optional-chain open below is a no-op there). Cosmetic-only: any failure is
     // swallowed (never affects the run); the operator closes a surviving watch pane.
     const lock = acquireRunLock(repoRoot, runId);
+    // v1.54 T2: declared before the try so the finally can always deregister (a throw before
+    // registration leaves it undefined — the guard below covers that path).
+    let onTermination;
     try {
         let graph = loadGraph(repoRoot);
         // v1.51 T2: the routing mode resolves BEFORE any routing input is built — run flag > spec front-matter
@@ -116,6 +123,67 @@ export async function runDaemon(repoRoot, opts = {}) {
         // No preview — the daemon honors routing.learned:off and gets undefined; this snapshot is immutable
         // for the run, so this run's own telemetry never feeds back into its own routing.
         const profile = loadRoutingProfile(repoRoot, cfg);
+        // v1.54 T2 (OBS-71): signal reaper — a killed daemon closes its own panes and releases the lock.
+        // Every slot this run opens stays in liveSlots until closed: the worker path opens through
+        // trackedDriver below, and gates/consults receive trackedDriver as THEIR driver, so their pane
+        // opens/closes keep the ledger exact. Termination then closes exactly what is still live — and a
+        // slot closed once (task-done, quota reroute, gate self-clean) can never be closed twice.
+        const liveSlots = new Set();
+        const closeSlot = async (s) => {
+            if (!liveSlots.delete(s))
+                return; // already closed — never twice
+            await driver.close(s);
+        };
+        const trackedDriver = {
+            id: driver.id,
+            interactive: driver.interactive,
+            slot: async (cwd, name, o) => { const s = await driver.slot(cwd, name, o); liveSlots.add(s); return s; },
+            run: (s, cmd) => driver.run(s, cmd),
+            waitOutput: (s, p, ms, o) => driver.waitOutput(s, p, ms, o),
+            waitAgentStatus: (s, st, ms) => driver.waitAgentStatus(s, st, ms),
+            status: (s) => driver.status(s),
+            read: (s, n) => driver.read(s, n),
+            ...(driver.sendKey ? { sendKey: driver.sendKey.bind(driver) } : {}),
+            notify: (m, o) => driver.notify(m, o),
+            close: closeSlot,
+            worktree: (r, b, base) => driver.worktree(r, b, base),
+        };
+        // Termination (SIGINT/SIGTERM): close every live slot, reconcile owned panes against an EMPTY
+        // desired set (herdr panes not in memory; panesToClose spares foreign names, watch panes, and
+        // other runs' panes by construction), release the run lock, then exit. Journal-silent by design —
+        // no run-end/interrupted event, so stop-amend-resume keeps resuming. keepPanes:"forever" (the
+        // keep-everything debug override) preserves panes but still releases the lock and exits.
+        let termSignal;
+        let abortRun = () => { };
+        const aborted = new Promise((_, reject) => { abortRun = reject; });
+        aborted.catch(() => { });
+        let reaping = false;
+        const exit = opts.exit ?? ((code) => process.exit(code));
+        onTermination = (sig) => {
+            termSignal = sig;
+            void (async () => {
+                if (!reaping) {
+                    reaping = true;
+                    if (cfg.visibility.keepPanes !== "forever") {
+                        for (const s of liveSlots) { // closeSlot only deletes the element being visited — safe during Set iteration
+                            try {
+                                await closeSlot(s);
+                            }
+                            catch { /* cosmetic — reconcile is the backstop */ }
+                        }
+                        try {
+                            await driver.reconcile?.(new Set(), runId);
+                        }
+                        catch { /* cosmetic — visibility is never a gate */ }
+                    }
+                    releaseRunLock(repoRoot); // the process dies at exit() below — the finally never runs on this path
+                }
+                abortRun(new Error(`terminated by ${sig}`));
+                exit(sig === "SIGINT" ? 130 : 143);
+            })();
+        };
+        process.on("SIGINT", onTermination);
+        process.on("SIGTERM", onTermination);
         const journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
         const branchEvent = opts.resume
             ? [...journal.read()].reverse().find((e) => (e.event === "run-start" || e.event === "run-end" || e.event === "merge") && typeof e.data.branch === "string")
@@ -140,6 +208,11 @@ export async function runDaemon(repoRoot, opts = {}) {
         // equivalence to the router.ts:194 profile⇒undefined pattern: no map entry ⇒ today's literal.
         const resume = opts.resume ? journal.replayResumeState() : new Map();
         if (opts.resume) {
+            // v1.53 T5: a superseded run is dead — resuming it beside its successor is the exact
+            // two-concurrent-runs hazard supersession exists to prevent. Fail closed, naming the successor.
+            const superseded = [...journal.read()].reverse().find((e) => e.event === "superseded" && typeof e.data.by === "string");
+            if (superseded)
+                throw new Error(`refusing to resume ${runId}: superseded by ${superseded.data.by}`);
             const start = journal.read().find((e) => e.event === "run-start");
             if (!start)
                 throw new Error(`journal for ${runId} has no run-start event`);
@@ -175,7 +248,10 @@ export async function runDaemon(repoRoot, opts = {}) {
             baseRef = await gitHead(repoRoot);
             baseline = await captureBaseline(repoRoot, commands);
             writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(baseline, null, 2));
-            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphDefinitionHash: graphDefinitionHash(graph), mode: rm.mode.mode, modeSource: rm.source }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness; mode/modeSource: v1.51 T2
+            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphDefinitionHash: graphDefinitionHash(graph), mode: rm.mode.mode, modeSource: rm.source, ...(prior ? { supersedes: prior.runId } : {}) }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness; mode/modeSource: v1.51 T2; supersedes: v1.53 T5
+            // v1.53 T5: mark the prior run AFTER this run's run-start exists, so the prior journal never
+            // names a successor that has no journal. Append-only — the prior journal is never rewritten.
+            prior?.append("superseded", undefined, { by: runId });
         }
         // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
         // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
@@ -334,9 +410,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     journalTail: JSON.stringify(journal.read().slice(-20)),
                     transcript: transcript.slice(-8000),
                     diff: diffOrFeedback, gates,
-                }, cfg, adapters, driver, repoRoot, journal.dir, 
+                }, cfg, adapters, trackedDriver, repoRoot, journal.dir, 
                 // D-07: consult panes self-clean when the verdict is read (keepLlm) — only "forever" keeps them.
-                { keep: keepLlm, onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined, runId });
+                // v1.54 T1: channels = this run's doctor-filtered live list — consult.prefer seat liveness
+                // is judged against it, never rebuilt from config (installed-but-unauthed seats would stall).
+                { keep: keepLlm, onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined, runId, channels });
             };
             // returns true → continue attempting, false → task is terminal (parked)
             // trigger (why the consult ran) is threaded in so the decompose/human park keeps its cause —
@@ -412,13 +490,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                 }
                 // v1.29: consume the prior gate-failed session once. Same channel + known under-threshold context
                 // + adapter capability resumes; every other path is today's fresh dispatch.
+                // v1.53 T3: an adapter with no context surface at all (kimi, KIMI-03) may declare
+                // resumeUnknownContext to loosen ONLY the contextTokens-known requirement — a KNOWN
+                // over-threshold context still forces fresh, and the escalation ladder bounds the chain.
                 const priorSession = retrySession;
                 retrySession = undefined;
+                const retryAdapter = adapters.find((a) => a.id === assignment.adapter);
                 retryMode = priorSession
                     && priorSession.channel === channelKey(assignment)
-                    && priorSession.contextTokens !== undefined
-                    && priorSession.contextTokens < cfg.contextWarnTokens
-                    && adapters.find((a) => a.id === assignment.adapter)?.resumeCommand
+                    && (priorSession.contextTokens !== undefined
+                        ? priorSession.contextTokens < cfg.contextWarnTokens
+                        : retryAdapter?.resumeUnknownContext === true)
+                    && retryAdapter?.resumeCommand
                     ? "resume"
                     : "fresh";
                 // v1.23 T3: over-threshold context still forces fresh at the retry boundary; never interrupt a
@@ -480,7 +563,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const adapter = getAdapter(assignment.adapter, adapters);
                 // VIS-04: workers share one role tab. T2: `owned` names the pane canonically (ownership contract);
                 // the legacy name stays the fallback for drivers without owned handling (subprocess spies).
-                const slot = await driver.slot(wt, `${t.id}-worker-${assignment.adapter}-a${attempt}-${runTag}`, { group: "workers", owned: { role: "worker", taskId: t.id, attempt, runId } });
+                const slot = await trackedDriver.slot(wt, `${t.id}-worker-${assignment.adapter}-a${attempt}-${runTag}`, { group: "workers", owned: { role: "worker", taskId: t.id, attempt, runId } });
                 const sessionId = retryMode === "resume" ? priorSession.id : slot.name;
                 const icmd = retryMode === "resume"
                     ? adapter.resumeCommand(sessionId, promptFile, assignment.model)
@@ -660,7 +743,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 if (keepOpen && (finished || driver.id !== "subprocess"))
                     keptSlots.push(slot);
                 else
-                    await driver.close(slot);
+                    await closeSlot(slot);
                 // SPEND-01: usage from the harness's own cwd-keyed structured store, read POST-HOC from disk —
                 // `wt` is this task's private worktree, so the path is unique; the read is sliced to records
                 // stamped at/after this attempt's dispatch instant. Never the harvested pane text, never the
@@ -714,7 +797,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             if (idx >= 0) {
                                 keptSlots.splice(idx, 1);
                                 try {
-                                    await driver.close(slot);
+                                    await closeSlot(slot);
                                 }
                                 catch { /* cosmetic — reconcile is the backstop */ }
                             }
@@ -793,7 +876,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         commands, baseline, channels, adapters, cfg,
                         via: cfg.visibility.llm === "pane"
                             ? {
-                                driver,
+                                driver: trackedDriver,
                                 // D-07: judge/review panes self-clean when their verdict is read (keepLlm) — only "forever" keeps them.
                                 keep: keepLlm,
                                 onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined,
@@ -845,7 +928,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             const idx = keptSlots.indexOf(slot);
                             if (idx >= 0) {
                                 keptSlots.splice(idx, 1);
-                                await driver.close(slot);
+                                await closeSlot(slot);
                             }
                         }
                         await reconcile({ spareLiveLlm: true }); // task-done is a terminal event — sweep this task's leftovers
@@ -854,7 +937,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     break gateLoop;
                 }
                 gateFails++; // this attempt's gates failed — the one place quality degradation is verified (never inferred from attempts)
-                retrySession = { channel: channelKey(assignment), id: sessionId, contextTokens };
+                // v1.53 T3: prefer the CLI's own session id captured from this attempt's output (kimi's resume
+                // trailer) over the harness slot name; absent hook or no capture keeps today's slot-name id.
+                retrySession = { channel: channelKey(assignment), id: adapter.sessionIdFrom?.(output) ?? sessionId, contextTokens };
                 feedback = results.filter((g) => !g.pass).map((g) => `${g.gate}: ${g.details}`).join("\n\n");
                 const step = r.ladder[Math.min(ladderIdx++, r.ladder.length - 1)];
                 journal.append("escalation", t.id, { step, attempt: attempt + 1 });
@@ -882,6 +967,10 @@ export async function runDaemon(repoRoot, opts = {}) {
         };
         const inflight = new Map();
         while (true) {
+            // v1.54 T2: a signal that landed while nothing was racing `aborted` (empty inflight window)
+            // must still stop the run before it can dispatch more work or write run-end.
+            if (termSignal)
+                throw new Error(`terminated by ${termSignal}`);
             const ready = readyTasks(graph)
                 .filter((t) => !inflight.has(t.id))
                 .slice(0, Math.max(0, concurrency - inflight.size));
@@ -899,14 +988,14 @@ export async function runDaemon(repoRoot, opts = {}) {
             }
             if (inflight.size === 0)
                 break;
-            await Promise.race(inflight.values());
+            await Promise.race([...inflight.values(), aborted]); // aborted rejects on termination — unwinds the run
         }
         // D-07: the sweep now closes only what's LEFT in keptSlots — done-closed worker slots were removed
         // (no double-close) and self-cleaned LLM/consult panes were never added under keepLlm:false. This
         // leaves failed/parked attempts' worker slots, which keep their failure context until run end.
         if (cfg.visibility.keepPanes === "run") {
             for (const s of keptSlots)
-                await driver.close(s); // panes persist for the run's duration, then clean up
+                await closeSlot(s); // panes persist for the run's duration, then clean up
         }
         saveGraph(repoRoot, graph);
         const byStatus = (s) => graph.tasks.filter((t) => t.status === s).map((t) => t.id);
@@ -967,6 +1056,13 @@ export async function runDaemon(repoRoot, opts = {}) {
         return summary;
     }
     finally {
+        // v1.54 T2: deregister on EVERY exit (normal run end, throw, termination unwind) — the daemon
+        // test suite runs runDaemon dozens of times in one process; a leaked handler would close a
+        // later run's slots.
+        if (onTermination) {
+            process.removeListener("SIGINT", onTermination);
+            process.removeListener("SIGTERM", onTermination);
+        }
         releaseRunLock(repoRoot);
     }
 }

package/dist/run/git.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
-import { existsSync, lstatSync, readlinkSync, rmSync, symlinkSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
@@ -110,11 +110,40 @@ export async function createWorktree(repo, branch, baseRef) {
 // (real directory, wrong/broken symlink) is restored to the provisioned link. Idempotent: an
 // already-correct link is a no-op. Returns whether dest is the provisioned link: provisioning ignores
 // the result; the pre-gate caller treats false as a named environmental park, never a masked test red.
+// OBS-78: target repos typically ignore `node_modules/` — a directories-only pattern that does NOT
+// match the provisioned SYMLINK, so a worker staging with `git add -A` commits the link and burns an
+// attempt on the scope gate. Write `node_modules` (no slash: matches the link too) into the exclude
+// file git actually consults for this worktree. Per-worktree `info/` is ignored in linked worktrees
+// (gitrepository-layout redirects it), so resolve through the `.git` gitfile + `commondir` indirection
+// to the common git dir. Local git metadata only — the target repository's .gitignore is never edited.
+// Idempotent (appends only when no entry exists) and best-effort, like the link itself.
+function excludeNodeModules(dir) {
+    try {
+        let gitDir = join(dir, ".git");
+        if (lstatSync(gitDir).isFile()) { // linked worktree: .git is a gitfile naming the real git dir
+            const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync(gitDir, "utf8"));
+            if (!m)
+                return;
+            gitDir = resolve(dir, m[1]);
+        }
+        const commondir = join(gitDir, "commondir");
+        if (existsSync(commondir))
+            gitDir = resolve(gitDir, readFileSync(commondir, "utf8").trim());
+        const exclude = join(gitDir, "info", "exclude");
+        const current = existsSync(exclude) ? readFileSync(exclude, "utf8") : "";
+        if (/^node_modules$/m.test(current))
+            return; // already excluded — repeated re-asserts add nothing
+        mkdirSync(join(gitDir, "info"), { recursive: true });
+        writeFileSync(exclude, current + (current && !current.endsWith("\n") ? "\n" : "") + "node_modules\n");
+    }
+    catch { /* not a git checkout (bare tmpdir in tests) — never fail provisioning over the exclude */ }
+}
 export function linkNodeModules(repo, dir, { force = false } = {}) {
     const src = join(repo, "node_modules");
     const dest = join(dir, "node_modules");
     if (!existsSync(src))
         return true; // nothing provisioned to link — correct state is no link (OBS-27 best-effort)
+    excludeNodeModules(dir); // OBS-78: the link must never be stageable in this worktree
     try {
         if (lstatSync(dest).isSymbolicLink() && readlinkSync(dest) === src)
             return true; // already the provisioned link

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.52.0",
+  "version": "1.54.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",