tickmarkr 1.53.0 → 1.55.0

package/README.md

@@ -173,8 +173,56 @@ More levers, all optional and absent-safe (absent config keeps default behavior)
   the routed model's window
 - `routing.sla` — per-shape latency expectations, surfaced as advisory plan lints against the
   learned performance profile
-- `run --quality` — raise every capability floor one band for that run (it never lowers one),
-  disable exploration, and record the original and raised floor in routing provenance
+- `run --quality` — compatibility alias for `run --mode partner-led` for that run; it disables
+  exploration and records the selected mode in routing provenance
+
+## Steering: routing modes, reviewer preferences, and reruns
+
+### Routing modes
+
+`routing.mode` is a preset that compiles into floor assignments at config load time. The router never sees the mode itself; it receives resolved floors only.
+
+Three routing modes are available:
+
+- **`risk-based`** (default): byte-identical to pre-v1.51 routing. Absent `mode` key resolves as risk-based.
+- **`partner-led`**: resolves every non-overridden shape to a `frontier` floor and disables exploration — use when quality is paramount and cost is secondary.
+- **`staff-led`**: lowers each mode default by one tier (e.g., `implement` and `refactor` become `cheap` instead of `mid`) while keeping the preset floor for the integrity set (`plan`, `spec`, `migration`, `ui`) at `frontier`.
+
+Explicit `routing.floors` entries beat mode-preset deltas and are linted during plan if they shadow the mode's delta; an explicit integrity floor below `frontier` is also linted. The mode is compiled once at config load and never consulted during routing.
+
+### Review preferences
+
+`review.prefer` is an ordered list of reviewer seats for the cross-vendor code-review gate. Entries are matched by diversity (never the same vendor or model as the original worker), and routing reorders the available channels only — it does not admit unauthed or denied channels.
+
+```yaml
+review:
+  prefer: [codex, kimi]           # bare adapter: inherits model from the routed channel
+  prefer: [codex:gpt-5.6-sol, kimi:kimi-code/k3]  # adapter:model explicit
+  prefer: [codex, kimi:kimi-code/k3]  # mixed: bare and explicit
+```
+
+**Grammar**: review prefer entries may name a bare adapter (inheriting the model from the current channel) or an explicit `adapter:model` pair. Bare adapters rank every diversity-eligible channel for that adapter; explicit pairs rank one diversity-eligible channel.
+
+### Consult preferences
+
+`consult.prefer` is a ranked failover list of seats for escalations on deadlock or gate stalls. Unlike review, a consult seat has no channel to inherit a model from, so entries **must be explicit `adapter:model` pairs**.
+
+```yaml
+consult:
+  adapter: claude-code
+  model: fable
+  prefer: [codex:gpt-5.6-sol, kimi:kimi-code/k3]   # adapter:model ONLY
+```
+
+The daemon walks the preference list to the first live adapter, then the pinned `consult.adapter:model` pair as the final fallback. Failed or unparseable verdicts fall to the next entry.
+
+**Grammar**: consult prefer entries require `adapter:model` form — a bare adapter name is invalid and fails config load. Every entry must declare both the adapter and the model because a consult seat runs independently with no channel context.
+
+### Rerun control: --supersedes
+
+`tickmarkr run --supersedes <prior-runId>` marks the current run as a rerun of a prior engagement. The current task graph is used for the rerun; compile it fresh first if the spec changed. The prior runId is recorded in the new journal, and the prior journal records the successor, for audit trails and change attribution.
+
+Use this when you modify the spec or worker logic and want to mark an intentional rerun while preserving the relationship in both run journals.
 
 ## Model scoping and auth detection
 

package/dist/adapters/model-lints.d.ts

@@ -17,6 +17,7 @@ export type RoutedAssignment = {
 /** Advisory only — absent windows config or undeclared model window ⇒ no lint. */
 export declare function contextWindowLints(tasks: ReadonlyArray<Task>, assignments: ReadonlyArray<RoutedAssignment>, cfg: TickmarkrConfig, repoRoot: string): string[];
 export declare function seedPreferLints(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], overlayPreferShapes?: ReadonlySet<string>): string[];
+export declare function preferEntryLints(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, mapShapes?: ReadonlySet<string>): string[];
 export declare function modelLints(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], opts?: {
     tty?: boolean;
     stateDir?: string;

package/dist/adapters/model-lints.js

@@ -95,6 +95,33 @@ export function seedPreferLints(cfg, health, adapters, overlayPreferShapes = new
     }
     return lints;
 }
+// v1.54 T3: dead-steering sweep — operator prefer entries (routing.map overlay shapes, review.prefer,
+// consult.prefer) that can never match an installed channel are named at plan time; v1.53 T2 pins the
+// no-match case as a silent no-op, which makes a typo invisible. Advisory only: reads config + doctor
+// health (no live probes), never touches routing. Seed map prefers stay seedPreferLints' turf (auto-prefer
+// routes around dead seeds) — mapShapes limits this sweep to operator-authored entries so a bare default
+// fleet isn't double-linted. Entry grammar mirrors preferIndex: adapter | adapter:model (first colon).
+export function preferEntryLints(cfg, health, mapShapes = new Set()) {
+    const lints = [];
+    const sweep = (surface, entries) => {
+        for (const entry of entries ?? []) {
+            const i = entry.indexOf(":");
+            const adapter = i < 0 ? entry : entry.slice(0, i);
+            const model = i < 0 ? undefined : entry.slice(i + 1);
+            if (!health[adapter]?.installed) {
+                lints.push(`${surface} '${entry}' names uninstalled adapter '${adapter}' — dead steering (entry can never match)`);
+            }
+            else if (model !== undefined && !(model in (cfg.tiers[adapter]?.models ?? {}))) {
+                lints.push(`${surface} '${entry}' names model '${model}' absent from ${adapter}'s configured channels — dead steering (entry can never match)`);
+            }
+        }
+    };
+    for (const shape of mapShapes)
+        sweep(`routing.map.${shape}.prefer`, cfg.routing.map[shape]?.prefer);
+    sweep("review.prefer", cfg.review.prefer);
+    sweep("consult.prefer", cfg.consult.prefer);
+    return lints;
+}
 // Diffs detected models (doctor.json) against configured tiers, both directions, per adapter id in cfg.tiers.
 // No `  ! ` prefix here — the consumer (doctor rows / plan lints) owns that. Pre-v1.5 doctor.json (models:[], no
 // modelsDetectedAt) is the compat baseline: `?.`/`?? []` everywhere, no zod (would reject old files).

package/dist/adapters/registry.js

@@ -77,6 +77,19 @@ const MODEL_PROBE_PROMPT = "Reply with exactly OK and nothing else.";
 const MODEL_PROBE_TIMEOUT_MS = 60000;
 // Auth-words only match when tied to a failure word; bare "auth"/"OAuth"/"authored" never fail (v1.27 T2).
 const AUTH_FAILURE_RE = /\b4\d\d\b|\bauth(?:entication|orization)?\s+(?:error|failed|failure|denied)|unauthori[sz]ed|forbidden|access denied|credit(?:s)?\s+(?:exhausted|error|denied)/i;
+const PROBE_REASON_CAP = 240;
+// v1.55 T3: the tail must open at a word boundary — a mid-word slice ("odel 'grok-…'") reads as
+// corruption in operator-facing diagnostics. Input is already space-normalized, so " " is the only
+// boundary. A tail that is one unbroken token keeps its mid-word cut rather than storing nothing.
+function reasonTail(output) {
+    if (output.length <= PROBE_REASON_CAP)
+        return output;
+    const tail = output.slice(-PROBE_REASON_CAP);
+    if (output[output.length - PROBE_REASON_CAP - 1] === " ")
+        return tail;
+    const sp = tail.indexOf(" ");
+    return sp === -1 ? tail : tail.slice(sp + 1);
+}
 function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TIMEOUT_MS) {
     // SIGKILL-timeout is not exit-1: report the budget, never the masked kill code (v1.27 T1).
     if (timedOut)
@@ -85,7 +98,7 @@ function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TI
     // OBS-72: TAIL, not head — the error lands at the END of CLI output; a head slice stores only the
     // startup banner and hid the real "Not inside a trusted directory" failure for a day.
     return code !== 0 || QUOTA_RE.test(output) || AUTH_FAILURE_RE.test(output)
-        ? output.slice(-240) || `probe exited ${code}`
+        ? reasonTail(output) || `probe exited ${code}`
         : undefined;
 }
 export const pendingAutoPreferKey = Symbol.for("tickmarkr.pendingAutoPrefer");

package/dist/cli/commands/fleet.js

@@ -194,9 +194,9 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
     const health = cached;
     const term = openTerm(input, output);
     try {
-        // step 1/5 — probe data
+        // step 1/6 — probe data
         const ageLine = formatAge(doctorAgeMs(cwd));
-        term.frame(listFrame("step 1/5 · probe data", "enter continue · r refresh via doctor · esc/q quit", [`probe data: ${ageLine} (.tickmarkr/doctor.json)`], 0));
+        term.frame(listFrame("step 1/6 · probe data", "enter continue · r refresh via doctor · esc/q quit", [`probe data: ${ageLine} (.tickmarkr/doctor.json)`], 0));
         for (;;) {
             const k = await term.key();
             if (isAbort(k))
@@ -207,7 +207,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             if (isNext(k))
                 break;
         }
-        // step 2/5 — agent CLIs (space toggles adapter deny)
+        // step 2/6 — agent CLIs (space toggles adapter deny)
         const installed = adapters.filter((a) => health[a.id]?.installed);
         const adapterRows = () => installed.map((a) => {
             const h = health[a.id];
@@ -216,7 +216,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         });
         const listLegend = "↑↓/jk move · space toggle · enter next · esc/q quit";
         let aCursor = 0;
-        term.frame(listFrame("step 2/5 · agent CLIs", listLegend, adapterRows(), aCursor));
+        term.frame(listFrame("step 2/6 · agent CLIs", listLegend, adapterRows(), aCursor));
         for (;;) {
             const k = await term.key();
             if (isAbort(k))
@@ -240,9 +240,9 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 changed = true;
             }
             if (changed)
-                term.frame(listFrame("step 2/5 · agent CLIs", listLegend, adapterRows(), aCursor));
+                term.frame(listFrame("step 2/6 · agent CLIs", listLegend, adapterRows(), aCursor));
         }
-        // step 3/5 — models per enabled adapter (space toggles deny, t assigns tier from the row)
+        // step 3/6 — models per enabled adapter (space toggles deny, t assigns tier from the row)
         const enabledAdapters = installed.filter((a) => !isDeniedAdapter(a.id, editable));
         for (const a of enabledAdapters) {
             const unclassifiedAll = fleetUnclassifiedModels(cfg, health, adapters).filter((u) => u.adapter === a.id);
@@ -260,7 +260,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 const denied = isDeniedModel(a.id, r.model, editable);
                 return `${denied ? toggleInactive() : toggleActive()} ${r.model}  ${tier?.tier ?? "???"}  ${denied ? "denied" : "allowed"}`;
             });
-            const title = `step 3/5 · models · ${a.id}`;
+            const title = `step 3/6 · models · ${a.id}`;
             const modelsLegend = "↑↓/jk move · space toggle · t tier · enter next · esc/q quit";
             let mCursor = 0;
             term.frame(listFrame(title, modelsLegend, renderRows(rowsData()), mCursor));
@@ -305,7 +305,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                     term.frame(listFrame(title, modelsLegend, renderRows(rowsData()), mCursor));
             }
         }
-        // step 4/5 — routing mode (selection is in-memory; the write happens only through the diff confirm).
+        // step 4/6 — routing mode (selection is in-memory; the write happens only through the diff confirm).
         // Candidate floor tables come from the ONE preset compiler via resolveRunMode — no mode math here.
         const modeCfgs = Object.fromEntries(ROUTING_MODES.map((m) => [m, m === rm.mode.mode ? rm : resolveRunMode(cwd, { flag: m, globalDir })]));
         const modeRows = () => ROUTING_MODES.map((m) => `${m === rm.mode.mode ? toggleActive() : " "} ${m.padEnd(11)}  ${MODE_GLOSS[m]}`);
@@ -321,7 +321,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 ...(changed.length ? changed.map((s) => `    ${s}: ${cur[s]} → ${next[s]}`) : ["    (no floor changes)"]),
             ];
         };
-        const modeTitle = "step 4/5 · routing mode";
+        const modeTitle = "step 4/6 · routing mode";
         const modeLegend = "↑↓/jk move · enter select · esc/q quit";
         let modeCursor = ROUTING_MODES.indexOf(rm.mode.mode);
         let selectedMode = rm.mode.mode;
@@ -341,7 +341,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
                 term.frame(modeFrame());
             }
         }
-        // step 5/5 — shape routing (typed entry for pin/tier/prefer from the highlighted row);
+        // step 5/6 — shape routing (typed entry for pin/tier/prefer from the highlighted row);
         // previews route under the SELECTED mode's resolved floors, never a floor edit of its own
         const channels = discoverChannels(cfg, adapters, health);
         const profile = loadRoutingProfile(cwd, cfg, { preview: true });
@@ -359,7 +359,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             const auto = autoPrefer?.[shape] && !overlayShapes.has(shape) ? "  (auto-prefer active)" : "";
             return `${shape}  →  ${now}${auto}`;
         });
-        const shapesTitle = "step 5/5 · shape routing";
+        const shapesTitle = "step 5/6 · shape routing";
         // v1.52 T5: no map-tier editing action — routing.floors is the only band authority now.
         const shapesLegend = "↑↓/jk move · a auto · p pin · f prefer · enter next · esc/q quit";
         let sCursor = 0;
@@ -400,6 +400,43 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             if (changed)
                 term.frame(listFrame(shapesTitle, shapesLegend, shapeRows(), sCursor));
         }
+        // step 6/6 — steering (v1.54 T4): review.prefer + consult.prefer via the same typed-entry
+        // pattern as the shape prefer action; edits are in-memory only and land on the merged overlay
+        // below, so they ride the ONE diff-confirm + reload-guard write path (never a second writer)
+        const STEER_KEYS = ["review", "consult"];
+        const initialSteering = {
+            review: cfg.review.prefer?.slice(),
+            consult: cfg.consult.prefer?.slice(),
+        };
+        const steering = structuredClone(initialSteering);
+        const steerRows = () => STEER_KEYS.map((k) => `${k}.prefer  →  ${steering[k]?.join(", ") ?? "(none)"}`);
+        const steerTitle = "step 6/6 · steering";
+        const steerLegend = "↑↓/jk move · f prefer · enter next · esc/q quit";
+        let stCursor = 0;
+        term.frame(listFrame(steerTitle, steerLegend, steerRows(), stCursor));
+        for (;;) {
+            const k = await term.key();
+            if (isAbort(k))
+                return QUIT;
+            if (isNext(k))
+                break;
+            let changed = false;
+            const moved = moveCursor(k, stCursor, STEER_KEYS.length);
+            if (moved !== stCursor) {
+                stCursor = moved;
+                changed = true;
+            }
+            else if (k.name === "f") {
+                const which = STEER_KEYS[stCursor];
+                const grammar = which === "consult" ? "adapter:model seats" : "adapters or adapter:model";
+                const raw = await term.askTyped(`${which}.prefer (comma-separated ${grammar}, empty clears)> `);
+                const list = raw.split(",").map((s) => s.trim()).filter(Boolean);
+                steering[which] = list.length ? list : undefined;
+                changed = true;
+            }
+            if (changed)
+                term.frame(listFrame(steerTitle, steerLegend, steerRows(), stCursor));
+        }
         // review — unified diff + typed confirm (the ONLY write path; the mode screen funnels through here)
         const before = currentRepoOverlayText(cwd);
         const existing = readOverlayFile(repoOverlayPath(cwd));
@@ -409,8 +446,25 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         const merged = fleetEditableEquals(initial, editable)
             ? structuredClone(existing)
             : fleetRepoOverlayFromDelta(initial, editable, existing);
+        // steering lands on the merged object and serializes via repoOverlayYaml's non-fleet
+        // passthrough; clearing removes the prefer key (and an emptied parent block) from the overlay
+        let steeringChanged = false;
+        for (const key of STEER_KEYS) {
+            if (JSON.stringify(steering[key]) === JSON.stringify(initialSteering[key]))
+                continue;
+            steeringChanged = true;
+            const block = { ...merged[key] };
+            if (steering[key])
+                block.prefer = steering[key];
+            else
+                delete block.prefer;
+            if (Object.keys(block).length)
+                merged[key] = block;
+            else
+                delete merged[key];
+        }
         const after = withModeLine(repoOverlayYaml(merged, provenanceMap(editable)), writeMode);
-        if ((!modeChanged && fleetEditableEquals(initial, editable)) || before === after) {
+        if ((!modeChanged && !steeringChanged && fleetEditableEquals(initial, editable)) || before === after) {
             return "fleet: no overlay changes (empty diff)";
         }
         const diff = unifiedYamlDiff(before, after, repoOverlayPath(cwd));

package/dist/cli/commands/plan.js

@@ -1,9 +1,9 @@
 import { allAdapters, discoverChannels, doctorAgeMs, modelAuthExclusions, probeAll, readDoctor, servableExclusions, servabilityLine } from "../../adapters/registry.js";
-import { formatModelAuthLine, contextWindowLints, modelLints, ttyVisual } from "../../adapters/model-lints.js";
+import { formatModelAuthLine, contextWindowLints, modelLints, preferEntryLints, ttyVisual } from "../../adapters/model-lints.js";
 import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
 import { parseArgs } from "node:util";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
-import { DEFAULT_CONFIG, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
+import { DEFAULT_CONFIG, overlayPreferShapes, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
 import { loadGraph } from "../../graph/graph.js";
 import { resolveRunMode } from "../../run/daemon.js";
 import { excludedChannels, exclusionLine } from "../../route/preference.js";
@@ -121,6 +121,8 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters())
             lints.push(`${role}: ${sel.adapter}:${sel.model} not installed — that gate/consult will fail closed`);
     }
     lints.push(...modelLints(cfg, health, adapters, { tty: ttyVisual() })); // health may be pre-v1.5/probeAll-fallback — no-detection branch covers both
+    // v1.54 T3: dead-steering sweep — advisory only, renders with the routing lints, never alters routing.
+    lints.push(...preferEntryLints(cfg, health, overlayPreferShapes(cwd)));
     if (cfg.review.required && channels.length && !fleetCanCrossVendorReview(channels)) {
         lints.push("review: no cross-vendor reviewer pair in fleet — set review.required: false to waive");
     }

package/dist/config/config.d.ts

@@ -174,6 +174,7 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
         adapter: z.ZodString;
         model: z.ZodString;
         stallMinutes: z.ZodNumber;
+        prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>;
     visibility: z.ZodObject<{
         llm: z.ZodEnum<{

package/dist/config/config.js

@@ -155,7 +155,18 @@ export const TickmarkrConfigSchema = z.object({
     // v1.53 T2: prefer — ordered reviewer preference (entry grammar: adapter | adapter:model, same as
     // routing.map.prefer). Reorders diversity-eligible channels only; never widens or narrows eligibility.
     review: z.object({ complexityThreshold: z.number(), required: z.boolean(), prefer: z.array(z.string()).optional() }),
-    consult: z.object({ adapter: z.string(), model: z.string(), stallMinutes: z.number().positive() }),
+    // v1.54 T1: prefer — ranked consult seat failover. Entries MUST be adapter:model (unlike
+    // review.prefer's adapter|adapter:model grammar): a consult seat has no channel to inherit a
+    // model from, so a bare adapter is meaningless and fails config load fail-closed. The pinned
+    // adapter/model pair below stays the final fallback seat; an absent list is byte-identical.
+    consult: z.object({
+        adapter: z.string(),
+        model: z.string(),
+        stallMinutes: z.number().positive(),
+        prefer: z
+            .array(z.string().regex(/^[^:]+:.+$/, "consult.prefer entries must be adapter:model — a bare adapter has no model to run the seat with"))
+            .optional(),
+    }),
     visibility: z.object({
         llm: z.enum(["pane", "headless"]),
         keepPanes: z.enum(["run", "attempt", "forever"]),
@@ -479,7 +490,11 @@ export function configTemplate(overlay) {
 # review: { complexityThreshold: 7, required: true, prefer: [codex:gpt-5.6-sol, kimi] }
 #                         # prefer: ordered reviewer seat preference (adapter | adapter:model); ranks
 #                         # diversity-eligible channels only — never admits a same-vendor/same-model reviewer
-# consult: { adapter: claude-code, model: fable, stallMinutes: 15 }
+# consult: { adapter: claude-code, model: fable, stallMinutes: 15, prefer: [codex:gpt-5.6-sol, kimi:kimi-code/k3] }
+#                         # prefer: ranked consult seat failover — entries are adapter:model ONLY (a
+#                         # consult seat has no channel to inherit a model from). The seat walks the
+#                         # list to the first live adapter; a failed seat or unparseable verdict falls
+#                         # to the next entry; the pinned adapter/model above is always the final seat
 # cost:                   # v1.20 REC-02 — OPTIONAL price table for the usage/cost report. Absent ⇒ every
 #                         # channel reports "not measurable" (never a crash or a fake $0). Two economics,
 #                         # never conflated: API = tokens × per-Mtok rate; sub = flat plan amortized over a

package/dist/run/consult.d.ts

@@ -28,4 +28,7 @@ export declare function consult(d: Dossier, cfg: TickmarkrConfig, adapters: Work
     keep?: boolean;
     onSlot?: (slot: Slot) => void;
     runId?: string;
+    channels?: Array<{
+        adapter: string;
+    }>;
 }): Promise<ConsultVerdict>;

package/dist/run/consult.js

@@ -92,6 +92,8 @@ let consultSeq = 0;
 export async function consult(d, cfg, adapters, driver, cwd, runDir, 
 // T2 ownership contract: runId names the consult pane canonically (tickmarkr:consult:<task>:0:<runId>)
 // via SlotOpts.owned; without it the legacy gatePaneName shape survives (non-daemon callers/tests).
+// v1.54 T1: channels — the daemon's doctor-filtered live channel list; prefer-seat liveness is
+// judged against it only (never rebuilt from config, which would select installed-but-unauthed seats).
 opts = {}) {
     const n = ++consultSeq;
     const nonce = generateVerdictNonce();
@@ -99,54 +101,82 @@ opts = {}) {
     mkdirSync(dir, { recursive: true });
     const promptFile = join(dir, `${d.taskId}-${n}.md`);
     writeFileSync(promptFile, buildDossierPrompt(d, nonce));
-    const adapter = getAdapter(cfg.consult.adapter, adapters);
-    let out;
-    if (cfg.visibility.llm === "headless") {
-        const r = await sh(adapter.headlessCommand(promptFile, cfg.consult.model), cwd, cfg.consult.stallMinutes * 60_000);
-        out = r.stdout + r.stderr;
-        out = augmentFakeVerdictOutput(adapter, out, nonce);
-    }
-    else {
-        // T8: role-first pane name for fleet visibility (consult · T2); consultSeq stays on the dossier artifact only
-        const slot = await driver.slot(cwd, gatePaneName("consult", d.taskId), {
-            label: `CONSULT ${d.taskId}`,
-            ...(opts.runId ? { owned: { role: "consult", taskId: d.taskId, attempt: 0, runId: opts.runId } } : {}),
-        });
-        opts.onSlot?.(slot);
-        const scriptPath = join(dir, `${d.taskId}-${n}.sh`);
-        // OBS-50: visible consult panes get the brand banner; headless path above stays banner-free (machine-parsed stdout)
-        writeFileSync(scriptPath, [
-            "export BASH_SILENCE_DEPRECATION_WARNING=1",
-            bannerShell(),
-            adapter.headlessCommand(promptFile, cfg.consult.model),
-            gateExitTrailer(nonce),
-        ].join("\n"));
-        await driver.run(slot, paneDispatchCommand(scriptPath));
-        // nonce-suffixed exit only: a dossier quoting tickmarkr's own exit literal must not false-complete.
-        await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, cfg.consult.stallMinutes * 60_000, { regex: true });
-        out = await driver.read(slot, 300);
-        if (!opts.keep)
-            await driver.close(slot);
+    // One seat = the WHOLE invoke-and-parse unit, both visibility branches (OBS-69 class: a headless-only
+    // failover would leave the production pane path hard-failing on seat one). null = no parseable verdict.
+    const invokeSeat = async (seatAdapter, seatModel, seatIdx) => {
+        const adapter = getAdapter(seatAdapter, adapters);
+        let out;
+        if (cfg.visibility.llm === "headless") {
+            const r = await sh(adapter.headlessCommand(promptFile, seatModel), cwd, cfg.consult.stallMinutes * 60_000);
+            out = r.stdout + r.stderr;
+        }
+        else {
+            // T8: role-first pane name for fleet visibility (consult · T2); consultSeq stays on the dossier artifact only
+            const slot = await driver.slot(cwd, gatePaneName("consult", d.taskId), {
+                label: `CONSULT ${d.taskId}`,
+                ...(opts.runId ? { owned: { role: "consult", taskId: d.taskId, attempt: 0, runId: opts.runId } } : {}),
+            });
+            opts.onSlot?.(slot);
+            const scriptPath = join(dir, `${d.taskId}-${n}${seatIdx > 0 ? `-s${seatIdx}` : ""}.sh`);
+            // OBS-50: visible consult panes get the brand banner; headless path above stays banner-free (machine-parsed stdout)
+            writeFileSync(scriptPath, [
+                "export BASH_SILENCE_DEPRECATION_WARNING=1",
+                bannerShell(),
+                adapter.headlessCommand(promptFile, seatModel),
+                gateExitTrailer(nonce),
+            ].join("\n"));
+            try {
+                await driver.run(slot, paneDispatchCommand(scriptPath));
+                // nonce-suffixed exit only: a dossier quoting tickmarkr's own exit literal must not false-complete.
+                await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, cfg.consult.stallMinutes * 60_000, { regex: true });
+                out = await driver.read(slot, 300);
+            }
+            finally {
+                // a failed seat must not leak its pane before the next seat opens under the same name
+                if (!opts.keep)
+                    await driver.close(slot);
+            }
+        }
         out = augmentFakeVerdictOutput(adapter, out, nonce);
-    }
-    const v = extractVerdictJson(out, nonce);
-    if (!v || !ACTIONS.includes(v.action)) {
-        return { action: "human", notes: "consult verdict unparseable — failing safe to human" };
-    }
-    // fail-closed exclusion: only a non-empty string survives. Malformed values (number/array/object/
-    // empty) are dropped — the verdict stays a normal channel-level reroute/retry/…, never a crash
-    // and never silently forced to human. Unknown adapter ids pass through; the daemon treats a
-    // zero-match expansion as channel-level reroute.
-    const raw = v.excludeAdapter;
-    const excludeAdapter = typeof raw === "string" && raw.length > 0 ? raw : undefined;
-    const reason = typeof v.reason === "string" ? v.reason : undefined;
-    const guidance = typeof v.guidance === "string" ? v.guidance : undefined;
-    const notes = String(v.notes ?? guidance ?? reason ?? "");
-    return {
-        action: v.action,
-        notes,
-        ...(reason ? { reason } : {}),
-        ...(guidance ? { guidance } : {}),
-        ...(excludeAdapter ? { excludeAdapter } : {}),
+        const v = extractVerdictJson(out, nonce);
+        if (!v || !ACTIONS.includes(v.action))
+            return null;
+        // fail-closed exclusion: only a non-empty string survives. Malformed values (number/array/object/
+        // empty) are dropped — the verdict stays a normal channel-level reroute/retry/…, never a crash
+        // and never silently forced to human. Unknown adapter ids pass through; the daemon treats a
+        // zero-match expansion as channel-level reroute.
+        const raw = v.excludeAdapter;
+        const excludeAdapter = typeof raw === "string" && raw.length > 0 ? raw : undefined;
+        const reason = typeof v.reason === "string" ? v.reason : undefined;
+        const guidance = typeof v.guidance === "string" ? v.guidance : undefined;
+        const notes = String(v.notes ?? guidance ?? reason ?? "");
+        return {
+            action: v.action,
+            notes,
+            ...(reason ? { reason } : {}),
+            ...(guidance ? { guidance } : {}),
+            ...(excludeAdapter ? { excludeAdapter } : {}),
+        };
     };
+    // v1.54 T1: ranked seat failover. Walk consult.prefer (adapter:model entries) to the first entry
+    // whose adapter is in the live channel set; a failed seat or unparseable verdict falls to the next;
+    // the pinned consult.adapter/model is always the final seat. No channels provided (non-daemon
+    // callers) ⇒ empty live set ⇒ pin only, byte-identical to pre-v1.54 behavior. Failover changes
+    // only WHICH seat answers — per-seat parsing and the fail-safe human action below are untouched.
+    const live = new Set((opts.channels ?? []).map((c) => c.adapter));
+    const seats = (cfg.consult.prefer ?? [])
+        .map((entry) => ({ adapter: entry.slice(0, entry.indexOf(":")), model: entry.slice(entry.indexOf(":") + 1) }))
+        .filter((s) => live.has(s.adapter));
+    seats.push({ adapter: cfg.consult.adapter, model: cfg.consult.model });
+    for (const [i, seat] of seats.entries()) {
+        try {
+            const v = await invokeSeat(seat.adapter, seat.model, i);
+            if (v)
+                return v;
+        }
+        catch {
+            // failed seat (unknown adapter, dead driver/pane, shell error) — fall to the next entry
+        }
+    }
+    return { action: "human", notes: "consult verdict unparseable — failing safe to human" };
 }

package/dist/run/daemon.d.ts

@@ -13,6 +13,7 @@ export interface RunOptions {
     globalDir?: string;
     mode?: RoutingMode;
     narrate?: (event: JournalEvent) => void;
+    exit?: (code: number) => void;
 }
 export type ModeSource = "run flag" | "spec" | "repo config" | "global config" | "default";
 export interface ResolvedRunMode {

package/dist/run/daemon.js

@@ -106,6 +106,9 @@ export async function runDaemon(repoRoot, opts = {}) {
     // subprocess, so the optional-chain open below is a no-op there). Cosmetic-only: any failure is
     // swallowed (never affects the run); the operator closes a surviving watch pane.
     const lock = acquireRunLock(repoRoot, runId);
+    // v1.54 T2: declared before the try so the finally can always deregister (a throw before
+    // registration leaves it undefined — the guard below covers that path).
+    let onTermination;
     try {
         let graph = loadGraph(repoRoot);
         // v1.51 T2: the routing mode resolves BEFORE any routing input is built — run flag > spec front-matter
@@ -120,6 +123,67 @@ export async function runDaemon(repoRoot, opts = {}) {
         // No preview — the daemon honors routing.learned:off and gets undefined; this snapshot is immutable
         // for the run, so this run's own telemetry never feeds back into its own routing.
         const profile = loadRoutingProfile(repoRoot, cfg);
+        // v1.54 T2 (OBS-71): signal reaper — a killed daemon closes its own panes and releases the lock.
+        // Every slot this run opens stays in liveSlots until closed: the worker path opens through
+        // trackedDriver below, and gates/consults receive trackedDriver as THEIR driver, so their pane
+        // opens/closes keep the ledger exact. Termination then closes exactly what is still live — and a
+        // slot closed once (task-done, quota reroute, gate self-clean) can never be closed twice.
+        const liveSlots = new Set();
+        const closeSlot = async (s) => {
+            if (!liveSlots.delete(s))
+                return; // already closed — never twice
+            await driver.close(s);
+        };
+        const trackedDriver = {
+            id: driver.id,
+            interactive: driver.interactive,
+            slot: async (cwd, name, o) => { const s = await driver.slot(cwd, name, o); liveSlots.add(s); return s; },
+            run: (s, cmd) => driver.run(s, cmd),
+            waitOutput: (s, p, ms, o) => driver.waitOutput(s, p, ms, o),
+            waitAgentStatus: (s, st, ms) => driver.waitAgentStatus(s, st, ms),
+            status: (s) => driver.status(s),
+            read: (s, n) => driver.read(s, n),
+            ...(driver.sendKey ? { sendKey: driver.sendKey.bind(driver) } : {}),
+            notify: (m, o) => driver.notify(m, o),
+            close: closeSlot,
+            worktree: (r, b, base) => driver.worktree(r, b, base),
+        };
+        // Termination (SIGINT/SIGTERM): close every live slot, reconcile owned panes against an EMPTY
+        // desired set (herdr panes not in memory; panesToClose spares foreign names, watch panes, and
+        // other runs' panes by construction), release the run lock, then exit. Journal-silent by design —
+        // no run-end/interrupted event, so stop-amend-resume keeps resuming. keepPanes:"forever" (the
+        // keep-everything debug override) preserves panes but still releases the lock and exits.
+        let termSignal;
+        let abortRun = () => { };
+        const aborted = new Promise((_, reject) => { abortRun = reject; });
+        aborted.catch(() => { });
+        let reaping = false;
+        const exit = opts.exit ?? ((code) => process.exit(code));
+        onTermination = (sig) => {
+            termSignal = sig;
+            void (async () => {
+                if (!reaping) {
+                    reaping = true;
+                    if (cfg.visibility.keepPanes !== "forever") {
+                        for (const s of liveSlots) { // closeSlot only deletes the element being visited — safe during Set iteration
+                            try {
+                                await closeSlot(s);
+                            }
+                            catch { /* cosmetic — reconcile is the backstop */ }
+                        }
+                        try {
+                            await driver.reconcile?.(new Set(), runId);
+                        }
+                        catch { /* cosmetic — visibility is never a gate */ }
+                    }
+                    releaseRunLock(repoRoot); // the process dies at exit() below — the finally never runs on this path
+                }
+                abortRun(new Error(`terminated by ${sig}`));
+                exit(sig === "SIGINT" ? 130 : 143);
+            })();
+        };
+        process.on("SIGINT", onTermination);
+        process.on("SIGTERM", onTermination);
         const journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
         const branchEvent = opts.resume
             ? [...journal.read()].reverse().find((e) => (e.event === "run-start" || e.event === "run-end" || e.event === "merge") && typeof e.data.branch === "string")
@@ -346,9 +410,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     journalTail: JSON.stringify(journal.read().slice(-20)),
                     transcript: transcript.slice(-8000),
                     diff: diffOrFeedback, gates,
-                }, cfg, adapters, driver, repoRoot, journal.dir, 
+                }, cfg, adapters, trackedDriver, repoRoot, journal.dir, 
                 // D-07: consult panes self-clean when the verdict is read (keepLlm) — only "forever" keeps them.
-                { keep: keepLlm, onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined, runId });
+                // v1.54 T1: channels = this run's doctor-filtered live list — consult.prefer seat liveness
+                // is judged against it, never rebuilt from config (installed-but-unauthed seats would stall).
+                { keep: keepLlm, onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined, runId, channels });
             };
             // returns true → continue attempting, false → task is terminal (parked)
             // trigger (why the consult ran) is threaded in so the decompose/human park keeps its cause —
@@ -497,7 +563,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const adapter = getAdapter(assignment.adapter, adapters);
                 // VIS-04: workers share one role tab. T2: `owned` names the pane canonically (ownership contract);
                 // the legacy name stays the fallback for drivers without owned handling (subprocess spies).
-                const slot = await driver.slot(wt, `${t.id}-worker-${assignment.adapter}-a${attempt}-${runTag}`, { group: "workers", owned: { role: "worker", taskId: t.id, attempt, runId } });
+                const slot = await trackedDriver.slot(wt, `${t.id}-worker-${assignment.adapter}-a${attempt}-${runTag}`, { group: "workers", owned: { role: "worker", taskId: t.id, attempt, runId } });
                 const sessionId = retryMode === "resume" ? priorSession.id : slot.name;
                 const icmd = retryMode === "resume"
                     ? adapter.resumeCommand(sessionId, promptFile, assignment.model)
@@ -677,7 +743,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 if (keepOpen && (finished || driver.id !== "subprocess"))
                     keptSlots.push(slot);
                 else
-                    await driver.close(slot);
+                    await closeSlot(slot);
                 // SPEND-01: usage from the harness's own cwd-keyed structured store, read POST-HOC from disk —
                 // `wt` is this task's private worktree, so the path is unique; the read is sliced to records
                 // stamped at/after this attempt's dispatch instant. Never the harvested pane text, never the
@@ -731,7 +797,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             if (idx >= 0) {
                                 keptSlots.splice(idx, 1);
                                 try {
-                                    await driver.close(slot);
+                                    await closeSlot(slot);
                                 }
                                 catch { /* cosmetic — reconcile is the backstop */ }
                             }
@@ -810,7 +876,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         commands, baseline, channels, adapters, cfg,
                         via: cfg.visibility.llm === "pane"
                             ? {
-                                driver,
+                                driver: trackedDriver,
                                 // D-07: judge/review panes self-clean when their verdict is read (keepLlm) — only "forever" keeps them.
                                 keep: keepLlm,
                                 onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined,
@@ -862,7 +928,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             const idx = keptSlots.indexOf(slot);
                             if (idx >= 0) {
                                 keptSlots.splice(idx, 1);
-                                await driver.close(slot);
+                                await closeSlot(slot);
                             }
                         }
                         await reconcile({ spareLiveLlm: true }); // task-done is a terminal event — sweep this task's leftovers
@@ -901,6 +967,10 @@ export async function runDaemon(repoRoot, opts = {}) {
         };
         const inflight = new Map();
         while (true) {
+            // v1.54 T2: a signal that landed while nothing was racing `aborted` (empty inflight window)
+            // must still stop the run before it can dispatch more work or write run-end.
+            if (termSignal)
+                throw new Error(`terminated by ${termSignal}`);
             const ready = readyTasks(graph)
                 .filter((t) => !inflight.has(t.id))
                 .slice(0, Math.max(0, concurrency - inflight.size));
@@ -918,14 +988,14 @@ export async function runDaemon(repoRoot, opts = {}) {
             }
             if (inflight.size === 0)
                 break;
-            await Promise.race(inflight.values());
+            await Promise.race([...inflight.values(), aborted]); // aborted rejects on termination — unwinds the run
         }
         // D-07: the sweep now closes only what's LEFT in keptSlots — done-closed worker slots were removed
         // (no double-close) and self-cleaned LLM/consult panes were never added under keepLlm:false. This
         // leaves failed/parked attempts' worker slots, which keep their failure context until run end.
         if (cfg.visibility.keepPanes === "run") {
             for (const s of keptSlots)
-                await driver.close(s); // panes persist for the run's duration, then clean up
+                await closeSlot(s); // panes persist for the run's duration, then clean up
         }
         saveGraph(repoRoot, graph);
         const byStatus = (s) => graph.tasks.filter((t) => t.status === s).map((t) => t.id);
@@ -986,6 +1056,13 @@ export async function runDaemon(repoRoot, opts = {}) {
         return summary;
     }
     finally {
+        // v1.54 T2: deregister on EVERY exit (normal run end, throw, termination unwind) — the daemon
+        // test suite runs runDaemon dozens of times in one process; a leaked handler would close a
+        // later run's slots.
+        if (onTermination) {
+            process.removeListener("SIGINT", onTermination);
+            process.removeListener("SIGTERM", onTermination);
+        }
         releaseRunLock(repoRoot);
     }
 }

package/dist/run/git.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
-import { existsSync, lstatSync, readlinkSync, rmSync, symlinkSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
@@ -110,11 +110,40 @@ export async function createWorktree(repo, branch, baseRef) {
 // (real directory, wrong/broken symlink) is restored to the provisioned link. Idempotent: an
 // already-correct link is a no-op. Returns whether dest is the provisioned link: provisioning ignores
 // the result; the pre-gate caller treats false as a named environmental park, never a masked test red.
+// OBS-78: target repos typically ignore `node_modules/` — a directories-only pattern that does NOT
+// match the provisioned SYMLINK, so a worker staging with `git add -A` commits the link and burns an
+// attempt on the scope gate. Write `node_modules` (no slash: matches the link too) into the exclude
+// file git actually consults for this worktree. Per-worktree `info/` is ignored in linked worktrees
+// (gitrepository-layout redirects it), so resolve through the `.git` gitfile + `commondir` indirection
+// to the common git dir. Local git metadata only — the target repository's .gitignore is never edited.
+// Idempotent (appends only when no entry exists) and best-effort, like the link itself.
+function excludeNodeModules(dir) {
+    try {
+        let gitDir = join(dir, ".git");
+        if (lstatSync(gitDir).isFile()) { // linked worktree: .git is a gitfile naming the real git dir
+            const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync(gitDir, "utf8"));
+            if (!m)
+                return;
+            gitDir = resolve(dir, m[1]);
+        }
+        const commondir = join(gitDir, "commondir");
+        if (existsSync(commondir))
+            gitDir = resolve(gitDir, readFileSync(commondir, "utf8").trim());
+        const exclude = join(gitDir, "info", "exclude");
+        const current = existsSync(exclude) ? readFileSync(exclude, "utf8") : "";
+        if (/^node_modules$/m.test(current))
+            return; // already excluded — repeated re-asserts add nothing
+        mkdirSync(join(gitDir, "info"), { recursive: true });
+        writeFileSync(exclude, current + (current && !current.endsWith("\n") ? "\n" : "") + "node_modules\n");
+    }
+    catch { /* not a git checkout (bare tmpdir in tests) — never fail provisioning over the exclude */ }
+}
 export function linkNodeModules(repo, dir, { force = false } = {}) {
     const src = join(repo, "node_modules");
     const dest = join(dir, "node_modules");
     if (!existsSync(src))
         return true; // nothing provisioned to link — correct state is no link (OBS-27 best-effort)
+    excludeNodeModules(dir); // OBS-78: the link must never be stageable in this worktree
     try {
         if (lstatSync(dest).isSymbolicLink() && readlinkSync(dest) === src)
             return true; // already the provisioned link

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.53.0",
+  "version": "1.55.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-loop/SKILL.md

@@ -50,6 +50,10 @@ Use one of:
 
 After sending, **confirm delivery** by reading the target pane and verifying the message landed (input empty, agent status `working`, or notification acknowledged). Never report "briefed" or "relayed" without read-back confirmation.
 
+## Dedicated consultant tab rule
+
+When spawning consultants (agents gathering synthesis input for decisions like SCOPER analysis or architectural reviews), create them in a DEDICATED tab separate from the ORCHESTRATOR tab. This ensures that when the orchestrator stands down, the consultant panes persist and their assessments remain available for review and reference.
+
 ## Stand-down (mission end and retirement)
 
 - **Orchestrator, on terminal state** (green, failed, or parked), after the record commit and operator notification: stop every monitor and background task you started, print one final stand-down line, and leave NOTHING queued in your input box. A finished session with an armed watcher or pre-filled input is a loaded gun — a retired v1.40 orchestrator sat idle with "merge … tag, publish" unsent in its input; one stray Enter would have shipped a duplicate release.