tickmarkr 1.60.0 → 1.62.0

package/README.md

@@ -160,9 +160,9 @@ Nothing is written until you confirm; pressing Enter through every step leaves c
 Step 5/6 uses an arrow-driven candidate picker ranked by the production router; step 3 may ask
 for a benchmark-provenance note when you classify a new model.
 
-Routing-mode semantics, pin/prefer/floor precedence, review and consult steering syntax,
+Routing-mode semantics, pin/floor/prefer precedence, review and consult steering syntax,
 provenance rules, and `--quality` / `--mode` flags are documented in
-**[FLEET.md](FLEET.md)** (advanced reference).
+**[FLEET.md](https://github.com/alzahrani-khalid/tickmarkr/blob/main/FLEET.md)** (advanced reference).
 
 ## Steering
 
@@ -170,7 +170,7 @@ Fleet step 6/6 sets `review.prefer` and `consult.prefer`; routing modes (`risk-b
 `partner-led`, `staff-led`) are chosen in step 4/6. Full grammar — including when review
 prefer may name a **bare adapter** versus `adapter:model`, and why consult prefer entries
 require **`adapter:model`** form — plus `tickmarkr run --supersedes` rerun control, is in
-**[FLEET.md](FLEET.md)**.
+**[FLEET.md](https://github.com/alzahrani-khalid/tickmarkr/blob/main/FLEET.md)**.
 
 ## Model scoping and auth detection
 
@@ -366,7 +366,7 @@ accepted contributions are credited via `Co-authored-by:` on the release commit.
 
 ## Documentation
 
-- **[FLEET.md](FLEET.md)** — routing modes, steering syntax, tier provenance, and run flags (advanced reference)
+- **[FLEET.md](https://github.com/alzahrani-khalid/tickmarkr/blob/main/FLEET.md)** — routing modes, steering syntax, tier provenance, and run flags (advanced reference)
 - **[LICENSE](LICENSE)** — MIT license
 - **[CONTRIBUTING.md](CONTRIBUTING.md)** — development setup and contribution guidelines
 - **[SECURITY.md](SECURITY.md)** — security policy and private vulnerability reporting

package/dist/cli/commands/status.js

@@ -67,6 +67,11 @@ const failedSuffix = (states) => {
     const f = failedGates(states);
     return f.length ? ` · ${f.join(", ")}` : "";
 };
+// a designed human gate parks the task BEFORE any gate result exists (daemon.ts execTask), so the
+// awaited approval is named from task state alone — never from gate results. Failed gates win the
+// cell when present: a post-approval park is not awaiting the designed gate. Plain text for column
+// math; rendered with a dim dot + warn words. TTY-only — the non-TTY surface stays byte-pinned.
+const humanGateSuffix = (t, st, states) => st === "human" && t.humanGate && failedGates(states).length === 0 ? " · awaiting approval" : "";
 const shortGoal = (goal, max) => {
     const clause = goal.split(/[,;.?!]/, 1)[0].trim();
     if (clause.length <= max)
@@ -203,7 +208,7 @@ const renderFrame = (cwd) => {
     const gatesLegend = legend(`   gates: ${GATE_NAMES.join(" · ")}`);
     const taskVerdict = (st) => st === "done" ? "pass" : st === "failed" ? "fail" : st === "human" ? "warn" : "neutral";
     const idW = Math.max(...cells.map((c) => c.t.id.length), 2);
-    const stW = Math.max(...cells.map((c) => (String(c.st) + c.label + failedSuffix(c.states)).length));
+    const stW = Math.max(...cells.map((c) => (String(c.st) + c.label + failedSuffix(c.states) + humanGateSuffix(c.t, c.st, c.states)).length));
     const chainW = gateChainWidth(true);
     const assignW = Math.max(...cells.map((c) => c.assignCol.length));
     const goalW = Math.max(8, width - (5 + idW) - 2 - chainW - 2 - stW - 2 - assignW);
@@ -212,10 +217,12 @@ const renderFrame = (cwd) => {
         const stWord = st === "done" ? ok(String(st)) : st === "failed" ? fail(String(st)) : st === "human" ? warn(String(st)) : String(st);
         // a fail names its gate in words right here — the one moment gate identity is needed on a row
         const f = failedGates(states);
+        const human = humanGateSuffix(t, st, states);
         const statusCell = stWord +
             (label ? (label === " starved" ? fail(label) : dim(label)) : "") +
             (f.length ? dim(" · ") + fail(f.join(", ")) : "") +
-            " ".repeat(stW - (String(st) + label + failedSuffix(states)).length);
+            (human ? dim(" · ") + warn("awaiting approval") : "") +
+            " ".repeat(stW - (String(st) + label + failedSuffix(states) + human).length);
         return `  ${statusRow(taskVerdict(st), `${t.id.padEnd(idW)} ${goal}  ${gateChain(states, true)}  ${statusCell}  ${dim(assignCol)}`)}`;
     });
     return [header, hr, gatesLegend, ...rows].join("\n");

package/dist/compile/native.d.ts

@@ -1,4 +1,5 @@
 import { type RunGraph } from "../graph/schema.js";
+export declare const COLLECTABLE_TESTS = "tests/**/*.test.ts";
 export declare const LEGACY_PREFIX: string;
 export declare const TICKMARKR_NATIVE_MARKER: RegExp;
 export declare const NATIVE_MARKER: RegExp;

package/dist/compile/native.js

@@ -1,6 +1,9 @@
 import { existsSync, readFileSync } from "node:fs";
+import picomatch from "picomatch";
 import { GATE_NAMES, GRAPH_ROUTING_MODES, ORACLES, SHAPES, TIERS, validateGraph } from "../graph/schema.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
+// OBS-97: mirror of the vitest.config.ts suite include — the only path class vitest collects.
+export const COLLECTABLE_TESTS = "tests/**/*.test.ts";
 export const LEGACY_PREFIX = ["dro", "vr"].join("");
 export const TICKMARKR_NATIVE_MARKER = /^<!--\s*tickmarkr:spec(?:\s+v1)?\s*-->\s*$/m;
 export const NATIVE_MARKER = new RegExp(`^<!--\\s*(?:tickmarkr|${LEGACY_PREFIX}):spec(?:\\s+v1)?\\s*-->\\s*$`, "m");
@@ -115,7 +118,101 @@ export function compileNative(file) {
         throw new CompileError(`acceptance criteria are required on every task. Missing on: ${missing.join(", ")}.\n` +
             `Add to each section in ${file}:\n- acceptance:\n  - <observable outcome>`);
     }
-    const csv = (value) => (value && value.toLowerCase() !== "none" ? value.split(",").map((item) => item.trim()).filter(Boolean) : []);
+    // v1.62 (OBS-97): commas inside {a,b} alternatives are part of one glob entry, not separators —
+    // split only at brace depth 0 so a brace glob reaches the lint (and the scope gate) intact.
+    const splitTop = (value) => {
+        const parts = [];
+        let depth = 0;
+        let current = "";
+        for (const ch of value) {
+            if (ch === "," && depth === 0) {
+                parts.push(current);
+                current = "";
+                continue;
+            }
+            if (ch === "{")
+                depth++;
+            else if (ch === "}" && depth > 0)
+                depth--;
+            current += ch;
+        }
+        return [...parts, current];
+    };
+    const csv = (value) => (value && value.toLowerCase() !== "none" ? splitTop(value).map((item) => item.trim()).filter(Boolean) : []);
+    // OBS-97: a typed test: oracle needs a collectable home. vitest only collects COLLECTABLE_TESTS
+    // paths, so a task whose non-empty files[] cannot host one makes scope-green and acceptance-green
+    // mutually exclusive by construction — run-20260719-210434 burned two dispatch attempts before a
+    // consult diagnosed exactly this. Empty files[] stays exempt: no file scope means unrestricted
+    // (src/gates/scope.ts). An entry hosts a collectable path iff its glob can produce one — probed by
+    // substituting each wildcard run with a test-shaped segment (also covers literal test-file paths);
+    // v1.62 extends the probe to {a,b} brace alternatives and ? single-character wildcards.
+    const collectable = picomatch(COLLECTABLE_TESTS, { dot: true });
+    // Single-token substitution is not a true glob-overlap test (tests/**/*.ts needs "probe.test",
+    // a bare ** needs the whole collectable path) — probe with several test-shaped tokens and accept
+    // if ANY candidate satisfies both globs. Scopes that truly cannot host one still fail every probe.
+    const PROBE_TOKENS = ["probe.test.ts", "probe.test", "tests/probe.test.ts"];
+    // v1.62: {a,b} alternatives expand to concrete branches before probing (innermost group first, so
+    // nesting resolves); an unbalanced brace is literal to picomatch and stays unexpanded. Expansion is
+    // BOUNDED: past BRANCH_CAP branches, further alternatives are dropped — dropping candidates can only
+    // reject, never accept (every accept needs a concrete witness), so the cap stays fail-closed while a
+    // pathological {a,b}{a,b}… entry can no longer balloon compile time.
+    const BRANCH_CAP = 64;
+    const expandBraces = (glob) => {
+        let branches = [glob];
+        for (;;) {
+            let changed = false;
+            const next = [];
+            for (const branch of branches) {
+                const inner = branch.match(/\{([^{}]*)\}/);
+                if (!inner) {
+                    next.push(branch);
+                    continue;
+                }
+                changed = true;
+                for (const alt of inner[1].split(","))
+                    next.push(branch.replace(inner[0], alt));
+            }
+            branches = next.slice(0, BRANCH_CAP);
+            if (!changed)
+                return branches;
+        }
+    };
+    // v1.62: a ? never blocks self-match (it matches any one char), so hosting hinges on the probe
+    // clearing the collectable literals — search ? positions over that alphabet PER POSITION (a mixed
+    // scope like test?/unit.tes?.ts needs different chars at each ?). Every accepted probe is a concrete
+    // path satisfying BOTH globs (a witness), so expansion and substitution can only lift false
+    // rejections — a scope with no witness still fails every probe. Bounded: entries with more than
+    // QMARK_CAP ?s stay fail-closed (4^4 = 256 candidates is the ceiling per probe).
+    const QMARK_CHARS = ["t", "e", "s", "."];
+    const QMARK_CAP = 4;
+    const qmarkVariants = (probe) => {
+        const qCount = (probe.match(/\?/g) ?? []).length;
+        if (qCount === 0 || qCount > QMARK_CAP)
+            return [probe];
+        let variants = [probe];
+        for (let i = 0; i < qCount; i++) {
+            variants = variants.flatMap((v) => QMARK_CHARS.map((ch) => v.replace("?", ch)));
+        }
+        return [probe, ...variants];
+    };
+    const canHostTest = (entry) => {
+        const self = picomatch(entry, { dot: true });
+        return expandBraces(entry)
+            .flatMap((branch) => PROBE_TOKENS.map((token) => branch.replace(/\*+/g, token)))
+            .flatMap(qmarkVariants)
+            .some((probe) => self(probe) && collectable(probe));
+    };
+    const homeless = drafts
+        .filter((draft) => {
+        const files = csv(draft.fields.files);
+        return files.length > 0 && !files.some(canHostTest)
+            && draft.acceptance.some((item) => typeof item !== "string" && item.oracle === "test");
+    })
+        .map((draft) => draft.id);
+    if (homeless.length) {
+        throw new CompileError(`OBS-97: task${homeless.length === 1 ? "" : "s"} ${homeless.join(", ")} carr${homeless.length === 1 ? "ies" : "y"} a test: acceptance oracle but files[] cannot host a vitest-collectable test path (${COLLECTABLE_TESTS}).\n` +
+            `Add a ${COLLECTABLE_TESTS} entry to files[] in ${file}, or replace the test: oracle with command:/judge:.`);
+    }
     const tasks = drafts.map((draft) => {
         const { fields } = draft;
         const shape = fields.shape ?? inferShape(draft.title);

package/dist/config/config.d.ts

@@ -235,8 +235,8 @@ export type InitConfigOverlay = {
     };
 };
 export declare function configTemplate(overlay?: InitConfigOverlay): string;
-/** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
-export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
+export { FLEET_OVERLAY_KEYS, fleetEditableEquals, fleetRepoOverlayFromDelta, harvestFleetProvenance, repoOverlayYaml, serializeFleetOverlay, unifiedYamlDiff, } from "./fleet-overlay.js";
+export type { FleetDenyNotes, HarvestedProvenance } from "./fleet-overlay.js";
 export type FleetTierAssignment = {
     tier: Tier;
     provenance?: string;
@@ -259,28 +259,3 @@ export declare function fleetKeyLayer(repoRoot: string, dotted: string, opts?: {
 export declare function formatFleetPrint(repoRoot: string, opts?: {
     globalDir?: string;
 }): string;
-/** Trailing `# note` comments on per-entry lines an operator may have hand-written or a prior
- *  fleet write stamped: model tier lines (including null tombstones) and deny list items. */
-export type HarvestedProvenance = {
-    tiers: Record<string, Record<string, string>>;
-    denyAdapters: Record<string, string>;
-    denyModels: Record<string, string>;
-};
-/** OBS-88: harvest existing provenance comments from raw repo-overlay bytes at fleet-session
- *  load. yaml.parse discards comments, so before this every fleet write re-serialized the file
- *  knowing only the current session's own notes and silently stripped all prior ones — a typed
- *  benchmark-provenance note survived exactly one write. Fail-open to empty: an unreadable
- *  overlay is the loader's problem to reject, never the harvester's. */
-export declare function harvestFleetProvenance(overlayText: string): HarvestedProvenance;
-/** Harvested deny-entry notes keyed by the exact entry string, re-attached at serialize time. */
-export type FleetDenyNotes = {
-    adapters?: Record<string, string>;
-    models?: Record<string, string>;
-};
-/** Build the repo overlay fragment fleet would write for edits since session start. */
-export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>): Record<string, unknown>;
-export declare function repoOverlayYaml(overlay: Record<string, unknown>, provenance?: Record<string, Record<string, string>>, denyNotes?: FleetDenyNotes): string;
-export declare function serializeFleetOverlay(overlay: Record<string, unknown>, provenance?: Record<string, Record<string, string>>, denyNotes?: FleetDenyNotes): string;
-export declare function unifiedYamlDiff(before: string, after: string, label?: string): string;
-export declare function fleetEditableEquals(a: FleetEditable, b: FleetEditable): boolean;
-export {};

package/dist/config/config.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { isMap, isScalar, isSeq, parse, parseDocument, stringify } from "yaml";
+import { parse, stringify } from "yaml";
 import { z } from "zod";
 import { stateDirName } from "../graph/graph.js";
 import { SHAPES, TIERS } from "../graph/schema.js";
@@ -533,8 +533,9 @@ export function configTemplate(overlay) {
     const nl = base.indexOf("\n");
     return `${base.slice(0, nl + 1)}${lines.join("\n")}\n${base.slice(nl + 1)}`;
 }
-/** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
-export const FLEET_OVERLAY_KEYS = ["routing", "tiers"];
+// v1.61 seed 8: the fleet-overlay provenance cluster (harvesting, serialization, diff rendering)
+// moved to fleet-overlay.ts as a pure move — re-exported here so prior import paths keep working.
+export { FLEET_OVERLAY_KEYS, fleetEditableEquals, fleetRepoOverlayFromDelta, harvestFleetProvenance, repoOverlayYaml, serializeFleetOverlay, unifiedYamlDiff, } from "./fleet-overlay.js";
 export function repoOverlayPath(repoRoot) {
     return join(repoRoot, stateDirName(repoRoot), "config.yaml");
 }
@@ -565,14 +566,6 @@ export function fleetEditableFromConfig(cfg, provenance = {}) {
         floors: { ...cfg.routing.floors },
     };
 }
-function fleetSubset(obj) {
-    const out = {};
-    for (const k of FLEET_OVERLAY_KEYS) {
-        if (obj[k] !== undefined)
-            out[k] = obj[k];
-    }
-    return out;
-}
 /** Resolve which layer last set a dotted fleet path (defaults < global < repo). */
 export function fleetKeyLayer(repoRoot, dotted, opts = {}) {
     const gdir = opts.globalDir ?? globalConfigDir();
@@ -650,238 +643,3 @@ export function formatFleetPrint(repoRoot, opts = {}) {
     }
     return `${lines.join("\n")}\n`;
 }
-function sortedUnique(xs) {
-    return [...new Set(xs)].sort();
-}
-/** OBS-88: harvest existing provenance comments from raw repo-overlay bytes at fleet-session
- *  load. yaml.parse discards comments, so before this every fleet write re-serialized the file
- *  knowing only the current session's own notes and silently stripped all prior ones — a typed
- *  benchmark-provenance note survived exactly one write. Fail-open to empty: an unreadable
- *  overlay is the loader's problem to reject, never the harvester's. */
-export function harvestFleetProvenance(overlayText) {
-    const out = { tiers: {}, denyAdapters: {}, denyModels: {} };
-    if (!overlayText.trim())
-        return out;
-    const doc = parseDocument(overlayText);
-    const note = (n) => {
-        const c = isScalar(n) ? n.comment : undefined;
-        return typeof c === "string" && c.trim() ? c.trim() : undefined;
-    };
-    const tiers = doc.getIn(["tiers"]);
-    if (isMap(tiers)) {
-        for (const ap of tiers.items) {
-            if (!isScalar(ap.key))
-                continue;
-            const models = isMap(ap.value) ? ap.value.get("models") : undefined;
-            if (!isMap(models))
-                continue;
-            for (const mp of models.items) {
-                const n = note(mp.value);
-                if (isScalar(mp.key) && n)
-                    (out.tiers[String(ap.key.value)] ??= {})[String(mp.key.value)] = n;
-            }
-        }
-    }
-    for (const [key, dest] of [["adapters", out.denyAdapters], ["models", out.denyModels]]) {
-        const seq = doc.getIn(["routing", "deny", key]);
-        if (!isSeq(seq))
-            continue;
-        for (const item of seq.items) {
-            const n = note(item);
-            if (isScalar(item) && n)
-                dest[String(item.value)] = n;
-        }
-    }
-    return out;
-}
-/** Build the repo overlay fragment fleet would write for edits since session start. */
-export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}) {
-    if (fleetEditableEquals(initial, edited))
-        return {};
-    const out = structuredClone(existingRepo);
-    const routing = { ...out.routing };
-    let routingTouched = false;
-    const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
-        || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
-    if (denyChanged) {
-        routing.deny = {
-            adapters: edited.denyAdapters.length ? edited.denyAdapters : null,
-            models: edited.denyModels.length ? edited.denyModels : null,
-        };
-        routingTouched = true;
-    }
-    const mapDelta = {};
-    for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
-        if (JSON.stringify(initial.map[shape]) !== JSON.stringify(edited.map[shape]))
-            mapDelta[shape] = edited.map[shape];
-    }
-    if (Object.keys(mapDelta).length) {
-        routing.map = { ...routing.map, ...mapDelta };
-        routingTouched = true;
-    }
-    const floorDelta = {};
-    for (const shape of new Set([...Object.keys(initial.floors), ...Object.keys(edited.floors)])) {
-        if (initial.floors[shape] !== edited.floors[shape])
-            floorDelta[shape] = edited.floors[shape];
-    }
-    if (Object.keys(floorDelta).length) {
-        routing.floors = { ...routing.floors, ...floorDelta };
-        routingTouched = true;
-    }
-    if (routingTouched)
-        out.routing = routing;
-    const tiersOut = {
-        ...out.tiers,
-    };
-    let tiersTouched = false;
-    const adapters = new Set([...Object.keys(initial.tiers), ...Object.keys(edited.tiers)]);
-    for (const adapter of adapters) {
-        const models = new Set([
-            ...Object.keys(initial.tiers[adapter] ?? {}),
-            ...Object.keys(edited.tiers[adapter] ?? {}),
-        ]);
-        const modelDelta = {};
-        for (const model of models) {
-            const a = initial.tiers[adapter]?.[model];
-            const b = edited.tiers[adapter]?.[model];
-            if (JSON.stringify(a) !== JSON.stringify(b)) {
-                modelDelta[model] = b === null || b === undefined ? null : b.tier;
-            }
-        }
-        if (Object.keys(modelDelta).length) {
-            // spread the existing entry so vendor/channel/windows survive the rewrite — dropping them
-            // makes the overlay unloadable for any adapter without a default seed (reload-guard class)
-            tiersOut[adapter] = { ...tiersOut[adapter], models: { ...tiersOut[adapter]?.models, ...modelDelta } };
-            tiersTouched = true;
-        }
-    }
-    if (tiersTouched)
-        out.tiers = tiersOut;
-    return out;
-}
-export function repoOverlayYaml(overlay, provenance = {}, denyNotes = {}) {
-    if (!Object.keys(overlay).length)
-        return "";
-    const fleet = fleetSubset(overlay);
-    const fleetBody = serializeFleetOverlay(fleet, provenance, denyNotes);
-    const rest = { ...overlay };
-    for (const k of FLEET_OVERLAY_KEYS)
-        delete rest[k];
-    if (!Object.keys(rest).length)
-        return fleetBody;
-    const head = stringify(rest).trimEnd();
-    return fleetBody ? `${head}\n${fleetBody}` : `${head}\n`;
-}
-export function serializeFleetOverlay(overlay, provenance = {}, denyNotes = {}) {
-    if (!Object.keys(overlay).length)
-        return "";
-    const lines = [];
-    // OBS-75: never glue stringify() output onto a key line — wrap the key into the object and
-    // re-indent the whole emitted block, so sequences/nested maps nest correctly and null
-    // tombstones/empty collections survive the serialize→parse round-trip.
-    const block = (obj, pad) => stringify(obj).trimEnd().split("\n").map((l) => `${pad}${l}`);
-    // deny lists emit item-by-item through the same stringify quoting rules as block(), so a
-    // harvested `# reason` can re-attach to its exact entry (multi-line emissions never take one)
-    const denySeq = (key, v) => {
-        if (v === undefined)
-            return [];
-        if (v === null || !v.length)
-            return block({ [key]: v }, "    ");
-        const out = [`    ${key}:`];
-        for (const item of v) {
-            const emitted = stringify([item]).trimEnd().split("\n");
-            const n = denyNotes[key]?.[item];
-            if (n && emitted.length === 1)
-                emitted[0] += `  # ${n}`;
-            out.push(...emitted.map((l) => `      ${l}`));
-        }
-        return out;
-    };
-    const routing = overlay.routing;
-    if (routing) {
-        lines.push("routing:");
-        const deny = routing.deny;
-        if (deny && (deny.adapters !== undefined || deny.models !== undefined)) {
-            lines.push("  deny:");
-            lines.push(...denySeq("adapters", deny.adapters));
-            lines.push(...denySeq("models", deny.models));
-        }
-        if (routing.map)
-            lines.push(...block({ map: routing.map }, "  "));
-        if (routing.floors)
-            lines.push(...block({ floors: routing.floors }, "  "));
-    }
-    const tiers = overlay.tiers;
-    if (tiers && Object.keys(tiers).length) {
-        lines.push("tiers:");
-        for (const [adapter, entry] of Object.entries(tiers)) {
-            const body = [];
-            if (entry.vendor)
-                body.push(`    vendor: ${entry.vendor}`);
-            if (entry.channel)
-                body.push(`    channel: ${entry.channel}`);
-            if (entry.windows)
-                body.push(...block({ windows: entry.windows }, "    "));
-            const models = Object.entries(entry.models ?? {});
-            if (models.length) {
-                body.push("    models:");
-                for (const [model, tier] of models) {
-                    // OBS-88: notes serialize verbatim (fresh session notes arrive pre-stamped with their
-                    // "— fleet <date>" suffix), so a harvested note round-trips byte-for-byte every write
-                    const note = provenance[adapter]?.[model];
-                    const suffix = note ? `  # ${note}` : "";
-                    body.push(`      ${model}: ${tier === null ? "null" : tier}${suffix}`);
-                }
-            }
-            else if (entry.models) {
-                body.push("    models: {}"); // present-but-empty: explicit {} — a childless header parses as null and the loader rejects it
-            }
-            // a bare `adapter:` line parses as a null tombstone and would DELETE the adapter's default seeds on merge
-            if (body.length)
-                lines.push(`  ${adapter}:`, ...body);
-            else
-                lines.push(`  ${adapter}: {}`);
-        }
-    }
-    return `${lines.join("\n")}\n`;
-}
-export function unifiedYamlDiff(before, after, label = "config overlay") {
-    if (before === after)
-        return "";
-    const a = before.split("\n");
-    const b = after.split("\n");
-    // v1.60 T3: shortest-edit (LCS) matching. The old scan resynced greedily on the first mismatched
-    // line, so one inserted line could cascade into a whole-file remove/re-add hunk on the one
-    // confirmation surface an operator reviews before a write.
-    // ponytail: O(n·m) table — overlays are tens of lines; Myers O(nd) if files ever grow.
-    const lcs = Array.from({ length: a.length + 1 }, () => Array.from({ length: b.length + 1 }, () => 0));
-    for (let i = a.length - 1; i >= 0; i--) {
-        for (let j = b.length - 1; j >= 0; j--) {
-            lcs[i][j] = a[i] === b[j] ? lcs[i + 1][j + 1] + 1 : Math.max(lcs[i + 1][j], lcs[i][j + 1]);
-        }
-    }
-    const header = [`--- ${label} (current)`, `+++ ${label} (proposed)`];
-    const hunks = [];
-    let i = 0;
-    let j = 0;
-    while (i < a.length || j < b.length) {
-        if (i < a.length && j < b.length && a[i] === b[j]) {
-            i++;
-            j++;
-            continue;
-        }
-        const del = [];
-        const add = [];
-        while ((i < a.length || j < b.length) && !(i < a.length && j < b.length && a[i] === b[j])) {
-            if (j >= b.length || (i < a.length && lcs[i + 1][j] >= lcs[i][j + 1]))
-                del.push(`-${a[i++]}`);
-            else
-                add.push(`+${b[j++]}`);
-        }
-        hunks.push("@@", ...del, ...add);
-    }
-    return `${header.join("\n")}\n${hunks.join("\n")}\n`;
-}
-export function fleetEditableEquals(a, b) {
-    return JSON.stringify(a) === JSON.stringify(b);
-}

package/dist/config/fleet-overlay.d.ts

@@ -0,0 +1,27 @@
+import type { FleetEditable } from "./config.js";
+/** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
+export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
+/** Trailing `# note` comments on per-entry lines an operator may have hand-written or a prior
+ *  fleet write stamped: model tier lines (including null tombstones) and deny list items. */
+export type HarvestedProvenance = {
+    tiers: Record<string, Record<string, string>>;
+    denyAdapters: Record<string, string>;
+    denyModels: Record<string, string>;
+};
+/** OBS-88: harvest existing provenance comments from raw repo-overlay bytes at fleet-session
+ *  load. yaml.parse discards comments, so before this every fleet write re-serialized the file
+ *  knowing only the current session's own notes and silently stripped all prior ones — a typed
+ *  benchmark-provenance note survived exactly one write. Fail-open to empty: an unreadable
+ *  overlay is the loader's problem to reject, never the harvester's. */
+export declare function harvestFleetProvenance(overlayText: string): HarvestedProvenance;
+/** Harvested deny-entry notes keyed by the exact entry string, re-attached at serialize time. */
+export type FleetDenyNotes = {
+    adapters?: Record<string, string>;
+    models?: Record<string, string>;
+};
+/** Build the repo overlay fragment fleet would write for edits since session start. */
+export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>): Record<string, unknown>;
+export declare function repoOverlayYaml(overlay: Record<string, unknown>, provenance?: Record<string, Record<string, string>>, denyNotes?: FleetDenyNotes): string;
+export declare function serializeFleetOverlay(overlay: Record<string, unknown>, provenance?: Record<string, Record<string, string>>, denyNotes?: FleetDenyNotes): string;
+export declare function unifiedYamlDiff(before: string, after: string, label?: string): string;
+export declare function fleetEditableEquals(a: FleetEditable, b: FleetEditable): boolean;

package/dist/config/fleet-overlay.js

@@ -0,0 +1,249 @@
+// Fleet-overlay provenance cluster (v1.61 seed 8): harvesting, serialization, and diff rendering
+// for the `tickmarkr fleet` write path. Pure move out of config.ts — prior import paths preserved
+// via re-exports there.
+import { isMap, isScalar, isSeq, parseDocument, stringify } from "yaml";
+/** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
+export const FLEET_OVERLAY_KEYS = ["routing", "tiers"];
+function fleetSubset(obj) {
+    const out = {};
+    for (const k of FLEET_OVERLAY_KEYS) {
+        if (obj[k] !== undefined)
+            out[k] = obj[k];
+    }
+    return out;
+}
+function sortedUnique(xs) {
+    return [...new Set(xs)].sort();
+}
+/** OBS-88: harvest existing provenance comments from raw repo-overlay bytes at fleet-session
+ *  load. yaml.parse discards comments, so before this every fleet write re-serialized the file
+ *  knowing only the current session's own notes and silently stripped all prior ones — a typed
+ *  benchmark-provenance note survived exactly one write. Fail-open to empty: an unreadable
+ *  overlay is the loader's problem to reject, never the harvester's. */
+export function harvestFleetProvenance(overlayText) {
+    const out = { tiers: {}, denyAdapters: {}, denyModels: {} };
+    if (!overlayText.trim())
+        return out;
+    const doc = parseDocument(overlayText);
+    const note = (n) => {
+        const c = isScalar(n) ? n.comment : undefined;
+        return typeof c === "string" && c.trim() ? c.trim() : undefined;
+    };
+    const tiers = doc.getIn(["tiers"]);
+    if (isMap(tiers)) {
+        for (const ap of tiers.items) {
+            if (!isScalar(ap.key))
+                continue;
+            const models = isMap(ap.value) ? ap.value.get("models") : undefined;
+            if (!isMap(models))
+                continue;
+            for (const mp of models.items) {
+                const n = note(mp.value);
+                if (isScalar(mp.key) && n)
+                    (out.tiers[String(ap.key.value)] ??= {})[String(mp.key.value)] = n;
+            }
+        }
+    }
+    for (const [key, dest] of [["adapters", out.denyAdapters], ["models", out.denyModels]]) {
+        const seq = doc.getIn(["routing", "deny", key]);
+        if (!isSeq(seq))
+            continue;
+        for (const item of seq.items) {
+            const n = note(item);
+            if (isScalar(item) && n)
+                dest[String(item.value)] = n;
+        }
+    }
+    return out;
+}
+/** Build the repo overlay fragment fleet would write for edits since session start. */
+export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}) {
+    if (fleetEditableEquals(initial, edited))
+        return {};
+    const out = structuredClone(existingRepo);
+    const routing = { ...out.routing };
+    let routingTouched = false;
+    const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
+        || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
+    if (denyChanged) {
+        routing.deny = {
+            adapters: edited.denyAdapters.length ? edited.denyAdapters : null,
+            models: edited.denyModels.length ? edited.denyModels : null,
+        };
+        routingTouched = true;
+    }
+    const mapDelta = {};
+    for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
+        if (JSON.stringify(initial.map[shape]) !== JSON.stringify(edited.map[shape]))
+            mapDelta[shape] = edited.map[shape];
+    }
+    if (Object.keys(mapDelta).length) {
+        routing.map = { ...routing.map, ...mapDelta };
+        routingTouched = true;
+    }
+    const floorDelta = {};
+    for (const shape of new Set([...Object.keys(initial.floors), ...Object.keys(edited.floors)])) {
+        if (initial.floors[shape] !== edited.floors[shape])
+            floorDelta[shape] = edited.floors[shape];
+    }
+    if (Object.keys(floorDelta).length) {
+        routing.floors = { ...routing.floors, ...floorDelta };
+        routingTouched = true;
+    }
+    if (routingTouched)
+        out.routing = routing;
+    const tiersOut = {
+        ...out.tiers,
+    };
+    let tiersTouched = false;
+    const adapters = new Set([...Object.keys(initial.tiers), ...Object.keys(edited.tiers)]);
+    for (const adapter of adapters) {
+        const models = new Set([
+            ...Object.keys(initial.tiers[adapter] ?? {}),
+            ...Object.keys(edited.tiers[adapter] ?? {}),
+        ]);
+        const modelDelta = {};
+        for (const model of models) {
+            const a = initial.tiers[adapter]?.[model];
+            const b = edited.tiers[adapter]?.[model];
+            if (JSON.stringify(a) !== JSON.stringify(b)) {
+                modelDelta[model] = b === null || b === undefined ? null : b.tier;
+            }
+        }
+        if (Object.keys(modelDelta).length) {
+            // spread the existing entry so vendor/channel/windows survive the rewrite — dropping them
+            // makes the overlay unloadable for any adapter without a default seed (reload-guard class)
+            tiersOut[adapter] = { ...tiersOut[adapter], models: { ...tiersOut[adapter]?.models, ...modelDelta } };
+            tiersTouched = true;
+        }
+    }
+    if (tiersTouched)
+        out.tiers = tiersOut;
+    return out;
+}
+export function repoOverlayYaml(overlay, provenance = {}, denyNotes = {}) {
+    if (!Object.keys(overlay).length)
+        return "";
+    const fleet = fleetSubset(overlay);
+    const fleetBody = serializeFleetOverlay(fleet, provenance, denyNotes);
+    const rest = { ...overlay };
+    for (const k of FLEET_OVERLAY_KEYS)
+        delete rest[k];
+    if (!Object.keys(rest).length)
+        return fleetBody;
+    const head = stringify(rest).trimEnd();
+    return fleetBody ? `${head}\n${fleetBody}` : `${head}\n`;
+}
+export function serializeFleetOverlay(overlay, provenance = {}, denyNotes = {}) {
+    if (!Object.keys(overlay).length)
+        return "";
+    const lines = [];
+    // OBS-75: never glue stringify() output onto a key line — wrap the key into the object and
+    // re-indent the whole emitted block, so sequences/nested maps nest correctly and null
+    // tombstones/empty collections survive the serialize→parse round-trip.
+    const block = (obj, pad) => stringify(obj).trimEnd().split("\n").map((l) => `${pad}${l}`);
+    // deny lists emit item-by-item through the same stringify quoting rules as block(), so a
+    // harvested `# reason` can re-attach to its exact entry (multi-line emissions never take one)
+    const denySeq = (key, v) => {
+        if (v === undefined)
+            return [];
+        if (v === null || !v.length)
+            return block({ [key]: v }, "    ");
+        const out = [`    ${key}:`];
+        for (const item of v) {
+            const emitted = stringify([item]).trimEnd().split("\n");
+            const n = denyNotes[key]?.[item];
+            if (n && emitted.length === 1)
+                emitted[0] += `  # ${n}`;
+            out.push(...emitted.map((l) => `      ${l}`));
+        }
+        return out;
+    };
+    const routing = overlay.routing;
+    if (routing) {
+        lines.push("routing:");
+        const deny = routing.deny;
+        if (deny && (deny.adapters !== undefined || deny.models !== undefined)) {
+            lines.push("  deny:");
+            lines.push(...denySeq("adapters", deny.adapters));
+            lines.push(...denySeq("models", deny.models));
+        }
+        if (routing.map)
+            lines.push(...block({ map: routing.map }, "  "));
+        if (routing.floors)
+            lines.push(...block({ floors: routing.floors }, "  "));
+    }
+    const tiers = overlay.tiers;
+    if (tiers && Object.keys(tiers).length) {
+        lines.push("tiers:");
+        for (const [adapter, entry] of Object.entries(tiers)) {
+            const body = [];
+            if (entry.vendor)
+                body.push(`    vendor: ${entry.vendor}`);
+            if (entry.channel)
+                body.push(`    channel: ${entry.channel}`);
+            if (entry.windows)
+                body.push(...block({ windows: entry.windows }, "    "));
+            const models = Object.entries(entry.models ?? {});
+            if (models.length) {
+                body.push("    models:");
+                for (const [model, tier] of models) {
+                    // OBS-88: notes serialize verbatim (fresh session notes arrive pre-stamped with their
+                    // "— fleet <date>" suffix), so a harvested note round-trips byte-for-byte every write
+                    const note = provenance[adapter]?.[model];
+                    const suffix = note ? `  # ${note}` : "";
+                    body.push(`      ${model}: ${tier === null ? "null" : tier}${suffix}`);
+                }
+            }
+            else if (entry.models) {
+                body.push("    models: {}"); // present-but-empty: explicit {} — a childless header parses as null and the loader rejects it
+            }
+            // a bare `adapter:` line parses as a null tombstone and would DELETE the adapter's default seeds on merge
+            if (body.length)
+                lines.push(`  ${adapter}:`, ...body);
+            else
+                lines.push(`  ${adapter}: {}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function unifiedYamlDiff(before, after, label = "config overlay") {
+    if (before === after)
+        return "";
+    const a = before.split("\n");
+    const b = after.split("\n");
+    // v1.60 T3: shortest-edit (LCS) matching. The old scan resynced greedily on the first mismatched
+    // line, so one inserted line could cascade into a whole-file remove/re-add hunk on the one
+    // confirmation surface an operator reviews before a write.
+    // ponytail: O(n·m) table — overlays are tens of lines; Myers O(nd) if files ever grow.
+    const lcs = Array.from({ length: a.length + 1 }, () => Array.from({ length: b.length + 1 }, () => 0));
+    for (let i = a.length - 1; i >= 0; i--) {
+        for (let j = b.length - 1; j >= 0; j--) {
+            lcs[i][j] = a[i] === b[j] ? lcs[i + 1][j + 1] + 1 : Math.max(lcs[i + 1][j], lcs[i][j + 1]);
+        }
+    }
+    const header = [`--- ${label} (current)`, `+++ ${label} (proposed)`];
+    const hunks = [];
+    let i = 0;
+    let j = 0;
+    while (i < a.length || j < b.length) {
+        if (i < a.length && j < b.length && a[i] === b[j]) {
+            i++;
+            j++;
+            continue;
+        }
+        const del = [];
+        const add = [];
+        while ((i < a.length || j < b.length) && !(i < a.length && j < b.length && a[i] === b[j])) {
+            if (j >= b.length || (i < a.length && lcs[i + 1][j] >= lcs[i][j + 1]))
+                del.push(`-${a[i++]}`);
+            else
+                add.push(`+${b[j++]}`);
+        }
+        hunks.push("@@", ...del, ...add);
+    }
+    return `${header.join("\n")}\n${hunks.join("\n")}\n`;
+}
+export function fleetEditableEquals(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}

package/dist/drivers/herdr.d.ts

@@ -1,6 +1,7 @@
 import { type ExecutorDriver, type NotifyOpts, type Slot, type SlotOpts } from "./types.js";
 export declare const TRAILER_SAFE_FLOOR_COLS = 108;
 export declare const TRAILER_WIDTH_MARGIN = 2;
+export declare const DELIVERY_ATTEMPTS = 3;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export declare function workerSplitDirection(paneCols: number | null, safeFloor?: number, margin?: number): "right" | "down";
 export declare class HerdrDriver implements ExecutorDriver {

package/dist/drivers/herdr.js

@@ -6,6 +6,10 @@ import { canonicalizeLegacyName, formatOwnedName, panesToClose, parseOwnedName }
 // VIS-09 P43-03: adopted safety floor from 43-MEASUREMENT.md (narrowest safe 53 → floor 108).
 export const TRAILER_SAFE_FLOOR_COLS = 108;
 export const TRAILER_WIDTH_MARGIN = 2; // cols below (floor + margin) refuse a rightward first split
+// OBS-85 verified delivery: bounded type→read-back→enter attempts before failing closed.
+export const DELIVERY_ATTEMPTS = 3;
+const DELIVERY_VERIFY_TIMEOUT_MS = 2000; // per attempt — a paste that hasn't rendered in 2s is retyped
+const DELIVERY_READ_LINES = 80;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export function workerSplitDirection(paneCols, safeFloor = TRAILER_SAFE_FLOOR_COLS, margin = TRAILER_WIDTH_MARGIN) {
     if (paneCols == null || paneCols <= 0)
@@ -273,11 +277,41 @@ export class HerdrDriver {
         await this.renameGroupTab(entry);
         return { id: pane, name, cwd, tabId: entry.tabId, group };
     }
+    // OBS-85 verified delivery: a pane paste can interleave a long dispatch line with itself (codex
+    // `$(git rev-parse…)` mashed into its trailing printf — v1.58 T2 attempts 2-4, v1.61 T10). Never
+    // the atomic `pane run` (text+Enter in one request, uninspectable between the two): type WITHOUT
+    // enter, read the pane back — `wait output --match` checks the same unwrapped transcript pane
+    // read exposes, event-driven so wrap and render timing can't race the check — and press Enter
+    // only when that read-back contains the typed command. A corrupted paste is captured (pane read),
+    // cleared (C-u), and retyped, bounded; persistent corruption fails closed WITH the captured
+    // transcript — the dispatch-time pincer the ledger asks for, not post-hoc `git:` archaeology.
     async run(slot, cmd) {
         const pane = await this.paneId(slot);
-        const r = await this.herdr(`pane run ${shq(pane)} ${shq(cmd)}`, slot.cwd);
-        if (r.code !== 0)
-            throw new Error(`herdr pane run failed: ${r.stderr || r.stdout}`);
+        let transcript = "";
+        for (let attempt = 0; attempt < DELIVERY_ATTEMPTS; attempt++) {
+            if (attempt > 0) {
+                // clear the corrupted input line before retyping; a failed clear must NOT be retyped onto —
+                // corrupt-prefix + clean-retype would concatenate and false-verify by containment
+                const cleared = await this.herdr(`pane send-keys ${shq(pane)} C-u`, slot.cwd);
+                if (cleared.code !== 0)
+                    throw new Error(`herdr delivery clear failed — refusing to retype onto a corrupted line (OBS-85); pane transcript:\n${transcript}`);
+            }
+            const typed = await this.herdr(`pane send-text ${shq(pane)} ${shq(cmd)}`, slot.cwd);
+            if (typed.code !== 0)
+                throw new Error(`herdr pane send-text failed: ${typed.stderr || typed.stdout}`);
+            const back = await this.herdr(`wait output ${shq(pane)} --match ${shq(cmd)} --timeout ${DELIVERY_VERIFY_TIMEOUT_MS}`, slot.cwd, DELIVERY_VERIFY_TIMEOUT_MS + 15_000);
+            // ponytail: transcript containment (scrollback included); anchor to the prompt line if a
+            // prior echo of the same command ever false-verifies. Dead pane → error envelope → unverified.
+            if (this.waitOk(back.code, back.stdout)) {
+                const enter = await this.herdr(`pane send-keys ${shq(pane)} Enter`, slot.cwd);
+                if (enter.code !== 0)
+                    throw new Error(`herdr pane send-keys Enter failed: ${enter.stderr || enter.stdout}`);
+                return;
+            }
+            // capture the corrupted delivery BEFORE clearing it — the OBS-85 byte-level evidence
+            transcript = (await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${DELIVERY_READ_LINES}`, slot.cwd)).stdout;
+        }
+        throw new Error(`herdr delivery corrupted after ${DELIVERY_ATTEMPTS} attempts — enter never pressed (OBS-85); pane transcript:\n${transcript}`);
     }
     waitOk(code, stdout) {
         if (code !== 0 || !stdout.trim())

package/dist/run/daemon.js

@@ -7,7 +7,7 @@ import { stringify } from "yaml";
 import { trailerPattern, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, discoverChannels, getAdapter, probeAll, readDoctor } from "../adapters/registry.js";
 import { addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
-import { bannerShell } from "../brand.js";
+import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
 import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
@@ -575,6 +575,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                     journal.append("worker-mode-fallback", t.id, { reason: driver.interactive ? "adapter" : "driver" });
                 }
                 const interactive = icmd !== null;
+                // OBS-85 (v1.62 T1): both dispatch branches deliver ONE short script invocation — banner,
+                // adapter command, and nonce exit marker live in a per-attempt script beside the prompt
+                // artifact (the same paneDispatchCommand pattern judge/review/consult dispatches use). The
+                // delivered pane line carries no command substitution and no trailing shell text, so paste
+                // timing can never interleave a `$(…)` with what follows it (the codex corruption class).
+                const workerCmd = interactive ? icmd : adapter.invoke(t, wt, assignment, { promptFile }).command;
+                const dispatchScript = promptFile.replace(/\.md$/, ".sh");
+                writeFileSync(dispatchScript, [
+                    "export BASH_SILENCE_DEPRECATION_WARNING=1",
+                    bannerShell(),
+                    workerCmd,
+                    exitMarkerCmd,
+                ].join("\n"));
                 // SPEND-01: this attempt's dispatch wall-clock — the usage collect cursor. Captured once here, the
                 // single site, so a test can reason about it; keep Date.now() out of profile.ts (still pure) and
                 // out of adapter module scope (the cursor is a parameter, threaded from the daemon).
@@ -617,9 +630,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 if (interactive) {
                     // v1.2 interactive: the TUI doesn't exit on completion — the trailer is the finish line.
                     // The exit wrapper still fires if the TUI dies (crash/quit): fast-fail instead of burning the timeout.
-                    // T5: the pane announces itself first — same brand header (logo + dim identity) as the
-                    // judge/review/consult dispatch scripts; one printf one-liner, dispatch mechanics unchanged.
-                    await driver.run(slot, `${bannerShell()}; ${icmd}; ${exitMarkerCmd}`);
+                    await driver.run(slot, paneDispatchCommand(dispatchScript));
                     let paged = false;
                     // v1.22 T5 / OBS-19: auto-answer a fingerprint-matched trust dialog exactly once per slot.
                     // Any other blocked/idle dialog still pages the operator (paged latch below).
@@ -708,9 +719,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                 }
                 else {
-                    const inv = adapter.invoke(t, wt, assignment, { promptFile });
-                    // T5: same brand header as the interactive path and the gate/consult dispatch scripts.
-                    await driver.run(slot, `${bannerShell()}; ${inv.command}; ${exitMarkerCmd}`);
+                    await driver.run(slot, paneDispatchCommand(dispatchScript));
                     // OBS-54: headless workers have the same output-inactivity budget as visible panes.
                     // OBS-82: same normalized-snapshot compare as the interactive site — spinner-only repaints
                     // exhaust the budget here too; harvest below still reads the raw pane.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.60.0",
+  "version": "1.62.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",