tickmarkr 1.63.0 → 1.65.0

package/dist/adapters/claude-code.js

@@ -41,6 +41,9 @@ export const claudeCode = {
     probeCwd: "neutral",
     probe: async () => probeVersion("claude"),
     channels: (cfg) => channelsFromConfig("claude-code", cfg),
+    // v1.65 T3: every flag the command builders below hardcode — doctor checks `claude --help` still
+    // lists each (all present on claude 2.x, verified 2026-07-22). Advisory only, never routing.
+    hardcodedFlags: { binary: "claude", flags: ["-p", "--model", "--permission-mode", "--strict-mcp-config", "--mcp-config", "--output-format", "-r"] },
     // --strict-mcp-config --mcp-config '{"mcpServers":{}}': pin the MCP surface to empty so fresh-worktree
     // workers/gates don't load project .mcp.json servers (herdr scrapes dialogs as idle — v1.4 incident,
     // memory tickmarkr-worker-mcp-dialog-stall). Live-verified 2026-07-10 on claude 2.1.205 (operator check):

package/dist/adapters/codex.js

@@ -169,6 +169,9 @@ export const codex = {
     probeConcurrency: 1,
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
+    // v1.65 T3: every flag the command builders below hardcode (incl. codexMcpSuppressionFlags' -c/
+    // --disable and GITDIR_WRITABLE's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
+    hardcodedFlags: { binary: "codex", flags: ["--sandbox", "--model", "-a", "-s", "-c", "--disable"] },
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
     // MCP suppression built per dispatch (config can change between runs) — see codexMcpSuppressionFlags.
     headlessCommand: (promptFile, model) => `codex exec --sandbox workspace-write ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,

package/dist/adapters/cursor-agent.js

@@ -36,6 +36,8 @@ export const cursorAgent = {
     vendor: "cursor",
     probe: async () => probeVersion("cursor-agent"),
     channels: (cfg) => channelsFromConfig("cursor-agent", cfg),
+    // v1.65 T3: every flag the command builders below hardcode — verified in `cursor-agent --help` 2026-07-22.
+    hardcodedFlags: { binary: "cursor-agent", flags: ["-p", "--model", "--force", "--output-format"] },
     headlessCommand: (promptFile, model) => `cursor-agent -p "$(cat ${shq(promptFile)})" --model ${shq(model)} --force --output-format text`,
     // NO --trust here: cursor rejects it outside --print ("--trust can only be used with --print/headless
     // mode", exit 1 — v1.4 phase-1 incident). Fresh worktrees therefore show the trust dialog; v1.22 T5

package/dist/adapters/grok.js

@@ -98,6 +98,8 @@ export const grok = {
             : { ...h, authed: false, note: "no valid ~/.grok/auth.json entry (grok login to fix)" };
     },
     channels: (cfg) => channelsFromConfig("grok", cfg),
+    // v1.65 T3: every flag the command builders below hardcode — verified in `grok --help` 2026-07-22.
+    hardcodedFlags: { binary: "grok", flags: ["-p", "--model", "--permission-mode", "--output-format"] },
     // GROK-02 headless. --output-format plain is the default but pin it explicitly; live-verified
     // 2026-07-11 (40-RESEARCH F-3): trailer intact + unwrapped, exit 0. "$(cat file)" matches every
     // other adapter and is already quoting-proven. --permission-mode bypassPermissions is the

package/dist/adapters/kimi.js

@@ -96,6 +96,9 @@ export const kimi = {
             : { ...h, authed: false, note: "no valid ~/.kimi-code/credentials/kimi-code.json (kimi login to fix)" };
     },
     channels: (cfg) => channelsFromConfig("kimi", cfg),
+    // v1.65 T3: every flag the command builders below hardcode (-S is resumeCommand's) — verified in
+    // `kimi --help` 2026-07-22.
+    hardcodedFlags: { binary: "kimi", flags: ["-p", "--model", "--output-format", "-S"] },
     // KIMI-02 headless. -p prompt mode + explicit model, NO permission flag: kimi 0.26.0 rejects
     // -p combined with -y/--auto at argument parse time ("Cannot combine --prompt with --yolo",
     // OBS-67 — doctor probes all failed on it), and prompt mode is already non-interactive with

package/dist/adapters/opencode.js

@@ -19,6 +19,9 @@ export const opencode = {
     probeCwd: "neutral",
     probe: async () => probeVersion("opencode"),
     channels: (cfg) => channelsFromConfig("opencode", cfg),
+    // v1.65 T3: every flag the command builders below hardcode (-m on run, --prompt on the TUI) —
+    // per the 2026-07-10 live verification, opencode 1.17.15.
+    hardcodedFlags: { binary: "opencode", flags: ["-m", "--prompt"] },
     headlessCommand: (promptFile, model) => `opencode run -m ${shq(model)} "$(cat ${shq(promptFile)})"`,
     interactiveCommand: (promptFile, model) => `opencode -m ${shq(model)} --prompt "$(cat ${shq(promptFile)})"`,
     invoke(task, _cwd, a, ctx) {

package/dist/adapters/pi.js

@@ -48,6 +48,8 @@ export const pi = {
         return { ...h, servable: parsePiModels(r.stdout || ""), note: "auth verified via pi --list-models (free; auth-filtered by pi)" };
     },
     channels: (cfg) => channelsFromConfig("pi", cfg),
+    // v1.65 T3: every flag the command builders below hardcode — verified in `pi --help` 2026-07-22.
+    hardcodedFlags: { binary: "pi", flags: ["-p", "--approve", "--model"] },
     // --approve: pi's per-directory trust prompt would stall fresh worktrees (herdr scrapes the dialog
     // as idle — cursor/claude incident class, milestone PITFALLS #2). Global option, legal in BOTH modes
     // per pi --help v0.80.3 (2026-07-10) — NOT print-only like cursor's --trust. Chosen over the more

package/dist/adapters/prompt.d.ts

@@ -3,4 +3,8 @@ import type { WorkerResult } from "./types.js";
 export declare function buildTaskPrompt(task: Task, feedback?: string, nonce?: string): string;
 export declare function writePrompt(dir: string, task: Task, attempt: number, feedback?: string, nonce?: string): string;
 export declare function trailerPattern(nonce: string): string;
+export declare const NO_TRAILER_SUMMARY = "worker produced no TICKMARKR_RESULT trailer";
+export declare const UNPARSEABLE_TRAILER_SUMMARY = "unparseable TICKMARKR_RESULT trailer";
 export declare function parseWorkerResult(raw: string, nonce: string): WorkerResult;
+export type DeadChannelReason = "auth-required" | "setup-required" | "provider-outage" | "timeout";
+export declare function classifyDeadChannel(result: WorkerResult): DeadChannelReason | undefined;

package/dist/adapters/prompt.js

@@ -41,11 +41,15 @@ function trailerTokenPositions(raw, nonce) {
         positions.push(i);
     return positions;
 }
+// v1.65 T1: the parse boundary's own no-trailer sentinel summaries. classifyDeadChannel keys on
+// these — a result carrying any other summary is a PARSED trailer, i.e. the worker speaking.
+export const NO_TRAILER_SUMMARY = "worker produced no TICKMARKR_RESULT trailer";
+export const UNPARSEABLE_TRAILER_SUMMARY = "unparseable TICKMARKR_RESULT trailer";
 export function parseWorkerResult(raw, nonce) {
     const fail = (summary) => ({ ok: false, summary, deviations: [], raw });
     const positions = trailerTokenPositions(raw, nonce);
     if (positions.length === 0)
-        return fail("worker produced no TICKMARKR_RESULT trailer");
+        return fail(NO_TRAILER_SUMMARY);
     // TUIs echo the prompt template, redraw lines, and HARD-wrap the JSON with per-line margins
     // (cursor does; recent-unwrapped can't rejoin hard newlines). Scan occurrences backward — last
     // parseable wins — joining wrapped lines, stripping margin/box chrome, and growing the candidate
@@ -75,5 +79,27 @@ export function parseWorkerResult(raw, nonce) {
             }
         }
     }
-    return fail("unparseable TICKMARKR_RESULT trailer");
+    return fail(UNPARSEABLE_TRAILER_SUMMARY);
+}
+// Signatures anchor distinctive CLI-error phrasing — never bare fragments or bare status-code
+// numbers (the QUOTA_RE Pitfall-3 lesson): these run only over no-trailer output, but a stalled
+// worker's harvested pane can still contain ordinary work text.
+const AUTH_RE = /not logged in|please (?:log ?in|sign in)|please run [^\n]{0,30}log ?in|authentication[ _](?:required|failed|error)|invalid (?:api key|credentials)|api key (?:is )?(?:not set|missing|invalid|required)|credentials? (?:have )?expired|401 unauthorized/i;
+const SETUP_RE = /command not found|not recognized as an internal or external command|spawn \S+ ENOENT|missing required config|workspace trust (?:required|not granted)/i;
+const OUTAGE_RE = /unable to reach the model provider|cannot reach the model provider|model provider.{0,40}(?:unavailable|unreachable)|service (?:is )?temporarily unavailable|upstream connect error|overloaded_error/i;
+const TIMEOUT_RE = /\bETIMEDOUT\b|request timed out|connection timed out|deadline exceeded|timed out waiting for/i;
+export function classifyDeadChannel(result) {
+    // A parsed trailer — ok:true OR ok:false — is the worker speaking: genuine work outcomes walk
+    // the normal gate/ladder path even when their transcript mentions auth/outage/timeout text.
+    if (result.ok || (result.summary !== NO_TRAILER_SUMMARY && result.summary !== UNPARSEABLE_TRAILER_SUMMARY))
+        return undefined;
+    if (AUTH_RE.test(result.raw))
+        return "auth-required";
+    if (SETUP_RE.test(result.raw))
+        return "setup-required";
+    if (OUTAGE_RE.test(result.raw))
+        return "provider-outage";
+    if (TIMEOUT_RE.test(result.raw))
+        return "timeout";
+    return undefined;
 }

package/dist/adapters/registry.d.ts

@@ -12,6 +12,9 @@ export declare function detectCandidateClis(opts?: {
     pathEnv?: string;
 }): CandidateCliDetection[];
 export declare function formatCandidateCliRow({ binary, version }: CandidateCliDetection): string;
+export declare function probeHelpText(bin: string): string | undefined;
+export declare function missingDeclaredFlags(helpText: string, flags: string[]): string[];
+export declare function flagDriftWarnings(adapters: WorkerAdapter[], health: Record<string, AuthHealth>, helpOf?: (bin: string) => string | undefined): string[];
 export declare function allAdapters(opts?: {
     fakeScriptPath?: string;
 }): WorkerAdapter[];

package/dist/adapters/registry.js

@@ -53,6 +53,44 @@ export function formatCandidateCliRow({ binary, version }) {
     const ver = version ?? "version unknown";
     return `  ! ${binary.padEnd(14)} detected: ${ver} (no tickmarkr adapter — not routable)`;
 }
+// v1.65 T3: same guarded spawn pattern as probeCandidateVersion — bounded, error/status-checked,
+// fail-open. undefined = binary unavailable/broken ⇒ no drift verdict (the existing auth reporting
+// already names an uninstalled CLI; drift must never pile on).
+export function probeHelpText(bin) {
+    try {
+        const r = spawnSync(bin, ["--help"], { encoding: "utf8", timeout: 10000 });
+        if (r.error || r.status !== 0)
+            return undefined;
+        return `${r.stdout || ""}\n${r.stderr || ""}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+// Whole-token match only: "-p" must never count as present because "--print" contains it, and
+// "--output" must not match a listed "--output-format". Splitting on non-flag chars keeps each
+// help-listed flag intact as one token ("-p, --print <fmt>" → "-p", "--print", "fmt").
+export function missingDeclaredFlags(helpText, flags) {
+    const tokens = new Set(helpText.split(/[^A-Za-z0-9_-]+/));
+    return flags.filter((f) => !tokens.has(f));
+}
+// v1.65 T3: advisory hardcoded-flag drift check. Reads help, mutates nothing — health, doctor.json,
+// discoverChannels, and routing never see these strings; they are doctor display rows only.
+export function flagDriftWarnings(adapters, health, helpOf = probeHelpText) {
+    const out = [];
+    for (const a of adapters) {
+        const decl = a.hardcodedFlags;
+        if (!decl || !health[a.id]?.installed)
+            continue;
+        const help = helpOf(decl.binary);
+        if (help === undefined)
+            continue;
+        for (const flag of missingDeclaredFlags(help, decl.flags)) {
+            out.push(`flag drift: ${a.id} hardcodes ${flag} but ${decl.binary} --help no longer lists it (advisory — routing unchanged)`);
+        }
+    }
+    return out;
+}
 export function allAdapters(opts = {}) {
     // pi + grok + kimi appended LAST: same-tier ties resolve by discovery order (Phase 6 D2), so
     // appending keeps the Phase 6 shape→channel matrix byte-identical; inserting anywhere else

package/dist/adapters/types.d.ts

@@ -91,6 +91,10 @@ export interface WorkerAdapter {
     contextUsage?(session: SessionRef): ContextUsage | null;
     trust?(repoRoot: string): TrustVerdict;
     trustDialog?: TrustDialog;
+    hardcodedFlags?: {
+        binary: string;
+        flags: string[];
+    };
 }
 export declare function channelsFromConfig(adapterId: string, cfg: TickmarkrConfig): BillingChannel[];
 export declare function channelKey(c: {

package/dist/cli/commands/doctor.js

@@ -1,6 +1,6 @@
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { allAdapters, detectCandidateClis, probeAll, probeModels, readAutoPrefer, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
+import { allAdapters, detectCandidateClis, flagDriftWarnings, probeAll, probeModels, readAutoPrefer, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
 import { BANNER, dim, fail, kvRow, legend, ok, rule, statusRow, title } from "../../brand.js";
 import { tickmarkrDir, stateDirName } from "../../graph/graph.js";
 import { declaredModelWindow, hasWindowsConfig, modelLints, suggestOverlay, ttyVisual } from "../../adapters/model-lints.js";
@@ -85,6 +85,9 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     const servable = servableExclusions(cfg, adapters, health);
     if (servable.length)
         rows.push(attentionRow(servabilityLine(servable)));
+    // v1.65 T3: hardcoded-flag drift — advisory warn rows only. Runs AFTER writeDoctor so the verdicts
+    // can never leak into doctor.json, and discoverChannels/routing never read them.
+    rows.push(...flagDriftWarnings(adapters, health).map(attentionRow));
     // MODEL-05/06: print-only drift fragment; advisory, whole-line-commented additions, tickmarkr NEVER applies it.
     // TTY gets a one-line summary + the fragment as a file (the full dump drowned everything else,
     // v1.33.1 onboarding); machine/CI surface keeps the inline dump — layout is pinned by tests.

package/dist/cli/commands/status.js

@@ -1,6 +1,7 @@
 import { BANNER, GLYPHS, dim, fail, legend, ok, rule, statusRow, title, warn } from "../../brand.js";
-import { blockedTasks, graphDefinitionHash, loadGraph, pendingTasks } from "../../graph/graph.js";
+import { blockedTasks, graphDefinitionHash, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
+import { foldActivity } from "../../run/activity.js";
 import { Journal, engagementComparable } from "../../run/journal.js";
 // ponytail: fixed 2s refresh; promote to config.visibility.* only when an operator asks.
 const REFRESH_MS = 2000;
@@ -171,14 +172,17 @@ const renderFrame = (cwd) => {
     }
     const effective = { ...g, tasks: g.tasks.map((t) => ({ ...t, status: replayed?.get(t.id) ?? t.status })) };
     const starved = new Set(blockedTasks(effective).map((t) => t.id));
-    const waiting = new Set(pendingTasks(effective).map((t) => t.id));
+    // OBS-104: ONE activity fold feeds both surfaces — never re-derived here. Comparable events only
+    // (a recompiled graph's journal must not animate the wrong tasks); with no or stale journal the
+    // dep-waiting cells still derive from the effective graph statuses.
+    const activity = foldActivity(comparable ? events : [], effective.tasks);
     const unicode = visual();
     const divider = unicode ? " · " : " / ";
     const width = process.stdout.columns ?? 120;
     const done = effective.tasks.filter((t) => t.status === "done").length;
     const cells = g.tasks.map((t) => {
         const st = replayed?.get(t.id) ?? t.status;
-        const label = starved.has(t.id) ? " starved" : waiting.has(t.id) ? " dep-waiting" : "";
+        const label = starved.has(t.id) ? " starved" : activity.cells.has(t.id) ? ` ${activity.cells.get(t.id)}` : "";
         const channel = assignments.get(t.id) ?? "-";
         const assignCol = contexts.has(t.id) ? `${channel}${divider}ctx ${contexts.get(t.id)}` : channel;
         return { t, st, label, assignCol, states: comparable ? gateStates(t, events) : defaultGateStates(t) };
@@ -218,6 +222,10 @@ const renderFrame = (cwd) => {
             : `no runs yet${dot}`) +
         `${gauge} ${done === g.tasks.length && g.tasks.length > 0 ? ok(tally) : tally}`;
     const hr = rule(Math.min(width, 100));
+    // OBS-104 run-level now line: names the most recent journal event. TTY frame only — the non-TTY
+    // machine surface is byte-pinned (status-brand golden) and must not drift. Rendered BELOW the task
+    // rows: the line names task ids, and rows must stay the first id-bearing lines for grep consumers.
+    const nowLine = activity.now ? [legend(`   now: ${activity.now}`)] : [];
     const gatesLegend = legend(`   gates: ${GATE_NAMES.join(" · ")}`);
     const taskVerdict = (st) => st === "done" ? "pass" : st === "failed" ? "fail" : st === "human" ? "warn" : "neutral";
     const idW = Math.max(...cells.map((c) => c.t.id.length), 2);
@@ -238,7 +246,7 @@ const renderFrame = (cwd) => {
             " ".repeat(stW - (String(st) + label + failedSuffix(states) + human).length);
         return `  ${statusRow(taskVerdict(st), `${t.id.padEnd(idW)} ${goal}  ${gateChain(states, true)}  ${statusCell}  ${dim(assignCol)}`)}`;
     });
-    return [header, hr, gatesLegend, ...rows].join("\n");
+    return [header, hr, gatesLegend, ...rows, ...nowLine].join("\n");
 };
 export async function status(argv, cwd = process.cwd(), opts = {}) {
     // cockpit surface: banner + frame on a TTY (doctor's pattern); pipes get the bare frame

package/dist/config/config.js

@@ -468,7 +468,10 @@ export function configTemplate(overlay) {
 #   explore: { mode: on, excludeShapes: [], excludeComplexityAtOrAbove: null, cap: 5 }  # optional; absent ⇒ byte-identical
 #   sla: { implement: 15 }  # optional per-shape minutes — advisory plan lint only; absent ⇒ no lint
 #   allow: { adapters: [claude-code, codex] }   # optional fleet allowlist; presence activates even if empty (fail-closed)
-#   deny: { models: [codex:gpt-5.5] }           # optional fleet denylist; deny beats allow on conflict
+#   deny:                                      # optional fleet denylist; deny beats allow on conflict
+#     models:
+#       - pi:zai/glm-5.2  # OBS-57: pi passes run-start probe but hangs at finish without TICKMARKR_RESULT — remove after no-trailer demotion ships (v1.46 provider-outage taxonomy)
+#   # incident-born deny/pin entries MUST name OBS id + root cause + removal condition (see docs/codebase/CONVENTIONS.md)
 #   # entry grammar: adapter id | model id | adapter:model (entries in either list accept all three forms)
 #   # a hint pinning a denied channel FAILS at plan time (RoutingError) — never silent reroute
 #   # tombstone: deny: null in a repo overlay removes a global deny (arrays replace wholesale, never merge)

package/dist/gates/acceptance.d.ts

@@ -8,6 +8,7 @@ export interface JudgeVerdict {
         criterion: string;
         met: boolean;
         reason: string;
+        evidence: string;
     }>;
 }
 export declare function judgeCriterionId(index: number): string;

package/dist/gates/acceptance.js

@@ -4,13 +4,16 @@ import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
 import { checkDiffCap, fetchTaskDiff } from "./review.js";
-import { extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
 const JUDGE_TIMEOUT_MS = 900_000;
 const JudgeVerdictRowSchema = z.object({
     criterion: z.string(),
     met: z.boolean(),
     reason: z.string(),
+    // v1.64: a verbatim quote from the judged diff grounding the ruling — required; a verdict
+    // omitting it is malformed and fails closed like any other shape violation.
+    evidence: z.string(),
 });
 const JudgeVerdictSchema = z.object({
     pass: z.boolean(),
@@ -157,6 +160,8 @@ You are a strict acceptance judge. Decide whether the diff satisfies EVERY accep
 Judge only what the diff proves — plausible-but-wrong must fail. Do not award partial credit.
 Deterministic command/test oracles have already passed mechanically; judge ONLY the rubric items below.
 
+${COMPLETION_FAKING_CHECKLIST}
+
 ## Task ${task.id}: ${task.title}
 Goal: ${task.goal}
 
@@ -171,8 +176,9 @@ ${diff}
 ${verdictNonceLine(nonce)}
 
 Respond with ONLY this JSON (no prose before or after):
-{"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "..."}]}
+{"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "...", "evidence": "..."}]}
 Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) exactly once.
+Each criteria[].evidence MUST be a short verbatim quote copied from the diff above that grounds the ruling; a quote not found in the diff voids the whole verdict.
 `;
     const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
     const extracted = extractVerdictJson(raw, nonce);
@@ -185,6 +191,15 @@ Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) ex
             meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
     }
     const { verdict: v, inconsistencies } = checkJudgeVerdict(extracted, expectedIds);
+    // v1.64: quoted evidence must appear verbatim in `diff` — the exact string embedded in the prompt
+    // above, never the worktree or any other artifact. A quote the diff doesn't contain is a
+    // hallucinated verdict: treated as unparseable so GATE-09 retries the judge on a failover channel.
+    const fabricated = v.criteria.filter((row) => !row.evidence.trim() || !diff.includes(row.evidence));
+    if (fabricated.length) {
+        return { gate: "acceptance", pass: false,
+            details: warn + detBlock + `judge verdict quotes evidence absent from the judged diff (${fabricated.map((row) => row.criterion).join(", ")}) — treating as unparseable, failing closed`,
+            meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
+    }
     const pass = v.pass === true && inconsistencies.length === 0 && v.criteria.every((row) => row.met);
     const lines = v.criteria.map((row) => `${row.met ? "✓" : "✗"} ${row.criterion}: ${row.reason}`);
     if (!v.pass)

package/dist/gates/baseline.d.ts

@@ -1,4 +1,5 @@
 import type { TickmarkrConfig } from "../config/config.js";
+import type { AcceptanceItem } from "../graph/schema.js";
 import type { GateResult } from "./types.js";
 export interface Baseline {
     commands: Record<string, {
@@ -16,4 +17,14 @@ export interface BaselineWarning {
 export declare function fingerprint(output: string): string[];
 export declare function detectGateCommands(repoRoot: string, cfg: TickmarkrConfig): Record<string, string>;
 export declare function captureBaseline(cwd: string, commands: Record<string, string>): Promise<Baseline>;
+export interface VacuousOracleWarning {
+    kind: "vacuous-oracle";
+    taskId: string;
+    oracles: string[];
+    reason: string;
+}
+export declare function detectVacuousOracles(cwd: string, tasks: ReadonlyArray<{
+    id: string;
+    acceptance: AcceptanceItem[];
+}>): Promise<VacuousOracleWarning[]>;
 export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[]): Promise<GateResult[]>;

package/dist/gates/baseline.js

@@ -83,6 +83,32 @@ export async function captureBaseline(cwd, commands) {
     }
     return base;
 }
+// Tier A #3 (2026-07-21 repo-scan reconciliation): a command oracle that already exits 0 before any
+// work exists cannot falsify the work — surface it at baseline capture. Observational only: journaled
+// warning, never a gate input, and an oracle that fails at baseline changes nothing. Judge oracles
+// (including plain-string compat judges) are never executed; test oracles stay gate-only (they need
+// the detected runner and the worker's diff to mean anything).
+export async function detectVacuousOracles(cwd, tasks) {
+    const out = [];
+    for (const t of tasks) {
+        const vacuous = [];
+        for (const a of t.acceptance) {
+            if (typeof a !== "object" || a.oracle !== "command")
+                continue;
+            if ((await sh(a.command, cwd)).code === 0)
+                vacuous.push(a.command);
+        }
+        if (vacuous.length) {
+            out.push({
+                kind: "vacuous-oracle",
+                taskId: t.id,
+                oracles: vacuous,
+                reason: `vacuous acceptance oracle on ${t.id}: already passes before any work exists — ${vacuous.map((c) => `$ ${c}`).join("; ")}`,
+            });
+        }
+    }
+    return out;
+}
 // HYG-08 (D-01): headline the runner's own failure naming; demote the fingerprint diff to a secondary
 // section. Extracts from `raw` — the SAME cwd-stripped, per-line ANSI_RE-stripped string that was
 // fingerprinted, digits UN-normalized (Pitfall 2: normalization mangles test names, and the diff set could

package/dist/gates/llm.d.ts

@@ -1,12 +1,13 @@
 import type { WorkerAdapter } from "../adapters/types.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 export declare const GATE_PANE_SEP = " \u00B7 ";
+export declare const COMPLETION_FAKING_CHECKLIST = "## Completion-faking checklist\nHunt for these concrete completion-faking shortcuts before ruling on any criterion:\n- hardcoded-result: output or fixture hardcoded to satisfy the stated criterion instead of real logic\n- test-weakening: tests skipped, deleted, or assertions loosened until failing behavior looks green\n- vacuous-assertion: a test that cannot fail (asserts a constant, asserts its own setup, no assertion)\n- fixture-overfit: implementation narrowed to the exact test inputs rather than the described behavior\n- echo-not-implement: criterion text echoed in names, comments, or strings without the behavior itself\n- stub-left-behind: TODO, throw, or no-op stub where the real implementation should be\n- error-swallowing: catch or fallback that hides failures instead of handling them\n- self-mocking: the code under test mocked or faked so the test exercises the mock\n- check-bypass: lint, type, or CI checks disabled, relaxed, or excluded to get green\n- rename-as-work: code moved or renamed and presented as the requested change\n- scope-padding: unrelated edits padding the diff while the criterion's behavior is untouched\nWhen a criterion fails, the verdict MUST name which shortcut above it matches, or state that none does.";
 /** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
 export declare function generateVerdictNonce(): string;
 export declare function verdictNonceLine(nonce: string): string;
 export declare function extractPromptNonce(prompt: string): string | null;
 export declare function gateExitTrailer(nonce: string): string;
-export declare function augmentFakeVerdictOutput(adapter: WorkerAdapter, out: string, nonce: string): string;
+export declare function augmentFakeVerdictOutput(adapter: WorkerAdapter, out: string, nonce: string, prompt?: string): string;
 export type GatePaneRole = "judge" | "review" | "consult";
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export declare function gatePaneName(role: GatePaneRole, taskId: string, suffix?: string): string;

package/dist/gates/llm.js

@@ -6,6 +6,22 @@ import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { sh } from "../run/git.js";
 export const GATE_PANE_SEP = " · ";
+// v1.64 gate-integrity (repo-scan Tier A·1): the concrete completion-faking shortcuts every
+// judge/review verdict must hunt for. Shared verbatim by the acceptance judge and review prompts.
+export const COMPLETION_FAKING_CHECKLIST = `## Completion-faking checklist
+Hunt for these concrete completion-faking shortcuts before ruling on any criterion:
+- hardcoded-result: output or fixture hardcoded to satisfy the stated criterion instead of real logic
+- test-weakening: tests skipped, deleted, or assertions loosened until failing behavior looks green
+- vacuous-assertion: a test that cannot fail (asserts a constant, asserts its own setup, no assertion)
+- fixture-overfit: implementation narrowed to the exact test inputs rather than the described behavior
+- echo-not-implement: criterion text echoed in names, comments, or strings without the behavior itself
+- stub-left-behind: TODO, throw, or no-op stub where the real implementation should be
+- error-swallowing: catch or fallback that hides failures instead of handling them
+- self-mocking: the code under test mocked or faked so the test exercises the mock
+- check-bypass: lint, type, or CI checks disabled, relaxed, or excluded to get green
+- rename-as-work: code moved or renamed and presented as the requested change
+- scope-padding: unrelated edits padding the diff while the criterion's behavior is untouched
+When a criterion fails, the verdict MUST name which shortcut above it matches, or state that none does.`;
 /** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
 export function generateVerdictNonce() {
     return randomBytes(4).toString("hex");
@@ -19,8 +35,20 @@ export function extractPromptNonce(prompt) {
 export function gateExitTrailer(nonce) {
     return `printf '\\nTICKMARKR_''EXIT_${nonce}:%s\\n' $?`;
 }
+// v1.64: scripted fake judge verdicts predate the required per-criterion evidence field — quote the
+// first line of the prompt's own diff block into rows lacking one so zero-token fixtures keep their
+// outcomes. Rows scripting an explicit evidence value pass through verbatim (tests exercise both paths).
+function injectFakeEvidence(obj, prompt) {
+    if (!prompt.startsWith("TICKMARKR-JUDGE") || !Array.isArray(obj.criteria))
+        return obj;
+    const line = /```diff\n([\s\S]*?)```/.exec(prompt)?.[1].split("\n").find((l) => l.trim());
+    if (!line)
+        return obj;
+    const criteria = obj.criteria.map((row) => row && typeof row === "object" && !("evidence" in row) ? { ...row, evidence: line } : row);
+    return { ...obj, criteria };
+}
 // ponytail: fake adapter serves static verdict JSON without nonce; append a bound copy for zero-token tests.
-export function augmentFakeVerdictOutput(adapter, out, nonce) {
+export function augmentFakeVerdictOutput(adapter, out, nonce, prompt = "") {
     if (adapter.id !== "fake")
         return out;
     const obj = extractJson(out);
@@ -28,7 +56,7 @@ export function augmentFakeVerdictOutput(adapter, out, nonce) {
         return out;
     if (typeof obj.nonce === "string")
         return out;
-    return `${out}\n${JSON.stringify({ ...obj, nonce })}`;
+    return `${out}\n${JSON.stringify(injectFakeEvidence({ ...obj, nonce }, prompt))}`;
 }
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export function gatePaneName(role, taskId, suffix = "") {
@@ -61,7 +89,7 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
     const nonce = extractPromptNonce(prompt);
     let out = r.stdout + "\n" + r.stderr;
     if (nonce)
-        out = augmentFakeVerdictOutput(adapter, out, nonce);
+        out = augmentFakeVerdictOutput(adapter, out, nonce, prompt);
     return out;
 }
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
@@ -88,7 +116,7 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
     let out = await via.driver.read(slot, 400);
     if (!via.keep)
         await via.driver.close(slot);
-    out = augmentFakeVerdictOutput(adapter, out, nonce);
+    out = augmentFakeVerdictOutput(adapter, out, nonce, prompt);
     return out;
 }
 export function runLlm(adapter, model, prompt, cwd, via, timeoutMs = 300000) {

package/dist/gates/review.js

@@ -4,7 +4,7 @@ import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { marginalCostRank } from "../route/router.js";
-import { extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // OBS-48: cap on zero-context diff bytes (git diff -U0), not context-padded full diff — scattered
 // one-line hunks no longer trip at ~370 diff-bytes per changed line. Full diff still goes to the judge.
 const DIFF_CAP_REMEDY = "split the task, or raise gates.diffCap";
@@ -82,6 +82,8 @@ export async function reviewGate(task, worktree, baseRef, author, channels, adap
 You are a skeptical cross-vendor code reviewer. Another agent (vendor: ${author.adapter}) authored this diff.
 Look for correctness bugs, security issues, and acceptance-criteria gaps. Approve only if you would merge it.
 
+${COMPLETION_FAKING_CHECKLIST}
+
 ## Task ${task.id}: ${task.title} (complexity ${task.complexity})
 ## Acceptance criteria
 ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}

package/dist/run/activity.d.ts

@@ -0,0 +1,15 @@
+import { type JournalEvent } from "./journal.js";
+export interface ActivityTask {
+    id: string;
+    gates: readonly string[];
+    deps: readonly string[];
+    /** the surface's effective status for the task (replayed ?? graph) */
+    status: string;
+}
+export interface ActivitySnapshot {
+    /** run-level now line naming the most recent journal event; absent when there are no events */
+    now?: string;
+    /** taskId → current-activity phrase; absent = idle (terminal, or queued with met deps) */
+    cells: Map<string, string>;
+}
+export declare function foldActivity(events: JournalEvent[], tasks: readonly ActivityTask[]): ActivitySnapshot;

package/dist/run/activity.js

@@ -0,0 +1,96 @@
+import { formatJournalNarration } from "./journal.js";
+const channelOf = (assignment) => {
+    const a = assignment;
+    return typeof a?.adapter === "string" && typeof a.model === "string" ? `${a.adapter}:${a.model}` : "unknown channel";
+};
+const cellText = (st, task) => {
+    switch (st.kind) {
+        case "worker":
+            // since is the dispatch event's own ISO ts — sliced, never re-clocked (purity)
+            return `attempt ${st.attempt} in flight on ${st.channel} since ${st.since.slice(11, 19)}`;
+        case "gates": {
+            const next = task.gates.find((g) => !st.results.has(g));
+            if (next)
+                return `gate ${next} running`;
+            // every declared gate has a result: all pass ⇒ the daemon is merging; any fail ⇒ a retry decision is next
+            return [...st.results.values()].every(Boolean) ? "merging" : "retrying";
+        }
+        case "retrying":
+            return "retrying";
+        case "parked":
+            return st.note ? `parked (${st.note})` : "parked";
+    }
+};
+export function foldActivity(events, tasks) {
+    const live = new Map();
+    // a daemon (re)start or run-end means no attempt/gate is in flight — mirror reconcile.ts; parks persist
+    const clearTransient = () => {
+        // deleting the current entry mid-iteration is well-defined for Map
+        for (const [id, st] of live)
+            if (st.kind !== "parked")
+                live.delete(id);
+    };
+    for (const e of events) {
+        if (e.event === "run-start" || e.event === "run-resume" || e.event === "run-end") {
+            clearTransient();
+            continue;
+        }
+        const id = e.taskId;
+        if (!id)
+            continue;
+        switch (e.event) {
+            case "task-dispatch":
+                live.set(id, {
+                    kind: "worker",
+                    attempt: (Number.isInteger(e.data.attempt) ? e.data.attempt : 0) + 1,
+                    channel: channelOf(e.data.assignment),
+                    since: e.ts,
+                });
+                break;
+            case "worker-result":
+                // a clean trailer moves the task into gating; anything else is heading for a retry decision
+                live.set(id, e.data.ok === true && e.data.finished === true ? { kind: "gates", results: new Map() } : { kind: "retrying" });
+                break;
+            case "gate-result": {
+                const prev = live.get(id);
+                const results = prev?.kind === "gates" ? prev.results : new Map();
+                if (typeof e.data.gate === "string")
+                    results.set(e.data.gate, e.data.pass === true || e.data.skipped === true);
+                live.set(id, { kind: "gates", results });
+                break;
+            }
+            case "escalation":
+            case "consult-verdict":
+            case "quota-failover":
+            case "provider-death-requeue":
+            case "merge-conflict":
+                live.set(id, { kind: "retrying" });
+                break;
+            case "task-human":
+                live.set(id, { kind: "parked", ...(typeof e.data.kind === "string" ? { note: e.data.kind } : {}) });
+                break;
+            case "task-done":
+            case "task-failed":
+            case "task-approved":
+                live.delete(id);
+                break;
+        }
+    }
+    const status = new Map(tasks.map((t) => [t.id, t.status]));
+    const cells = new Map();
+    for (const t of tasks) {
+        const st = live.get(t.id);
+        if (st) {
+            cells.set(t.id, cellText(st, t));
+            continue;
+        }
+        if (t.status !== "pending")
+            continue;
+        // dep-waiting is reserved for genuinely unmet deps — a bare pending task gets no cell (OBS-104 fix 1)
+        const unmet = t.deps.filter((d) => status.get(d) !== "done");
+        if (unmet.length)
+            cells.set(t.id, `dep-waiting on ${unmet.join(", ")}`);
+    }
+    const last = events.at(-1);
+    return { ...(last ? { now: formatJournalNarration(last) } : {}), cells };
+}

package/dist/run/consult.js

@@ -4,6 +4,8 @@ import { getAdapter } from "../adapters/registry.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { augmentFakeVerdictOutput, extractVerdictJson, gateExitTrailer, gatePaneName, generateVerdictNonce, verdictNonceLine } from "../gates/llm.js";
 import { sh } from "./git.js";
+import { redactSecrets } from "./redact.js";
+import { filterLlmTranscript } from "./stall.js";
 const MAX_RETRY_GUIDANCE_LINES = 10;
 function guidanceParts(text) {
     return text.split(/\n+/).flatMap((line) => line.split(/(?<=[.!?])\s+/)).map((s) => s.trim()).filter(Boolean);
@@ -55,6 +57,8 @@ export function augmentRetryBrief(feedback, opts) {
     return parts.join("\n\n");
 }
 const ACTIONS = ["retry", "reroute", "decompose", "human"];
+// v1.65 T2: transcript noise (spinner repaints, CR churn, pass-run spam) is squashed at build time —
+// the filtered form is what persists to the consults/ artifact AND what the model reads; fail-open.
 export function buildDossierPrompt(d, nonce) {
     return `TICKMARKR-CONSULT
 You are a senior engineering consult for the tickmarkr orchestrator. A worker task hit trouble.
@@ -69,7 +73,7 @@ ${d.gates.map((g) => `- [${g.pass ? "pass" : "FAIL"}] ${g.gate}: ${g.details}`).
 ${d.diff || "(none)"}
 
 ## Worker transcript (tail)
-${d.transcript || "(none)"}
+${filterLlmTranscript(d.transcript) || "(none)"}
 
 ## Journal (recent events)
 ${d.journalTail}
@@ -100,7 +104,9 @@ opts = {}) {
     const dir = join(runDir, "consults");
     mkdirSync(dir, { recursive: true });
     const promptFile = join(dir, `${d.taskId}-${n}.md`);
-    writeFileSync(promptFile, buildDossierPrompt(d, nonce));
+    // T3 secret redaction: the persisted dossier artifact (transcript/diff/journal tail — also what the
+    // consult model reads) is masked at this seam; the in-memory Dossier stays untouched.
+    writeFileSync(promptFile, redactSecrets(buildDossierPrompt(d, nonce)));
     // One seat = the WHOLE invoke-and-parse unit, both visibility branches (OBS-69 class: a headless-only
     // failover would leave the production pane path hard-failing on seat one). null = no parseable verdict.
     const invokeSeat = async (seatAdapter, seatModel, seatIdx) => {

package/dist/run/daemon.js

@@ -4,14 +4,14 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { stringify } from "yaml";
-import { trailerPattern, writePrompt } from "../adapters/prompt.js";
+import { classifyDeadChannel, trailerPattern, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, discoverChannels, getAdapter, probeAll, readDoctor } from "../adapters/registry.js";
 import { addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
 import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
-import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
+import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
 import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
@@ -259,12 +259,21 @@ export async function runDaemon(repoRoot, opts = {}) {
             prior?.append("superseded", undefined, { by: runId });
             for (const warning of baseline.warnings ?? [])
                 journal.append("baseline-warning", undefined, { ...warning });
+            // Tier A #3: run each task's command-typed acceptance oracles against the pristine baseline —
+            // one that already exits 0 verifies nothing. Warning only, taskId-stamped; never a gate input.
+            for (const w of await detectVacuousOracles(repoRoot, graph.tasks))
+                journal.append("baseline-warning", w.taskId, { ...w });
         }
         // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
         // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
         // a failed-to-open or later-dead watch pane never affects the run.
+        // OBS-103: hold the returned slot — narrator() adopts an already-open watch by its owned name
+        // (a prior daemon instance's, after a stop→resume cycle), so the run-end sweep below can retire
+        // it regardless of which instance split the pane.
+        const watchName = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
+        let watchSlot;
         try {
-            await driver.narrator?.(repoRoot, "tickmarkr status --watch", runId);
+            watchSlot = await driver.narrator?.(repoRoot, "tickmarkr status --watch", runId);
         }
         catch {
             /* cosmetic-only — the run proceeds without a live surface */
@@ -293,7 +302,22 @@ export async function runDaemon(repoRoot, opts = {}) {
             if (keepForever)
                 return;
             try {
-                await driver.reconcile?.(desiredPanes(journal.read(), runId), runId, opts);
+                const desired = desiredPanes(journal.read(), runId);
+                // The watch pane is never the DRIVER sweep's candidate (panesToClose spares role "watch":
+                // herdr's watches bookkeeping lives in close(), and a raw pane-close in the sweep would
+                // leave narrator() a stale cache) — the driver always sees it as desired; its lifecycle is
+                // decided here from the fold alone.
+                await driver.reconcile?.(new Set([...desired, watchName]), runId, opts);
+                // OBS-103: when the fold retires the watch (run-end boundary), close the narrator. The
+                // decision keys on the run identity in the pane name — narrator() adopts a prior daemon
+                // instance's pane under the same owned name, so a stop→resume cycle's leftover narrator
+                // closes exactly like one this instance opened. A narrator carrying a non-canonical name
+                // (no run identity) is never this run's to sweep.
+                if (watchSlot && watchSlot.name === watchName && !desired.has(watchName)) {
+                    const w = watchSlot;
+                    watchSlot = undefined;
+                    await driver.close(w);
+                }
             }
             catch {
                 /* cosmetic — visibility is never a gate */
@@ -835,6 +859,40 @@ export async function runDaemon(repoRoot, opts = {}) {
                     await park(t, "quota exhausted on every eligible channel", "quota", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
                     return;
                 }
+                // v1.65 T1: typed dead-channel failure — the parse boundary classified this no-trailer result
+                // as auth-required / setup-required / provider-outage / timeout (classifyDeadChannel; the
+                // daemon consumes the type, never re-derives it from raw text). Same free failover as quota —
+                // no escalation-ladder step — plus run-wide exclusion via demotedChannels: unlike a quota
+                // window that may reset, a dead channel stays dead for this run (OBS-57 class). Strictly
+                // AFTER the quota check so quota behavior stays byte-identical (a quota hit returns/continues
+                // before reaching here); provider-outage lands here only once the v1.46 same-channel requeue
+                // cap above is spent, so a transient blip still recovers in place.
+                const dead = classifyDeadChannel(result);
+                if (dead) {
+                    const from = channelKey(assignment);
+                    demotedChannels.add(from); // excluded for later attempts AND later tasks in this run
+                    const next = failover("dead-channel");
+                    journal.append("dead-channel-failover", t.id, { reason: dead, from, to: next ? channelKey(next) : null });
+                    if (next) {
+                        await driver.notify(`tickmarkr ${runId}: ${t.id} dead channel (${dead}) failover`, { tier: "attention" });
+                        // OBS-17 T2 (quota parity): the superseded slot holds a dead-end, not failure context.
+                        if (!keepForever) {
+                            const idx = keptSlots.indexOf(slot);
+                            if (idx >= 0) {
+                                keptSlots.splice(idx, 1);
+                                try {
+                                    await closeSlot(slot);
+                                }
+                                catch { /* cosmetic — reconcile is the backstop */ }
+                            }
+                        }
+                        assignment = next;
+                        tried.push(channelKey(next));
+                        continue;
+                    }
+                    await park(t, `dead channel (${dead}) and no eligible channel remains`, "reroute-exhausted", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                    return;
+                }
                 if (!finished) {
                     // ROUTE-18 (OBS-04): the channel burned a window without emitting a trailer (no-trailer timeout
                     // OR trailer-less crash-exit — both finished:false). durationMs:0 marks a FACT row, not a timed

package/dist/run/journal.js

@@ -5,6 +5,7 @@ import { channelKey, TokenUsageSchema } from "../adapters/types.js";
 import { stateDirName, tickmarkrDir } from "../graph/graph.js";
 import { TIERS } from "../graph/schema.js";
 import { buildProfile } from "../route/profile.js";
+import { redactSecrets } from "./redact.js";
 export function formatJournalNarration({ event, taskId, data }) {
     const assignment = data.assignment;
     const direct = [data.summary, data.reason, data.error, data.step, data.action, data.lint, data.branch, data.from]
@@ -311,9 +312,12 @@ export class Journal {
     }
     append(event, taskId, data = {}) {
         const row = { ts: new Date().toISOString(), event, ...(taskId ? { taskId } : {}), data };
-        appendFileSync(this.journalPath, JSON.stringify(row) + "\n");
+        // T3 secret redaction: only the persisted bytes are masked — the caller's data stays untouched in
+        // memory. The narrator receives the persisted (masked) row so a pane sink never shows a credential.
+        const line = redactSecrets(JSON.stringify(row));
+        appendFileSync(this.journalPath, line + "\n");
         try {
-            this.narrate?.(row);
+            this.narrate?.(JSON.parse(line));
         }
         catch {
             // narration is observational; a broken sink must not affect the journal or run
@@ -421,7 +425,8 @@ export class Journal {
         return m;
     }
     telemetry(row) {
-        appendFileSync(join(this.dir, "telemetry.jsonl"), JSON.stringify(row) + "\n");
+        // T3 secret redaction: same persistence seam as append — credential-free rows are byte-identical.
+        appendFileSync(join(this.dir, "telemetry.jsonl"), redactSecrets(JSON.stringify(row)) + "\n");
     }
     // Per-run, raw (NOT schema-validated) — report.ts reads v1.5 core fields; stays byte-compatible.
     readTelemetry() {

package/dist/run/reconcile.js

@@ -87,8 +87,10 @@ export function desiredPanes(rows, runId) {
                 clearTask(row.taskId);
                 break;
             case "run-end":
+                // OBS-103: run-end retires EVERY run-tagged pane, the watch narrator included. The fold
+                // keys on the run identity in the pane name, so a narrator a prior daemon instance opened
+                // (stop→resume cycle) retires all the same; a later run-resume re-desires it above.
                 desired.clear();
-                desired.add(formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId }));
                 break;
         }
     }

package/dist/run/redact.d.ts

@@ -0,0 +1,2 @@
+export declare const MASK = "[REDACTED]";
+export declare function redactSecrets(text: string): string;

package/dist/run/redact.js

@@ -0,0 +1,53 @@
+// T3 (repo-scan Tier A #2): the shared secret-redaction pass for captured agent text at the
+// persistence seams. Every seam that persists captured agent text routes its bytes through
+// redactSecrets before hitting disk — journal event payloads and telemetry rows (journal.ts) and
+// consult dossier artifacts (consult.ts). In-memory originals are never touched: redaction applies
+// to the serialized bytes only, at the write site.
+//
+// Two shape families:
+//   - vendor keys: recognizable prefix + high-entropy body. The prefix survives masking so the
+//     credential class stays identifiable; the body never persists.
+//   - secret assignments: KEY=value / "key": "value" where the key NAME announces a secret. The key
+//     survives; the value is masked.
+// Text with no credential shapes passes through byte-identical. Masks contain no quote or backslash
+// and value charsets never cross a JSON string boundary, so redacting a serialized JSON line always
+// yields a line that still parses.
+export const MASK = "[REDACTED]";
+// Order matters: more specific prefixes (sk-ant-, sk-proj-) before the generic sk- form.
+const VENDOR_KEY_RES = [
+    /\b(sk-ant-)[A-Za-z0-9_-]{8,}/g, // Anthropic
+    /\b(sk-proj-)[A-Za-z0-9_-]{8,}/g, // OpenAI project key
+    /\b(sk-)[A-Za-z0-9_-]{16,}/g, // OpenAI classic / sk-prefixed secret keys
+    /\b(github_pat_)[A-Za-z0-9_]{8,}/g, // GitHub fine-grained PAT
+    /\b(gh[pousr]_)[A-Za-z0-9]{16,}/g, // GitHub token family (ghp_/gho_/ghu_/ghs_/ghr_)
+    /\b(glpat-)[A-Za-z0-9_-]{8,}/g, // GitLab PAT
+    /\b(xox[baprs]-)[A-Za-z0-9-]{8,}/g, // Slack token family
+    /\b(npm_)[A-Za-z0-9]{16,}/g, // npm token
+    /\b(AKIA)[0-9A-Z]{16}\b/g, // AWS access key id
+    /\b(AIza)[0-9A-Za-z_-]{35}\b/g, // Google API key
+];
+// Key names that announce a secret. The optional quote after the key closes a JSON key ("apiKey": "…").
+// The match starts AT the keyword — chars before it (MY_ in MY_API_KEY=) are simply left in place by
+// replace, so anchoring on the keyword yields identical output while keeping the scan linear (a
+// leading [A-Za-z0-9_.-]* here backtracks quadratically on long tokens — seconds on a 50K blob, and
+// journal payloads carry parked diffs up to the diff cap).
+// The value charset excludes quotes/backslash (never crosses a JSON string boundary) and square
+// brackets (an already-masked value never re-matches ⇒ idempotent, and a vendor prefix kept by the
+// pass above survives). The letter lookahead skips purely numeric values ("maxTokens":30000000 is a
+// count, not a credential — and masking a bare JSON number would break the line's parse).
+// Quotes may arrive backslash-escaped (a transcript already serialized inside a JSON string), so the
+// optional opening/closing quote around key and value accepts \" as well as ".
+const ASSIGNMENT_RE = /((?:api[_-]?key|apikey|secret|token|passwd|password|credential|access[_-]?key)[A-Za-z0-9_.-]*(?:\\?["'])?\s*[=:]\s*(?:\\?["'])?)(?=[^\s"'`\\,;[\]]*[A-Za-z])([^\s"'`\\,;[\]]{8,})/gi;
+// Authorization headers are the most common credential shape in captured transcripts.
+const BEARER_RE = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]{16,}/g;
+// Cheap literal prescan: every pattern above needs one of these substrings, and most persisted text
+// (diffs, prose, telemetry) has none — those payloads skip all 12 regex passes in one linear scan.
+const HINT_RE = /sk-|github_pat_|gh[pousr]_|glpat-|xox[baprs]-|npm_|AKIA|AIza|Bearer|api[_-]?key|apikey|secret|token|passwd|password|credential|access[_-]?key/i;
+export function redactSecrets(text) {
+    if (!HINT_RE.test(text))
+        return text;
+    let out = text;
+    for (const re of VENDOR_KEY_RES)
+        out = out.replace(re, `$1${MASK}`);
+    return out.replace(ASSIGNMENT_RE, `$1${MASK}`).replace(BEARER_RE, `$1${MASK}`);
+}

package/dist/run/stall.d.ts

@@ -1,4 +1,8 @@
-/** Normalize one pane snapshot for the stall-inactivity compare (and ONLY that compare — trailer
- * parsing, harvest, waitOutput, and paging read the raw text). Two snapshots that normalize equal
- * are the same frame modulo spinner presentation; any other byte difference is worker activity. */
+/** Normalize one pane snapshot for the stall-inactivity compare (trailer parsing, harvest,
+ * waitOutput, and paging read the raw text; the LLM transcript filter below reuses this to
+ * CLASSIFY presentation-only lines, never to rewrite kept bytes). Two snapshots that normalize
+ * equal are the same frame modulo spinner presentation; any other byte difference is activity. */
 export declare function normalizeStallSnapshot(text: string): string;
+/** Filter transcript text bound for an LLM prompt (consult dossiers, gate prompts). The classify
+ * seam exists for fault injection in tests only — production callers pass text alone. */
+export declare function filterLlmTranscript(text: string, classify?: (t: string) => string): string;

package/dist/run/stall.js

@@ -16,9 +16,77 @@ const SPINNER_RE = /[⠀-⣿]/g;
 // A digit run (optionally decimal) bound directly to a time-unit suffix, standing alone as a
 // word: 9s, 41s, 3m, 1h, 800ms. Never bare digits — "(6/7)" and "5 of 7" stay change-sensitive.
 const ELAPSED_RE = /(?<![\w.])\d+(?:\.\d+)?(?:ms|[hms])(?!\w)/g;
-/** Normalize one pane snapshot for the stall-inactivity compare (and ONLY that compare — trailer
- * parsing, harvest, waitOutput, and paging read the raw text). Two snapshots that normalize equal
- * are the same frame modulo spinner presentation; any other byte difference is worker activity. */
+/** Normalize one pane snapshot for the stall-inactivity compare (trailer parsing, harvest,
+ * waitOutput, and paging read the raw text; the LLM transcript filter below reuses this to
+ * CLASSIFY presentation-only lines, never to rewrite kept bytes). Two snapshots that normalize
+ * equal are the same frame modulo spinner presentation; any other byte difference is activity. */
 export function normalizeStallSnapshot(text) {
     return text.replace(ANSI_RE, "").replace(SPINNER_RE, "").replace(ELAPSED_RE, "");
 }
+// ─── v1.65 T2: LLM-bound transcript filter ──────────────────────────────────────────────────────
+// Consult dossiers and gate prompts pay tokens per transcript byte, so LLM-bound text runs through
+// a per-line classifier: carriage-return overwrite churn keeps only the final paint, lines that are
+// pure presentation (spinner/ANSI/elapsed only — classified via normalizeStallSnapshot above, never
+// a parallel normalizer) drop, consecutive repaint frames that normalize equal squash to the last,
+// and runs of passing-test lines collapse to a count line. Failure lines, exit codes, and summary
+// lines always survive verbatim. Fail-open by contract: any internal error — or trivial savings —
+// returns the original text; the filter may only ever cost noise, never evidence.
+// Signal that must never drop: failure markers, exit codes, run summaries. Substring matches on
+// purpose (AssertionError, FAILED) — over-keeping is the safe miss, same asymmetry as the allowlist.
+const KEEP_RE = /[✗✖]|fail|error|exception|fatal|panic|exit\s*code|exit(?:ed)?\s+with|non-?zero|traceback|^\s*(?:tests?\b|test\s+(?:files|suites)|suites?\b|snapshots?\b|duration\b|summary\b)/i;
+// Passing-test line shapes (vitest/jest/tap/go/pytest). Only KEEP-negative lines reach this class.
+const PASS_RE = /^\s*(?:[✓✔√]\s|ok\s+\d|PASS\b|---\s*PASS:)|\bPASSED\b/;
+const COLLAPSE_MIN = 3; // a 1–2 line run costs less than the count line that would replace it
+const MIN_SAVINGS_RATIO = 0.1; // below 10% shrink the rewrite is not worth its risk — pass through
+function classifyTranscript(text) {
+    const out = [];
+    let run = [];
+    let prevNorm = null;
+    const flush = () => {
+        if (run.length >= COLLAPSE_MIN)
+            out.push(`[${run.length} passing-test lines collapsed]`);
+        else
+            out.push(...run);
+        run = [];
+    };
+    for (const raw of text.split("\n")) {
+        // CR overwrite churn: the final paint wins; earlier paints carrying must-keep signal survive too.
+        const segs = raw.split("\r");
+        for (const line of segs.filter((s, i) => i === segs.length - 1 || KEEP_RE.test(s))) {
+            if (KEEP_RE.test(line)) {
+                flush();
+                out.push(line);
+                prevNorm = null;
+                continue;
+            }
+            if (PASS_RE.test(line)) {
+                run.push(line);
+                prevNorm = null;
+                continue;
+            }
+            flush();
+            const norm = normalizeStallSnapshot(line);
+            if (line.trim() !== "" && norm.trim() === "")
+                continue; // pure spinner/ANSI/elapsed frame
+            if (norm !== "" && norm === prevNorm) {
+                out[out.length - 1] = line;
+                continue;
+            } // repaint of the prior line — latest wins
+            out.push(line);
+            prevNorm = norm;
+        }
+    }
+    flush();
+    return out.join("\n");
+}
+/** Filter transcript text bound for an LLM prompt (consult dossiers, gate prompts). The classify
+ * seam exists for fault injection in tests only — production callers pass text alone. */
+export function filterLlmTranscript(text, classify = classifyTranscript) {
+    try {
+        const filtered = classify(text);
+        return text.length - filtered.length < text.length * MIN_SAVINGS_RATIO ? text : filtered;
+    }
+    catch {
+        return text; // fail open — a filter defect must never cost the consult its evidence
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.63.0",
+  "version": "1.65.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",