tickmarkr 1.69.0 → 1.71.0

package/dist/adapters/kimi.js

@@ -1,9 +1,10 @@
-import { spawnSync } from "node:child_process";
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
+import { runInteractiveSeed } from "../run/interactive-seed.js";
+import { sh } from "../run/git.js";
 import { channelsFromConfig, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
 // KIMI-03 → v1.58 T5: the "no harness-readable counter" block (research F-6, 2026-07-17) is
 // LIFTED for collectUsage — kimi 0.27.0 writes a wire journal per agent at
@@ -117,40 +118,18 @@ export function confirmKimiSeedBanner(banner, assignedModel) {
     }
     return { ok: true, sessionId: kimiBannerSessionId(banner) };
 }
-// Shared launch-then-seed surface (T6) + banner confirm helpers (T7). One definition so the
-// adapter property and runKimiInteractiveSeed cannot drift.
+// Shared launch-then-seed surface (T6) + banner confirm (T7/T2). One definition so the adapter
+// property and the daemon's generic runInteractiveSeed path cannot drift.
 const KIMI_SEED = {
     launch: (model) => `kimi -y -m ${shq(kimiAlias(model))}`,
     readinessMatch: "Send /help for help information.",
     seedLine: (promptFile) => `Read ${promptFile} and do exactly what it says.`,
+    confirmBanner: confirmKimiSeedBanner,
 };
-// v1.69 T7: kimi-local launch-then-seed that confirms the banner model and captures the session id
-// from the SAME pane text already present for the readiness match. No extra probe, no extra
-// dispatch — one read of the launch banner, then seed or fail closed.
+// v1.69 T7 / v1.71 T2: thin wrapper over the daemon's generic dispatch path for kimi-only tests.
 export async function runKimiInteractiveSeed(opts) {
-    await opts.driver.run(opts.slot, KIMI_SEED.launch(opts.assignment.model));
-    const ready = await opts.driver.waitOutput(opts.slot, KIMI_SEED.readinessMatch, opts.taskTimeoutMinutes * 60_000);
-    // Banner text already on the pane for the readiness match — the only text model/session use.
-    const banner = await opts.driver.read(opts.slot, 1000);
-    if (!ready) {
-        return { output: banner, seedFailed: true, seedError: `readiness pattern not seen: ${KIMI_SEED.readinessMatch}` };
-    }
-    const confirm = confirmKimiSeedBanner(banner, opts.assignment.model);
-    if (!confirm.ok) {
-        return { output: banner, seedFailed: true, seedError: confirm.error };
-    }
-    const seedText = KIMI_SEED.seedLine(opts.promptFile);
-    await opts.driver.run(opts.slot, seedText);
-    let output = "";
-    for (let attempt = 0; attempt < 5; attempt++) {
-        await new Promise((r) => setTimeout(r, 200));
-        output = await opts.driver.read(opts.slot, 1000);
-        const bottom = output.trimEnd().split("\n").pop() ?? "";
-        if (!bottom.includes(seedText)) {
-            return { output, seedFailed: false, sessionId: confirm.sessionId };
-        }
-    }
-    return { output, seedFailed: true, seedError: "seed line never left the input box", sessionId: confirm.sessionId };
+    const r = await runInteractiveSeed({ ...opts, adapter: kimi });
+    return { output: r.output, seedFailed: r.seedFailed, seedError: r.seedError, sessionId: r.sessionId };
 }
 export const kimi = {
     id: "kimi",
@@ -183,10 +162,8 @@ export const kimi = {
     // null → the daemon's print fallback (types.ts:101) keeps kimi workers visible without a TUI.
     interactiveCommand: () => null,
     // v1.69 T6/T7: launch the real TUI, wait for the cold-start readiness marker, then submit the
-    // prompt as one user turn. Banner model/session confirmation for seed mode lives in
-    // runKimiInteractiveSeed / confirmKimiSeedBanner (same pane text as the readiness match — no
-    // extra probe). Live-probed 2026-07-22 (kimi 0.28.1): `kimi -y` opens the TUI with yolo active
-    // and prints the model/session lines plus "Send /help for help information." before the input box.
+    // prompt as one user turn. Banner model/session confirmation runs on the daemon's generic
+    // runInteractiveSeed path via confirmBanner on KIMI_SEED (not a separate dispatch helper).
     interactiveSeed: KIMI_SEED,
     // v1.53 T3 resume — live-probed 2026-07-18: `-p` + `-S <id>` compose cleanly (no OBS-67-class
     // flag rejection) and the resumed session carries prior conversation state. `-S <id>` is the
@@ -298,7 +275,7 @@ export const kimi = {
         }
     },
     listModels: async () => {
-        const r = spawnSync("kimi", ["provider", "list", "--json"], { encoding: "utf8", timeout: 15000 });
-        return r.error || r.status !== 0 ? [] : parseKimiModels(r.stdout || "");
+        const r = await sh("kimi provider list --json", process.cwd(), 15000);
+        return r.code !== 0 ? [] : parseKimiModels(r.stdout || "");
     },
 };

package/dist/adapters/registry.d.ts

@@ -3,6 +3,28 @@ import { type RoutingProfile } from "../route/profile.js";
 import { type AuthHealth, type BillingChannel, type WorkerAdapter } from "./types.js";
 export declare const CANDIDATE_CLI_CATALOG: readonly ["kimi", "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush"];
 export declare const REGISTERED_ADAPTER_BINARIES: readonly ["claude", "codex", "cursor-agent", "opencode", "pi", "grok"];
+export declare function resolveShellBinary(bin: string, cwd?: string): {
+    resolved?: string;
+    all: string[];
+};
+export declare function probeVersionShell(bin: string, cwd?: string): AuthHealth & {
+    binaryPaths?: string[];
+};
+export declare function binaryShadowWarnings(adapters: WorkerAdapter[], health: Record<string, AuthHealth>, cwd?: string, resolve?: (bin: string, cwd: string) => {
+    resolved?: string;
+    all: string[];
+}): string[];
+export declare function invalidConfiguredModels(cfg: TickmarkrConfig, adapterId: string, h: AuthHealth | undefined): string[];
+export declare function modelAliasExclusions(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): {
+    key: string;
+    adapter: string;
+    model: string;
+}[];
+export declare function modelAliasLine(excluded: {
+    key: string;
+    adapter: string;
+    model: string;
+}[]): string;
 export type CandidateCliDetection = {
     binary: string;
     version: string | undefined;
@@ -19,7 +41,9 @@ export declare function allAdapters(opts?: {
     fakeScriptPath?: string;
 }): WorkerAdapter[];
 export declare function getAdapter(id: string, adapters: WorkerAdapter[]): WorkerAdapter;
-export declare function probeAll(adapters: WorkerAdapter[]): Promise<Record<string, AuthHealth>>;
+export declare function probeAll(adapters: WorkerAdapter[], opts?: {
+    cwd?: string;
+}): Promise<Record<string, AuthHealth>>;
 export type ProbeModelStatus = "ok" | "timeout" | "failed";
 export type ProbeModelProgress = (adapter: string, model: string, status: ProbeModelStatus, durationMs: number) => void;
 export interface AutoPreferDoc {

package/dist/adapters/registry.js

@@ -18,11 +18,89 @@ import { grok } from "./grok.js";
 import { kimi } from "./kimi.js";
 import { opencode } from "./opencode.js";
 import { pi } from "./pi.js";
-import { channelKey, modelAuthed, QUOTA_RE } from "./types.js";
+import { sealHerdrEnv } from "../drivers/subprocess.js";
+import { channelKey, modelAuthed, QUOTA_RE, shq } from "./types.js";
 // Agent-CLI binary names with no tickmarkr adapter — doctor sweeps these advisory-only (v1.48 T1).
 export const CANDIDATE_CLI_CATALOG = ["kimi", "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush"];
 // Binaries probed by registered adapters — kept beside the catalog so a test can forbid overlap.
 export const REGISTERED_ADAPTER_BINARIES = ["claude", "codex", "cursor-agent", "opencode", "pi", "grok"];
+// OBS-117: worker panes run commands through `bash -lc` (SubprocessDriver + sh()), not bare spawnSync(bin).
+// Doctor must resolve adapter binaries the same way so a shadow install on PATH cannot disagree with dispatch.
+function shellSpawnSync(cmd, cwd, timeoutMs = 10000) {
+    const r = spawnSync("bash", ["-lc", cmd], {
+        encoding: "utf8",
+        cwd,
+        timeout: timeoutMs,
+        env: sealHerdrEnv(process.env),
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    return { code: r.status ?? 1, stdout: (r.stdout || "").trim(), stderr: (r.stderr || "").trim() };
+}
+export function resolveShellBinary(bin, cwd = process.cwd()) {
+    const r = shellSpawnSync(`type -a ${shq(bin)} 2>/dev/null | sed -n 's/^.* is \\(.*\\)$/\\1/p'`, cwd);
+    const all = r.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+    return { resolved: all[0], all };
+}
+export function probeVersionShell(bin, cwd = process.cwd()) {
+    const { resolved, all } = resolveShellBinary(bin, cwd);
+    if (!resolved)
+        return { installed: false, authed: false, models: [] };
+    const r = shellSpawnSync(`${shq(resolved)} --version`, cwd);
+    if (r.code !== 0)
+        return { installed: false, authed: false, models: [], binaryPaths: all };
+    return {
+        installed: true,
+        authed: true,
+        version: (r.stdout || r.stderr).trim().split("\n")[0],
+        models: [],
+        note: "auth assumed; verified at dispatch (failover on auth/quota errors)",
+        binaryPaths: all,
+    };
+}
+export function binaryShadowWarnings(adapters, health, cwd = process.cwd(), resolve) {
+    const resolveFn = resolve ?? resolveShellBinary;
+    const out = [];
+    for (const a of adapters) {
+        const bin = a.hardcodedFlags?.binary;
+        if (!bin || !health[a.id]?.installed)
+            continue;
+        const { resolved, all } = resolveFn(bin, cwd);
+        if (all.length <= 1)
+            continue;
+        out.push(`binary shadow: ${a.id} resolves to ${resolved ?? bin} but ${all.length} installs on PATH — ${all.join(", ")}`);
+    }
+    return out;
+}
+function modelListValidated(h) {
+    return !!h?.modelsDetectedAt && Array.isArray(h.models);
+}
+export function invalidConfiguredModels(cfg, adapterId, h) {
+    if (!modelListValidated(h))
+        return [];
+    const listed = new Set(h.models);
+    const configured = Object.keys(cfg.tiers[adapterId]?.models ?? {});
+    // Fail open until the CLI list intersects at least one configured model — proves the list is authoritative
+    // for this adapter's tier namespace (MODEL-04: unrelated detected ids must not invalidate routing).
+    if (!configured.some((m) => listed.has(m)))
+        return [];
+    return configured.filter((m) => !listed.has(m));
+}
+export function modelAliasExclusions(cfg, adapters, health) {
+    const out = [];
+    for (const a of adapters) {
+        const h = health[a.id];
+        if (!h?.installed || !h?.authed)
+            continue;
+        for (const model of invalidConfiguredModels(cfg, a.id, h)) {
+            out.push({ key: channelKey({ adapter: a.id, model }), adapter: a.id, model });
+        }
+    }
+    return out;
+}
+export function modelAliasLine(excluded) {
+    const parts = excluded.map(({ key, adapter }) => `${key} (not in ${adapter}'s reported model list)`);
+    return `model alias: ${excluded.length} channel(s) invalid — ${parts.join(", ")}`;
+}
 function candidateOnPath(bin, pathEnv) {
     const r = spawnSync("which", [bin], { encoding: "utf8", env: { ...process.env, PATH: pathEnv } });
     return r.status === 0 && r.stdout.trim().length > 0;
@@ -105,9 +183,20 @@ export function getAdapter(id, adapters) {
         throw new Error(`unknown adapter ${id} (have: ${adapters.map((a) => a.id).join(", ")})`);
     return a;
 }
-export async function probeAll(adapters) {
+export async function probeAll(adapters, opts = {}) {
+    const cwd = opts.cwd ?? process.cwd();
     const out = {};
-    await Promise.all(adapters.map(async (a) => { out[a.id] = await a.probe(); }));
+    await Promise.all(adapters.map(async (a) => {
+        let h = await a.probe();
+        const bin = a.hardcodedFlags?.binary;
+        if (bin) {
+            const shell = probeVersionShell(bin, cwd);
+            h = { ...h, installed: shell.installed, version: shell.version ?? h.version };
+            if (!shell.installed)
+                h = { ...h, installed: false, authed: false };
+        }
+        out[a.id] = h;
+    }));
     return out;
 }
 const MODEL_PROBE_PROMPT = "Reply with exactly OK and nothing else.";
@@ -317,10 +406,12 @@ export function discoverChannels(cfg, adapters, health) {
         .flatMap((a) => {
         const h = health[a.id];
         const s = h?.servable;
+        const invalid = new Set(invalidConfiguredModels(cfg, a.id, h));
         // T2 (2026-07-13): only a model doctor marked authed (modelAuth[model].authed===true) advertises a
         // channel — routing an unknown or 403 into dispatch is fail-closed. Operators with pre-v1.21 doctor.json
         // can opt into the prior unknown-is-routable behavior with routing.allowUnverifiedModels.
-        return a.channels(cfg).filter((c) => modelAuthed(h, c.model, cfg.routing.allowUnverifiedModels) && (!s || s.includes(c.model)));
+        // OBS-117: configured aliases absent from the adapter CLI's own model list are not dispatchable.
+        return a.channels(cfg).filter((c) => !invalid.has(c.model) && modelAuthed(h, c.model, cfg.routing.allowUnverifiedModels) && (!s || s.includes(c.model)));
     });
     if (!cfg.routing.allow && !cfg.routing.deny)
         return base;

package/dist/adapters/types.d.ts

@@ -48,10 +48,18 @@ export interface WorkerResult {
     deviations: string[];
     raw: string;
 }
+export type SeedBannerConfirmResult = {
+    ok: true;
+    sessionId?: string;
+} | {
+    ok: false;
+    error: string;
+};
 export interface InteractiveSeed {
     launch(model: string): string;
     readinessMatch: string;
     seedLine(promptFile: string): string;
+    confirmBanner?(banner: string, assignedModel: string): SeedBannerConfirmResult;
 }
 export interface ContextUsage {
     tokens: number;

package/dist/cli/commands/doctor.js

@@ -1,12 +1,12 @@
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { allAdapters, detectCandidateClis, flagDriftWarnings, probeAll, probeModels, readAutoPrefer, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
+import { allAdapters, binaryShadowWarnings, detectCandidateClis, flagDriftWarnings, modelAliasExclusions, modelAliasLine, probeAll, probeModels, readAutoPrefer, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
 import { BANNER, dim, fail, kvRow, legend, ok, rule, statusRow, title } from "../../brand.js";
 import { tickmarkrDir, stateDirName } from "../../graph/graph.js";
 import { declaredModelWindow, hasWindowsConfig, modelLints, suggestOverlay, ttyVisual } from "../../adapters/model-lints.js";
 import { DEFAULT_CONFIG, loadConfig, overlayPreferShapes } from "../../config/config.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
-import { disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
+import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
 const visual = () => process.stdout.isTTY === true && process.env.NO_COLOR === undefined;
 const alignedStatusRow = (verdict, key, value) => `  ${statusRow(verdict, kvRow(key, value).slice(2))}`;
 const attentionRow = (text) => `  ${statusRow("warn", text)}`;
@@ -19,7 +19,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     // otherwise prints nothing until the end — silence here reads as a hang (v1.33.1)
     console.error("probing installed agent CLIs — one short LLM call per configured model, may take a minute...");
     const probeProgressTTY = process.stderr.isTTY === true;
-    const health = await probeAll(adapters);
+    const health = await probeAll(adapters, { cwd });
     // MODEL-02: detect models where the adapter exposes a list surface, BEFORE writing doctor.json (write once, below).
     // Fail OPEN — the inverse of gates' fail-closed: detection is advisory, so a broken list surface NEVER fails doctor.
     for (const a of adapters) {
@@ -81,6 +81,11 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     const excluded = excludedChannels(cfg, adapters, health);
     if (excluded.length)
         rows.push(attentionRow(exclusionLine(excluded)));
+    rows.push(...denyPreferCollisions(cfg).map((c) => attentionRow(denyPreferCollisionLine(c))));
+    const aliasExcluded = modelAliasExclusions(cfg, adapters, health);
+    if (aliasExcluded.length)
+        rows.push(attentionRow(modelAliasLine(aliasExcluded)));
+    rows.push(...binaryShadowWarnings(adapters, health, cwd).map(attentionRow));
     // HYG-07(a): doctor just probed fresh (probeAll above), so servability attribution is current by construction.
     const servable = servableExclusions(cfg, adapters, health);
     if (servable.length)

package/dist/cli/commands/report.js

@@ -1,8 +1,11 @@
+import { writeFileSync } from "node:fs";
 import { parseArgs } from "node:util";
 import { ttyVisual } from "../../adapters/model-lints.js";
 import { addUsage } from "../../adapters/types.js";
 import { dim, rule, title } from "../../brand.js";
 import { loadConfig } from "../../config/config.js";
+import { buildProofBundle } from "../../report/bundle.js";
+import { compareRuns } from "../../report/compare.js";
 import { estimateCosts } from "../../report/cost.js";
 import { cellsOf, cellSummary } from "../../route/profile.js";
 import { Journal, loadRoutingProfile } from "../../run/journal.js";
@@ -316,17 +319,49 @@ const stylizeReport = (out) => {
 export async function report(argv, cwd = process.cwd()) {
     const { values, positionals } = parseArgs({
         args: argv,
-        options: { md: { type: "boolean" } },
+        options: {
+            md: { type: "boolean" },
+            // v1.70 T3: baseline run id for cost/gate/duration delta + environment comparability guard
+            compare: { type: "string" },
+            // v1.70 T4: write a portable, schema-versioned proof packet (local file only — no network)
+            bundle: { type: "string" },
+        },
         allowPositionals: true,
     });
     const runId = positionals[0] ?? Journal.latestRunId(cwd, { withJournal: true });
     if (!runId)
-        throw new Error("no runs found — usage: tickmarkr report <run-id> [--md]");
+        throw new Error("no runs found — usage: tickmarkr report <run-id> [--md] [--compare <baseline-run-id>] [--bundle <path>]");
     const j = Journal.open(cwd, runId);
     const events = j.read();
+    const rows = j.readTelemetry();
+    const cfg = loadConfig(cwd);
+    let bundleNote = "";
+    if (values.bundle) {
+        // Local-only write of the pure proof packet — no network path exists in buildProofBundle.
+        const packet = buildProofBundle(runId, events);
+        writeFileSync(values.bundle, JSON.stringify(packet, null, 2) + "\n");
+        bundleNote = `wrote proof bundle → ${values.bundle}\n`;
+    }
+    let comparison = "";
+    if (values.compare) {
+        const baselineRunId = values.compare;
+        const baseline = Journal.open(cwd, baselineRunId);
+        const outcome = compareRuns({
+            runId,
+            baselineRunId,
+            events,
+            baselineEvents: baseline.read(),
+            rows,
+            baselineRows: baseline.readTelemetry(),
+            cost: cfg.cost,
+        });
+        // Fail closed: missing run-start yields a clear reason, never a partial table.
+        if (!outcome.ok)
+            throw new Error(outcome.reason);
+        comparison = "\n" + outcome.text;
+    }
     if (values.md) {
-        const rows = j.readTelemetry();
-        return renderMarkdownRecord(runId, events, estimateCosts(rows, loadConfig(cwd).cost), rows);
+        return bundleNote + renderMarkdownRecord(runId, events, estimateCosts(rows, cfg.cost), rows) + comparison;
     }
-    return stylizeReport(textReport(runId, events, j.readTelemetry(), cwd));
+    return bundleNote + stylizeReport(textReport(runId, events, rows, cwd)) + comparison;
 }

package/dist/cli/commands/resume.js

@@ -2,6 +2,7 @@ import { loadConfig } from "../../config/config.js";
 import { pickDriver } from "../../drivers/index.js";
 import { formatSummary, runDaemon } from "../../run/daemon.js";
 import { formatJournalNarration } from "../../run/journal.js";
+import { denyPreferCollisionLine, denyPreferCollisions } from "../../route/preference.js";
 const summaryGreen = (s) => s.failed.length === 0 && s.human.length === 0 && s.blocked.length === 0 && s.pending.length === 0
     && s.tipVerify !== "failed";
 export async function resume(argv, cwd = process.cwd()) {
@@ -12,7 +13,12 @@ export async function resume(argv, cwd = process.cwd()) {
     // Fable F2) — the daemon refuses a mismatched/unbound journal unless this is set, then journals a
     // graph-rehash event naming both hashes. Strip the flag before runId resolution so a bare id still wins.
     const graphChanged = argv.includes("--graph-changed");
-    const s = await runDaemon(cwd, { runId, resume: true, graphChanged, driver: pickDriver(loadConfig(cwd)), narrate: (event) => console.log(formatJournalNarration(event)) });
+    const cfg = loadConfig(cwd);
+    const collisions = denyPreferCollisions(cfg);
+    if (collisions.length) {
+        throw new Error(collisions.map(denyPreferCollisionLine).join("; "));
+    }
+    const s = await runDaemon(cwd, { runId, resume: true, graphChanged, driver: pickDriver(cfg), narrate: (event) => console.log(formatJournalNarration(event)) });
     const out = `resumed ${s.runId} — ${formatSummary(s)}`;
     return { out, code: summaryGreen(s) ? 0 : 2 };
 }

package/dist/cli/commands/status.js

@@ -2,7 +2,7 @@ import { BANNER, GLYPHS, dim, fail, legend, ok, rule, statusRow, title, warn } f
 import { blockedTasks, graphDefinitionHash, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { foldActivity } from "../../run/activity.js";
-import { Journal, engagementComparable } from "../../run/journal.js";
+import { Journal, engagementComparable, isQualityFailureParkKind, recordedTaskFailureKind, runHasEnded, } from "../../run/journal.js";
 // ponytail: fixed 2s refresh; promote to config.visibility.* only when an operator asks.
 const REFRESH_MS = 2000;
 const NOT_COMPARABLE_NOTICE = "graph recompiled since this run — task states not comparable; run `tickmarkr run` to execute";
@@ -178,15 +178,23 @@ const renderFrame = (cwd) => {
     const divider = unicode ? " · " : " / ";
     const width = process.stdout.columns ?? 120;
     const done = effective.tasks.filter((t) => t.status === "done").length;
+    const ended = comparable && runHasEnded(events);
     const cells = g.tasks.map((t) => {
         const st = replayed?.get(t.id) ?? t.status;
+        const failureKind = comparable ? recordedTaskFailureKind(events, t.id) : undefined;
+        const terminal = st === "failed" || st === "human";
+        // Unknown legacy task-failed events stay red. Typed availability noise is warn-tier only while
+        // the run is live; verified quality parks and every unresolved task in an ended run are red.
+        const redTier = terminal && (ended
+            || (failureKind !== undefined && isQualityFailureParkKind(failureKind))
+            || (st === "failed" && failureKind === undefined));
         const isStarved = starved.has(t.id);
         const phrase = isStarved ? undefined : activity.cells.get(t.id);
         const label = isStarved ? " starved" : phrase ? ` ${phrase}` : "";
         const channel = assignments.get(t.id) ?? "-";
         const ctx = contexts.get(t.id);
         const assignCol = ctx !== undefined ? `${channel}${divider}ctx ${ctx}` : channel;
-        return { t, st, label, assignCol, isStarved, phrase, channel, ctx, states: comparable ? gateStates(t, events) : defaultGateStates(t) };
+        return { t, st, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, states: comparable ? gateStates(t, events) : defaultGateStates(t) };
     });
     if (!unicode) {
         // machine/CI surface — layout unchanged (pipes, greps, and the golden pins depend on it)
@@ -207,7 +215,7 @@ const renderFrame = (cwd) => {
     // rows (pad plain text FIRST, colorize after: ANSI has zero display width and would corrupt
     // padEnd math)
     const dot = dim(" · ");
-    const anyFailed = cells.some((c) => c.st === "failed");
+    const anyFailed = cells.some((c) => c.redTier);
     const gaugeCells = 10;
     const fill = g.tasks.length ? Math.round((done / g.tasks.length) * gaugeCells) : 0;
     const gauge = (fill ? (anyFailed ? fail : ok)("█".repeat(fill)) : "") + (fill < gaugeCells ? dim("░".repeat(gaugeCells - fill)) : "");
@@ -232,17 +240,20 @@ const renderFrame = (cwd) => {
     // id, goal at full width, and only SHORT status words. Line 2 carries the machinery, dim and
     // aligned under the goal: gate chain, live activity phrase (or channel), ctx. Long channel names
     // and activity phrases live on line 2 only, so they can never squeeze the goal or wrap line 1.
-    const taskVerdict = (st) => st === "done" ? "pass" : st === "failed" ? "fail" : st === "human" ? "warn" : "neutral";
+    const taskVerdict = (c) => c.st === "done" ? "pass" : c.redTier ? "fail" : c.st === "failed" || c.st === "human" ? "warn" : "neutral";
+    const statusWord = (c) => c.redTier ? "failed" : c.st === "failed" ? "warn" : String(c.st);
     const idW = Math.max(...cells.map((c) => c.t.id.length), 2);
     // plain-text status suffixes for width math only — starved / failed gate names / approval hint
     const suffixPlain = (c) => (c.isStarved ? " · starved" : "") + failedSuffix(c.states) + humanGateSuffix(c.t, c.st, c.states);
-    const stW = Math.max(...cells.map((c) => String(c.st).length + suffixPlain(c).length));
+    const stW = Math.max(...cells.map((c) => statusWord(c).length + suffixPlain(c).length));
     const avail = Math.max(8, width - (5 + idW) - 2 - stW);
     const goals = cells.map((c) => shortGoal(c.t.goal, avail));
     const goalW = Math.max(8, ...goals.map((s) => s.length));
     const indent = " ".repeat(idW + 5); // line 2 starts under the goal column
-    const rows = cells.map(({ t, st, states, isStarved, phrase, channel, ctx }, i) => {
-        const stWord = st === "done" ? ok(String(st)) : st === "failed" ? fail(String(st)) : st === "human" ? warn(String(st)) : String(st);
+    const rows = cells.map((c, i) => {
+        const { t, st, failureKind, redTier, states, isStarved, phrase, channel, ctx } = c;
+        const word = statusWord(c);
+        const stWord = st === "done" ? ok(word) : redTier ? fail(word) : st === "failed" || st === "human" ? warn(word) : word;
         // a fail names its gate in words right here — the one moment gate identity is needed on a row
         const f = failedGates(states);
         const human = humanGateSuffix(t, st, states);
@@ -250,10 +261,11 @@ const renderFrame = (cwd) => {
             (isStarved ? dot + fail("starved") : "") +
             (f.length ? dot + fail(f.join(", ")) : "") +
             (human ? dot + warn("awaiting approval") : "");
-        const line1 = `  ${statusRow(taskVerdict(st), `${t.id.padEnd(idW)} ${goals[i].padEnd(goalW)}  ${statusCell}`)}`;
+        const line1 = `  ${statusRow(taskVerdict(c), `${t.id.padEnd(idW)} ${goals[i].padEnd(goalW)}  ${statusCell}`)}`;
         // activity already names its channel for in-flight attempts — never repeat it
         const detail = [
             ...(phrase ? [phrase, ...(phrase.includes(channel) || channel === "-" ? [] : [channel])] : [channel]),
+            ...(failureKind && !phrase?.includes(failureKind) ? [failureKind] : []),
             ...(ctx !== undefined ? [`ctx ${ctx}`] : []),
         ].join(" · ");
         return [line1, `${indent}${gateChain(states, true)}  ${dim(detail)}`, ""];

package/dist/drivers/herdr.d.ts

@@ -11,11 +11,14 @@ export declare class HerdrDriver implements ExecutorDriver {
     interactive: boolean;
     private groups;
     private groupSerial;
+    private deliverySerial;
     private ws;
     private callerPane;
     private watches;
     constructor(bin?: string, workersPerTab?: number);
     private serial;
+    private deliveryQueue;
+    private deliveryMatches;
     static available(): boolean;
     private herdr;
     private namedPaneId;
@@ -29,6 +32,8 @@ export declare class HerdrDriver implements ExecutorDriver {
     private glyphFor;
     private joinGroup;
     run(slot: Slot, cmd: string): Promise<void>;
+    private deliver;
+    private deliveryReadMatches;
     private waitOk;
     waitOutput(slot: Slot, pattern: string, timeoutMs: number, opts?: {
         regex?: boolean;

package/dist/drivers/herdr.js

@@ -25,6 +25,8 @@ export class HerdrDriver {
     // grouped slot()/close() mutate shared group state across awaits — serialize them so two
     // concurrent first members can never both create the group tab (mergeSerial idiom, daemon.ts)
     groupSerial = Promise.resolve();
+    // OBS-119: concurrent deliveries contend on herdr's send path — one chain per driver (mergeSerial idiom)
+    deliverySerial = Promise.resolve();
     // VIS-10: the run's workspace id, captured once at construction (the daemon inherits it from the
     // operator's env before the driver is built). Required at slot() time, never in the constructor —
     // pickDriver and its unit test construct HerdrDriver without env, so slot() is the trust gate.
@@ -40,6 +42,18 @@ export class HerdrDriver {
         this.groupSerial = p.catch(() => undefined);
         return p;
     }
+    deliveryQueue(fn) {
+        const p = this.deliverySerial.then(fn, fn);
+        this.deliverySerial = p.catch(() => undefined);
+        return p;
+    }
+    // ponytail: narrow panes hard-wrap the input line — collapse whitespace before comparing.
+    deliveryMatches(transcript, cmd) {
+        const norm = (s) => s.replace(/\s+/g, "");
+        const hay = norm(transcript);
+        const needle = norm(cmd);
+        return needle.length > 0 && hay.includes(needle);
+    }
     static available() {
         return process.env.HERDR_ENV === "1";
     }
@@ -286,6 +300,9 @@ export class HerdrDriver {
     // cleared (C-u), and retyped, bounded; persistent corruption fails closed WITH the captured
     // transcript — the dispatch-time pincer the ledger asks for, not post-hoc `git:` archaeology.
     async run(slot, cmd) {
+        return this.deliveryQueue(() => this.deliver(slot, cmd));
+    }
+    async deliver(slot, cmd) {
         const pane = await this.paneId(slot);
         let transcript = "";
         for (let attempt = 0; attempt < DELIVERY_ATTEMPTS; attempt++) {
@@ -300,9 +317,7 @@ export class HerdrDriver {
             if (typed.code !== 0)
                 throw new Error(`herdr pane send-text failed: ${typed.stderr || typed.stdout}`);
             const back = await this.herdr(`wait output ${shq(pane)} --match ${shq(cmd)} --timeout ${DELIVERY_VERIFY_TIMEOUT_MS}`, slot.cwd, DELIVERY_VERIFY_TIMEOUT_MS + 15_000);
-            // ponytail: transcript containment (scrollback included); anchor to the prompt line if a
-            // prior echo of the same command ever false-verifies. Dead pane → error envelope → unverified.
-            if (this.waitOk(back.code, back.stdout)) {
+            if (this.waitOk(back.code, back.stdout) || await this.deliveryReadMatches(pane, cmd, slot.cwd)) {
                 const enter = await this.herdr(`pane send-keys ${shq(pane)} Enter`, slot.cwd);
                 if (enter.code !== 0)
                     throw new Error(`herdr pane send-keys Enter failed: ${enter.stderr || enter.stdout}`);
@@ -313,6 +328,10 @@ export class HerdrDriver {
         }
         throw new Error(`herdr delivery corrupted after ${DELIVERY_ATTEMPTS} attempts — enter never pressed (OBS-85); pane transcript:\n${transcript}`);
     }
+    async deliveryReadMatches(pane, cmd, cwd) {
+        const read = await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${DELIVERY_READ_LINES}`, cwd);
+        return read.code === 0 && this.deliveryMatches(read.stdout, cmd);
+    }
     waitOk(code, stdout) {
         if (code !== 0 || !stdout.trim())
             return code === 0; // herdr's successful waits may be silent

package/dist/gates/acceptance.d.ts

@@ -2,13 +2,17 @@ import { type WorkerAdapter } from "../adapters/types.js";
 import { type Task } from "../graph/schema.js";
 import { type LlmVia } from "./llm.js";
 import type { GateResult } from "./types.js";
+export interface EvidenceCitation {
+    path: string;
+    line: number;
+}
 export interface JudgeVerdict {
     pass: boolean;
     criteria: Array<{
         criterion: string;
         met: boolean;
         reason: string;
-        evidence: string;
+        evidence: string | EvidenceCitation;
     }>;
 }
 export declare function judgeCriterionId(index: number): string;