tickmarkr 1.70.0 → 1.72.0

package/dist/cli/commands/resume.js

@@ -2,6 +2,7 @@ import { loadConfig } from "../../config/config.js";
 import { pickDriver } from "../../drivers/index.js";
 import { formatSummary, runDaemon } from "../../run/daemon.js";
 import { formatJournalNarration } from "../../run/journal.js";
+import { denyPreferCollisionLine, denyPreferCollisions } from "../../route/preference.js";
 const summaryGreen = (s) => s.failed.length === 0 && s.human.length === 0 && s.blocked.length === 0 && s.pending.length === 0
     && s.tipVerify !== "failed";
 export async function resume(argv, cwd = process.cwd()) {
@@ -12,7 +13,12 @@ export async function resume(argv, cwd = process.cwd()) {
     // Fable F2) — the daemon refuses a mismatched/unbound journal unless this is set, then journals a
     // graph-rehash event naming both hashes. Strip the flag before runId resolution so a bare id still wins.
     const graphChanged = argv.includes("--graph-changed");
-    const s = await runDaemon(cwd, { runId, resume: true, graphChanged, driver: pickDriver(loadConfig(cwd)), narrate: (event) => console.log(formatJournalNarration(event)) });
+    const cfg = loadConfig(cwd);
+    const collisions = denyPreferCollisions(cfg);
+    if (collisions.length) {
+        throw new Error(collisions.map(denyPreferCollisionLine).join("; "));
+    }
+    const s = await runDaemon(cwd, { runId, resume: true, graphChanged, driver: pickDriver(cfg), narrate: (event) => console.log(formatJournalNarration(event)) });
     const out = `resumed ${s.runId} — ${formatSummary(s)}`;
     return { out, code: summaryGreen(s) ? 0 : 2 };
 }

package/dist/cli/commands/status.js

@@ -2,7 +2,7 @@ import { BANNER, GLYPHS, dim, fail, legend, ok, rule, statusRow, title, warn } f
 import { blockedTasks, graphDefinitionHash, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { foldActivity } from "../../run/activity.js";
-import { Journal, engagementComparable } from "../../run/journal.js";
+import { Journal, engagementComparable, isQualityFailureParkKind, recordedTaskFailureKind, runHasEnded, } from "../../run/journal.js";
 // ponytail: fixed 2s refresh; promote to config.visibility.* only when an operator asks.
 const REFRESH_MS = 2000;
 const NOT_COMPARABLE_NOTICE = "graph recompiled since this run — task states not comparable; run `tickmarkr run` to execute";
@@ -178,15 +178,23 @@ const renderFrame = (cwd) => {
     const divider = unicode ? " · " : " / ";
     const width = process.stdout.columns ?? 120;
     const done = effective.tasks.filter((t) => t.status === "done").length;
+    const ended = comparable && runHasEnded(events);
     const cells = g.tasks.map((t) => {
         const st = replayed?.get(t.id) ?? t.status;
+        const failureKind = comparable ? recordedTaskFailureKind(events, t.id) : undefined;
+        const terminal = st === "failed" || st === "human";
+        // Unknown legacy task-failed events stay red. Typed availability noise is warn-tier only while
+        // the run is live; verified quality parks and every unresolved task in an ended run are red.
+        const redTier = terminal && (ended
+            || (failureKind !== undefined && isQualityFailureParkKind(failureKind))
+            || (st === "failed" && failureKind === undefined));
         const isStarved = starved.has(t.id);
         const phrase = isStarved ? undefined : activity.cells.get(t.id);
         const label = isStarved ? " starved" : phrase ? ` ${phrase}` : "";
         const channel = assignments.get(t.id) ?? "-";
         const ctx = contexts.get(t.id);
         const assignCol = ctx !== undefined ? `${channel}${divider}ctx ${ctx}` : channel;
-        return { t, st, label, assignCol, isStarved, phrase, channel, ctx, states: comparable ? gateStates(t, events) : defaultGateStates(t) };
+        return { t, st, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, states: comparable ? gateStates(t, events) : defaultGateStates(t) };
     });
     if (!unicode) {
         // machine/CI surface — layout unchanged (pipes, greps, and the golden pins depend on it)
@@ -207,7 +215,7 @@ const renderFrame = (cwd) => {
     // rows (pad plain text FIRST, colorize after: ANSI has zero display width and would corrupt
     // padEnd math)
     const dot = dim(" · ");
-    const anyFailed = cells.some((c) => c.st === "failed");
+    const anyFailed = cells.some((c) => c.redTier);
     const gaugeCells = 10;
     const fill = g.tasks.length ? Math.round((done / g.tasks.length) * gaugeCells) : 0;
     const gauge = (fill ? (anyFailed ? fail : ok)("█".repeat(fill)) : "") + (fill < gaugeCells ? dim("░".repeat(gaugeCells - fill)) : "");
@@ -232,17 +240,20 @@ const renderFrame = (cwd) => {
     // id, goal at full width, and only SHORT status words. Line 2 carries the machinery, dim and
     // aligned under the goal: gate chain, live activity phrase (or channel), ctx. Long channel names
     // and activity phrases live on line 2 only, so they can never squeeze the goal or wrap line 1.
-    const taskVerdict = (st) => st === "done" ? "pass" : st === "failed" ? "fail" : st === "human" ? "warn" : "neutral";
+    const taskVerdict = (c) => c.st === "done" ? "pass" : c.redTier ? "fail" : c.st === "failed" || c.st === "human" ? "warn" : "neutral";
+    const statusWord = (c) => c.redTier ? "failed" : c.st === "failed" ? "warn" : String(c.st);
     const idW = Math.max(...cells.map((c) => c.t.id.length), 2);
     // plain-text status suffixes for width math only — starved / failed gate names / approval hint
     const suffixPlain = (c) => (c.isStarved ? " · starved" : "") + failedSuffix(c.states) + humanGateSuffix(c.t, c.st, c.states);
-    const stW = Math.max(...cells.map((c) => String(c.st).length + suffixPlain(c).length));
+    const stW = Math.max(...cells.map((c) => statusWord(c).length + suffixPlain(c).length));
     const avail = Math.max(8, width - (5 + idW) - 2 - stW);
     const goals = cells.map((c) => shortGoal(c.t.goal, avail));
     const goalW = Math.max(8, ...goals.map((s) => s.length));
     const indent = " ".repeat(idW + 5); // line 2 starts under the goal column
-    const rows = cells.map(({ t, st, states, isStarved, phrase, channel, ctx }, i) => {
-        const stWord = st === "done" ? ok(String(st)) : st === "failed" ? fail(String(st)) : st === "human" ? warn(String(st)) : String(st);
+    const rows = cells.map((c, i) => {
+        const { t, st, failureKind, redTier, states, isStarved, phrase, channel, ctx } = c;
+        const word = statusWord(c);
+        const stWord = st === "done" ? ok(word) : redTier ? fail(word) : st === "failed" || st === "human" ? warn(word) : word;
         // a fail names its gate in words right here — the one moment gate identity is needed on a row
         const f = failedGates(states);
         const human = humanGateSuffix(t, st, states);
@@ -250,10 +261,11 @@ const renderFrame = (cwd) => {
             (isStarved ? dot + fail("starved") : "") +
             (f.length ? dot + fail(f.join(", ")) : "") +
             (human ? dot + warn("awaiting approval") : "");
-        const line1 = `  ${statusRow(taskVerdict(st), `${t.id.padEnd(idW)} ${goals[i].padEnd(goalW)}  ${statusCell}`)}`;
+        const line1 = `  ${statusRow(taskVerdict(c), `${t.id.padEnd(idW)} ${goals[i].padEnd(goalW)}  ${statusCell}`)}`;
         // activity already names its channel for in-flight attempts — never repeat it
         const detail = [
             ...(phrase ? [phrase, ...(phrase.includes(channel) || channel === "-" ? [] : [channel])] : [channel]),
+            ...(failureKind && !phrase?.includes(failureKind) ? [failureKind] : []),
             ...(ctx !== undefined ? [`ctx ${ctx}`] : []),
         ].join(" · ");
         return [line1, `${indent}${gateChain(states, true)}  ${dim(detail)}`, ""];

package/dist/drivers/herdr.d.ts

@@ -11,11 +11,14 @@ export declare class HerdrDriver implements ExecutorDriver {
     interactive: boolean;
     private groups;
     private groupSerial;
+    private deliverySerial;
     private ws;
     private callerPane;
     private watches;
     constructor(bin?: string, workersPerTab?: number);
     private serial;
+    private deliveryQueue;
+    private deliveryMatches;
     static available(): boolean;
     private herdr;
     private namedPaneId;
@@ -23,12 +26,16 @@ export declare class HerdrDriver implements ExecutorDriver {
     private paneWidth;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
     private tabSlot;
+    private reclaimStaleLabel;
+    private staleLabelPanes;
     private groupSlot;
     private newGeneration;
     private renameGroupTab;
     private glyphFor;
     private joinGroup;
     run(slot: Slot, cmd: string): Promise<void>;
+    private deliver;
+    private deliveryReadMatches;
     private waitOk;
     waitOutput(slot: Slot, pattern: string, timeoutMs: number, opts?: {
         regex?: boolean;

package/dist/drivers/herdr.js

@@ -25,6 +25,8 @@ export class HerdrDriver {
     // grouped slot()/close() mutate shared group state across awaits — serialize them so two
     // concurrent first members can never both create the group tab (mergeSerial idiom, daemon.ts)
     groupSerial = Promise.resolve();
+    // OBS-119: concurrent deliveries contend on herdr's send path — one chain per driver (mergeSerial idiom)
+    deliverySerial = Promise.resolve();
     // VIS-10: the run's workspace id, captured once at construction (the daemon inherits it from the
     // operator's env before the driver is built). Required at slot() time, never in the constructor —
     // pickDriver and its unit test construct HerdrDriver without env, so slot() is the trust gate.
@@ -40,19 +42,37 @@ export class HerdrDriver {
         this.groupSerial = p.catch(() => undefined);
         return p;
     }
+    deliveryQueue(fn) {
+        const p = this.deliverySerial.then(fn, fn);
+        this.deliverySerial = p.catch(() => undefined);
+        return p;
+    }
+    // ponytail: narrow panes hard-wrap the input line — collapse whitespace before comparing.
+    deliveryMatches(transcript, cmd) {
+        const norm = (s) => s.replace(/\s+/g, "");
+        const hay = norm(transcript);
+        const needle = norm(cmd);
+        return needle.length > 0 && hay.includes(needle);
+    }
     static available() {
         return process.env.HERDR_ENV === "1";
     }
     herdr(args, cwd = process.cwd(), timeoutMs) {
         return sh(`${shq(this.bin)} ${args}`, cwd, timeoutMs);
     }
+    // herdr 0.7.5 (OBS-123): an "agent" is a DETECTED agent-CLI, so `agent get <name>` no longer resolves
+    // a tickmarkr-named bash pane. Durable identity is the pane LABEL (set via `pane rename`); resolve it
+    // by reading the label back from `pane list`.
     async namedPaneId(name) {
-        const r = await this.herdr(`agent get ${shq(name)}`);
+        const r = await this.herdr(`pane list`);
         if (r.code !== 0)
             return null;
         try {
-            const id = JSON.parse(r.stdout).result?.agent?.pane_id;
-            return typeof id === "string" && id ? id : null;
+            const panes = JSON.parse(r.stdout).result?.panes;
+            if (!Array.isArray(panes))
+                return null;
+            const hit = panes.find((p) => p.label === name && typeof p.pane_id === "string" && p.pane_id);
+            return hit?.pane_id ?? null;
         }
         catch {
             return null;
@@ -106,7 +126,11 @@ export class HerdrDriver {
             throw new Error("herdr placement requires HERDR_WORKSPACE_ID — refusing untargeted pane (VIS-10: fail closed, never place by focus)");
         // pin the tab to the RUN's workspace, UNCONDITIONALLY (inherited via HERDR_WORKSPACE_ID), never the
         // operator's focused one (Intl-Dossier run-20260709-104447 incident: worker tabs opened in the tickmarkr repo workspace)
-        const t = await this.herdr(`tab create --label ${shq(label)} --no-focus --workspace ${shq(this.ws)}`);
+        // herdr 0.7.5 (OBS-123): `tab create --cwd` spawns the tab's root shell pane already at a prompt in
+        // the worktree — that root pane IS the worker pane. The old one-shot `agent start … -- bash` verb
+        // (which named a fresh bash pane) was removed; 0.7.5's `agent start` only ATTACHES to a DETECTED
+        // agent CLI, so tickmarkr names the bash pane itself via `pane rename` and types the worker command in.
+        const t = await this.herdr(`tab create --label ${shq(label)} --no-focus --workspace ${shq(this.ws)} --cwd ${shq(cwd)}`);
         if (t.code !== 0)
             throw new Error(`herdr tab create failed (exit ${t.code}, refusing untargeted placement): ${t.stderr || t.stdout}`);
         let res;
@@ -117,43 +141,27 @@ export class HerdrDriver {
             throw new Error(`herdr tab create returned unparseable JSON (refusing untargeted placement): ${t.stdout}`);
         }
         const tabId = res?.tab?.tab_id;
-        const rootPane = res?.root_pane?.pane_id; // auto-created shell pane (SKILL:343)
+        const id = res?.root_pane?.pane_id; // the tab's root shell pane, already in cwd — this run's worker pane
         if (typeof tabId !== "string" || !tabId)
             throw new Error(`herdr tab create returned no tab_id (refusing untargeted placement): ${t.stdout}`);
+        if (typeof id !== "string" || !id)
+            throw new Error(`herdr tab create returned no root pane id (refusing untargeted placement): ${t.stdout}`);
         // T5: the banner's pane identity line, derived from the T1 owned name (legacy names pass through).
         const identity = shq(paneIdentityLine(canonicalizeLegacyName(name, "")));
-        let r = await this.herdr(`agent start ${shq(name)} --cwd ${shq(cwd)} --tab ${shq(tabId)} --no-focus -- bash`);
-        if (r.code !== 0 && /agent_name_taken/.test(r.stderr + r.stdout)) {
-            // DEFECT-01: a prior (killed) process's kept pane still holds this durable name — reclaim it.
-            // The old attempt is void by construction: its worktree was rm -rf'd on re-dispatch (git.ts:34),
-            // so adoption is meaningless; close the stale PANE only (never its tab — sibling prior-run panes
-            // may still be under the operator's eye) and restart. Match BOTH streams (herdr's error-stream
-            // convention varies — Pitfall 6); an unrelated nonzero exit must never reach pane close (T-10-04).
-            const g = await this.herdr(`agent get ${shq(name)}`);
-            try {
-                const stale = JSON.parse(g.stdout).result?.agent?.pane_id;
-                if (typeof stale === "string" && stale)
-                    await this.herdr(`pane close ${shq(stale)}`);
-            }
-            catch {
-                /* holder vanished between calls (agent_not_found) — retry the start regardless */
-            }
-            r = await this.herdr(`agent start ${shq(name)} --cwd ${shq(cwd)} --tab ${shq(tabId)} --no-focus -- bash`); // once
-        }
-        if (r.code !== 0)
-            throw new Error(`herdr agent start failed: ${r.stderr || r.stdout}`); // fail closed, no loop
-        const id = JSON.parse(r.stdout).result?.agent?.pane_id;
-        if (typeof id !== "string" || !id)
-            throw new Error(`herdr agent start returned no pane id: ${r.stdout}`);
-        // tab create auto-spawns a root shell pane and agent start --tab adds the agent as a SECOND
-        // pane — reap the idle shell so no tab shows a dead "tickmarkr git:" prompt beside its agent
-        // (VIS-04 orphan fix). Best-effort: a failed reap costs cosmetics only.
-        if (typeof rootPane === "string" && rootPane && rootPane !== id) {
-            await this.herdr(`pane close ${shq(rootPane)}`);
-        }
+        // durable identity: label the PANE (resolution + reconcile read it back via `pane list`); fail closed
+        // and reap the tab we just made if the rename fails (no orphan tab).
+        const rn = await this.herdr(`pane rename ${shq(id)} ${shq(name)}`);
+        if (rn.code !== 0) {
+            await this.herdr(`tab close ${shq(tabId)}`);
+            throw new Error(`herdr pane rename failed: ${rn.stderr || rn.stdout}`);
+        }
+        // DEFECT-01: a prior (killed) process's kept pane may still carry this durable label (resume +
+        // keepPanes re-dispatches at attempt=0 into the same name). 0.7.5 rename never collides, so instead
+        // of agent_name_taken we sweep stale same-label panes and verify this fresh pane is the sole holder.
+        await this.reclaimStaleLabel(name, id);
         // VIS-10 hole 3: seed the run's workspace id into the agent pane's shell so a worker's own ad-hoc
-        // `herdr agent start` is workspace-targeted BY CONSTRUCTION — correct placement is the default a
-        // worker GETS, not a rule it must remember (P40-02 probe leak). Fail closed: a failed seed rejects.
+        // `herdr` call is workspace-targeted BY CONSTRUCTION — correct placement is the default a worker GETS,
+        // not a rule it must remember (P40-02 probe leak). Fail closed: a failed seed rejects.
         // v1.22 T3 / OBS-17: also strip HERDR_ENV + socket path so the worker cannot open/mutate panes in
         // the operator's session. Daemon-side this.herdr() calls keep process.env (unsealed).
         const seed = await this.herdr(`pane run ${shq(id)} ${shq(`export HERDR_WORKSPACE_ID=${shq(this.ws)}; export ${PANE_IDENTITY_ENV}=${identity}; ${herdrSealShellPrefix()}`)}`);
@@ -161,6 +169,32 @@ export class HerdrDriver {
             throw new Error(`herdr workspace-id seed failed (refusing untargeted pane): ${seed.stderr || seed.stdout}`);
         return { id, name, cwd, tabId };
     }
+    // DEFECT-01 (0.7.5): close any OTHER pane still carrying this durable label (a prior killed attempt's
+    // kept pane), then verify none remain — else fail closed, since `pane list` would otherwise resolve the
+    // name to an ambiguous/stale pane. No-op on the common path (no dup labels). Best-effort closes; the
+    // post-sweep re-list is the fail-closed gate (a close that does not free the name must reject).
+    async reclaimStaleLabel(name, fresh) {
+        const stale = await this.staleLabelPanes(name, fresh);
+        if (stale.length === 0)
+            return;
+        for (const p of stale)
+            await this.herdr(`pane close ${shq(p)}`);
+        if ((await this.staleLabelPanes(name, fresh)).length > 0) {
+            throw new Error(`herdr pane rename reclaim failed — durable name ${name} still held by a stale pane`);
+        }
+    }
+    async staleLabelPanes(name, fresh) {
+        const r = await this.herdr(`pane list`);
+        try {
+            const panes = JSON.parse(r.stdout).result?.panes ?? [];
+            return panes
+                .filter((p) => p.label === name && typeof p.pane_id === "string" && p.pane_id !== fresh)
+                .map((p) => p.pane_id);
+        }
+        catch {
+            return [];
+        }
+    }
     // VIS-04 role-tab (extended VIS-09 item 2): first member bootstraps generation 1 (WORKERS);
     // later members join the latest generation with live-member room via joinGroup, else a NEW
     // overflow generation tab (cleanup, cleanup, …) opens — a second `tab create`, NOT a further
@@ -239,7 +273,7 @@ export class HerdrDriver {
         // stack down. Rightward splits below the measured floor shred the marker (e8aa003 at COLUMNS≈2;
         // unrecoverable at 25 cols per measurement). Introspection failure → down (fail closed).
         const direction = entry.members.length === 1 ? workerSplitDirection(await this.paneWidth(srcPane)) : "down";
-        const sp = await this.herdr(`pane split ${shq(srcPane)} --direction ${direction} --no-focus`);
+        const sp = await this.herdr(`pane split ${shq(srcPane)} --direction ${direction} --no-focus --cwd ${shq(cwd)}`);
         if (sp.code !== 0)
             return null;
         let pane;
@@ -251,13 +285,13 @@ export class HerdrDriver {
         }
         if (typeof pane !== "string" || !pane)
             return null;
-        // the split pane is a bare shell: give it a durable agent name (SKILL:197) and VERIFY the name
-        // resolves back to this pane (research A1 is checked live per join, never assumed) — then cd the
-        // shell into this member's own worktree (a split inherits its parent's cwd, not ours).
-        const rn = await this.herdr(`agent rename ${shq(pane)} ${shq(name)}`);
+        // the split pane is a bare shell: give it a durable PANE label (0.7.5 — agent rename only binds
+        // detected agents; SKILL:197 was the old agent-name path) and VERIFY the label resolves back to this
+        // pane (research A1 is checked live per join, never assumed). `pane split --cwd` already placed the
+        // shell in this member's worktree, so no separate `cd` is needed.
+        const rn = await this.herdr(`pane rename ${shq(pane)} ${shq(name)}`);
         const verified = rn.code === 0 && (await this.paneId({ id: "", name, cwd })) === pane;
-        const cd = verified ? await this.herdr(`pane run ${shq(pane)} ${shq(`cd ${shq(cwd)}`)}`) : null;
-        if (!cd || cd.code !== 0) {
+        if (!verified) {
             await this.herdr(`pane close ${shq(pane)}`); // reap the failed join, best-effort
             return null;
         }
@@ -286,6 +320,9 @@ export class HerdrDriver {
     // cleared (C-u), and retyped, bounded; persistent corruption fails closed WITH the captured
     // transcript — the dispatch-time pincer the ledger asks for, not post-hoc `git:` archaeology.
     async run(slot, cmd) {
+        return this.deliveryQueue(() => this.deliver(slot, cmd));
+    }
+    async deliver(slot, cmd) {
         const pane = await this.paneId(slot);
         let transcript = "";
         for (let attempt = 0; attempt < DELIVERY_ATTEMPTS; attempt++) {
@@ -299,10 +336,8 @@ export class HerdrDriver {
             const typed = await this.herdr(`pane send-text ${shq(pane)} ${shq(cmd)}`, slot.cwd);
             if (typed.code !== 0)
                 throw new Error(`herdr pane send-text failed: ${typed.stderr || typed.stdout}`);
-            const back = await this.herdr(`wait output ${shq(pane)} --match ${shq(cmd)} --timeout ${DELIVERY_VERIFY_TIMEOUT_MS}`, slot.cwd, DELIVERY_VERIFY_TIMEOUT_MS + 15_000);
-            // ponytail: transcript containment (scrollback included); anchor to the prompt line if a
-            // prior echo of the same command ever false-verifies. Dead pane → error envelope → unverified.
-            if (this.waitOk(back.code, back.stdout)) {
+            const back = await this.herdr(`pane wait-output ${shq(pane)} --match ${shq(cmd)} --timeout ${DELIVERY_VERIFY_TIMEOUT_MS}`, slot.cwd, DELIVERY_VERIFY_TIMEOUT_MS + 15_000);
+            if (this.waitOk(back.code, back.stdout) || await this.deliveryReadMatches(pane, cmd, slot.cwd)) {
                 const enter = await this.herdr(`pane send-keys ${shq(pane)} Enter`, slot.cwd);
                 if (enter.code !== 0)
                     throw new Error(`herdr pane send-keys Enter failed: ${enter.stderr || enter.stdout}`);
@@ -313,6 +348,10 @@ export class HerdrDriver {
         }
         throw new Error(`herdr delivery corrupted after ${DELIVERY_ATTEMPTS} attempts — enter never pressed (OBS-85); pane transcript:\n${transcript}`);
     }
+    async deliveryReadMatches(pane, cmd, cwd) {
+        const read = await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${DELIVERY_READ_LINES}`, cwd);
+        return read.code === 0 && this.deliveryMatches(read.stdout, cmd);
+    }
     waitOk(code, stdout) {
         if (code !== 0 || !stdout.trim())
             return code === 0; // herdr's successful waits may be silent
@@ -325,12 +364,19 @@ export class HerdrDriver {
     }
     async waitOutput(slot, pattern, timeoutMs, opts) {
         const pane = await this.paneId(slot);
-        const r = await this.herdr(`wait output ${shq(pane)} --match ${shq(pattern)}${opts?.regex ? " --regex" : ""} --timeout ${Math.floor(timeoutMs)}`, slot.cwd, timeoutMs + 15_000);
+        // 0.7.5: `--match` (literal) and `--regex` (pattern) are MUTUALLY EXCLUSIVE — the old
+        // `--match <p> --regex` form is rejected ("mutually exclusive"), which made the exit-marker wait
+        // error instantly instead of waiting, so LLM-gate/consult verdicts were read before they rendered
+        // and came back unparseable. Pick exactly one flag by whether the caller wants regex.
+        const r = await this.herdr(`pane wait-output ${shq(pane)} ${opts?.regex ? "--regex" : "--match"} ${shq(pattern)} --timeout ${Math.floor(timeoutMs)}`, slot.cwd, timeoutMs + 15_000);
         return this.waitOk(r.code, r.stdout); // dead pane: exit 0 + top-level error envelope (herdr bite)
     }
     async waitAgentStatus(slot, status, timeoutMs) {
         const pane = await this.paneId(slot);
-        const r = await this.herdr(`wait agent-status ${shq(pane)} --status ${shq(status)} --timeout ${Math.floor(timeoutMs)}`, slot.cwd, timeoutMs + 15_000);
+        // 0.7.5: `wait agent-status` (top-level) was removed; `agent wait <target> --until <status>` replaces
+        // it. Target is the pane id; when herdr has detected the worker's agent CLI there this resolves, else
+        // it returns an error envelope → waitOk false (a best-effort settle, same as the old timeout path).
+        const r = await this.herdr(`agent wait ${shq(pane)} --until ${shq(status)} --timeout ${Math.floor(timeoutMs)}`, slot.cwd, timeoutMs + 15_000);
         return this.waitOk(r.code, r.stdout);
     }
     async status(slot) {
@@ -339,9 +385,13 @@ export class HerdrDriver {
     // shared by status() and the VIS-13 blocked glyph (renameGroupTab): resolve the live agent_status
     // by durable name; "unknown" on any failure (dead pane, unparseable json) — never throws.
     async statusByName(name) {
-        const r = await this.herdr(`agent get ${shq(name)}`);
+        // 0.7.5: read the pane's herdr-detected agent_status off `pane list` (keyed by the durable label);
+        // "unknown" on any failure (no such label, unparseable json) — never throws.
+        const r = await this.herdr(`pane list`);
         try {
-            const s = JSON.parse(r.stdout).result?.agent?.agent_status;
+            const panes = JSON.parse(r.stdout).result?.panes;
+            const hit = Array.isArray(panes) ? panes.find((p) => p.label === name) : undefined;
+            const s = hit?.agent_status;
             return typeof s === "string" ? s : "unknown";
         }
         catch {
@@ -409,21 +459,21 @@ export class HerdrDriver {
     async priorWatch(runId) {
         if (!this.ws)
             throw new Error("herdr watch placement requires HERDR_WORKSPACE_ID — refusing unseeded pane");
-        const list = await this.herdr("agent list");
+        const list = await this.herdr("pane list");
         if (list.code !== 0)
-            throw new Error(`herdr agent list failed: ${list.stderr || list.stdout}`);
-        let agents;
+            throw new Error(`herdr pane list failed: ${list.stderr || list.stdout}`);
+        let panes;
         try {
-            agents = JSON.parse(list.stdout).result?.agents;
+            panes = JSON.parse(list.stdout).result?.panes;
         }
         catch {
-            throw new Error(`herdr agent list returned unparseable JSON: ${list.stdout}`);
+            throw new Error(`herdr pane list returned unparseable JSON: ${list.stdout}`);
         }
-        if (!Array.isArray(agents))
-            throw new Error(`herdr agent list returned no agents: ${list.stdout}`);
-        const prior = agents.find((a) => {
-            const owned = typeof a.name === "string" ? parseOwnedName(a.name) : null;
-            return a.workspace_id === this.ws && typeof a.pane_id === "string" && owned?.role === "watch" && owned.taskId === "run" && owned.runId !== runId;
+        if (!Array.isArray(panes))
+            throw new Error(`herdr pane list returned no panes: ${list.stdout}`);
+        const prior = panes.find((p) => {
+            const owned = typeof p.label === "string" ? parseOwnedName(p.label) : null;
+            return p.workspace_id === this.ws && typeof p.pane_id === "string" && owned?.role === "watch" && owned.taskId === "run" && owned.runId !== runId;
         });
         return prior?.pane_id ?? null;
     }
@@ -446,7 +496,7 @@ export class HerdrDriver {
         }
         if (typeof pane !== "string" || !pane)
             throw new Error(`herdr watch split returned no pane id: ${sp.stdout}`);
-        const renamed = await this.herdr(`agent rename ${shq(pane)} ${shq(name)}`);
+        const renamed = await this.herdr(`pane rename ${shq(pane)} ${shq(name)}`);
         if (renamed.code !== 0 || await this.namedPaneId(name) !== pane) {
             await this.herdr(`pane close ${shq(pane)}`);
             throw new Error(`herdr watch rename failed: ${renamed.stderr || renamed.stdout}`);
@@ -476,7 +526,7 @@ export class HerdrDriver {
             }
             const prior = runId ? await this.priorWatch(runId) : null;
             if (prior) {
-                const renamed = await this.herdr(`agent rename ${shq(prior)} ${shq(name)}`);
+                const renamed = await this.herdr(`pane rename ${shq(prior)} ${shq(name)}`);
                 if (renamed.code !== 0 || await this.namedPaneId(name) !== prior) {
                     throw new Error(`herdr watch reclaim failed: ${renamed.stderr || renamed.stdout}`);
                 }
@@ -509,9 +559,12 @@ export class HerdrDriver {
         try {
             if (!this.ws)
                 return;
-            const list = await this.herdr("agent list");
-            const agents = JSON.parse(list.stdout).result?.agents ?? [];
-            const toClose = panesToClose(agents.map((a) => ({ name: a.name, paneId: a.pane_id, tabId: a.tab_id, workspaceId: a.workspace_id })), desired, this.ws, runId, opts);
+            // 0.7.5: enumerate owned panes from `pane list` (labels), not `agent list` (detected agents only).
+            // panesToClose skips any pane whose label doesn't parse as tickmarkr-owned (orchestrator/operator
+            // shells, undetected agents), so a fuller pane listing never widens the blast radius.
+            const list = await this.herdr("pane list");
+            const panes = JSON.parse(list.stdout).result?.panes ?? [];
+            const toClose = panesToClose(panes.map((p) => ({ name: p.label, paneId: p.pane_id, tabId: p.tab_id, workspaceId: p.workspace_id })), desired, this.ws, runId, opts);
             const touched = new Set();
             for (const c of toClose) {
                 if (typeof c.tabId === "string")

package/dist/gates/acceptance.js

@@ -104,10 +104,15 @@ function tail(out, n = 8) {
         return "";
     return "\n" + t.split("\n").slice(-n).join("\n");
 }
-// v1.70: the new-file line numbers each hunk actually ADDS, per changed path — parsed from the
-// unified-diff hunk headers so a citation is validated against real changed locations, not a substring
-// of the whole diff text (which also matches unchanged context lines and the diff's own +++/@@ headers).
-// Only `+` lines are changed locations; context lines advance the new-file counter but are not changes.
+// v1.70 / OBS-129: the new-file line numbers each changed HUNK spans, per path — parsed from the
+// unified-diff so a citation is validated against real changed regions, not a substring of the whole
+// diff text (which also matches the diff's own +++/@@ headers). A hunk's span is every new-file line it
+// carries: the added (`+`) lines AND the context lines git includes around them.
+// OBS-129: this is a changed-HUNK check, not an exact-added-LINE check. Requiring the exact `+` line made
+// honest judges fail closed on correct work — two frontier judges cited an adjacent line of the same
+// change (LLMs miscount exact line numbers), voiding the whole verdict. The anti-hallucination property
+// holds: a citation outside every hunk, or to an untouched file, still fails (matching the documented
+// "outside every changed hunk → rejected" contract in acceptance.test.ts).
 // ponytail: assumes git's default a/ b/ prefixes (fetchTaskDiff uses plain `git diff`); revisit if a
 // caller passes a --no-prefix diff.
 function changedLinesByFile(diff) {
@@ -137,7 +142,9 @@ function changedLinesByFile(diff) {
         if (!inHunk || path === null)
             continue;
         const c = raw[0];
-        if (c === "+") {
+        if (c === "+" || c === " ") {
+            // OBS-129: record every new-file line the hunk spans — added AND context — so a citation to an
+            // adjacent line of the same change validates, not only the exact `+` line.
             let set = byFile.get(path);
             if (!set) {
                 set = new Set();
@@ -146,17 +153,28 @@ function changedLinesByFile(diff) {
             set.add(newLine);
             newLine++;
         }
-        else if (c === " ") {
-            newLine++;
-        }
         else if (c !== "-") {
             inHunk = false; // "\ No newline", a trailing blank, or the next section — hunk body ended
         }
     }
     return byFile;
 }
-// A citation is valid evidence iff the diff adds the cited line of the cited file. A legacy free-text
-// quote (string) keeps v1.64's substring check — non-empty and present somewhere in the diff.
+// Compact a sorted set of line numbers into "3, 7-9, 14" form for the judge's citable-lines index.
+function compressLines(lines) {
+    const sorted = [...new Set(lines)].sort((a, b) => a - b);
+    const parts = [];
+    for (let i = 0; i < sorted.length;) {
+        let j = i;
+        while (j + 1 < sorted.length && sorted[j + 1] === sorted[j] + 1)
+            j++;
+        parts.push(i === j ? `${sorted[i]}` : `${sorted[i]}-${sorted[j]}`);
+        i = j + 1;
+    }
+    return parts.join(", ");
+}
+// A citation is valid evidence iff the cited line falls inside a changed hunk of the cited file (OBS-129:
+// changed-hunk span, not exact-added-line). A legacy free-text quote (string) keeps v1.64's substring
+// check — non-empty and present somewhere in the diff.
 function citesChangedLocation(evidence, changed, diff) {
     if (typeof evidence === "string")
         return evidence.trim().length > 0 && diff.includes(evidence);
@@ -213,6 +231,10 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
     if (capFail)
         return capFail;
     const expectedIds = judgeItems.map((_, index) => judgeCriterionId(index));
+    // OBS-129: give the judge the exact citable new-file line numbers per changed file, so it grounds each
+    // citation in a real changed line instead of miscounting. Validated below against this same `changed`.
+    const changed = changedLinesByFile(diff);
+    const citable = [...changed.entries()].map(([p, set]) => `- ${p}: ${compressLines([...set])}`).join("\n");
     const nonce = generateVerdictNonce();
     const prompt = `TICKMARKR-JUDGE
 You are a strict acceptance judge. Decide whether the diff satisfies EVERY acceptance criterion.
@@ -232,12 +254,15 @@ ${judgeItems.map((a, index) => `- ${renderJudgeCriterion(a, index)}`).join("\n")
 ${diff}
 \`\`\`
 
+## Citable evidence lines (new-file line numbers inside the changed hunks above)
+${citable || "(the diff changes no lines)"}
+
 ${verdictNonceLine(nonce)}
 
 Respond with ONLY this JSON (no prose before or after):
 {"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "...", "evidence": {"path": "path/to/file", "line": 42}}]}
 Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) exactly once.
-Each criteria[].evidence MUST be a structured citation {"path", "line"} pointing at a line the diff above actually adds or changes (the new-file line number); a citation to an unchanged or nonexistent location voids the whole verdict.
+Each criteria[].evidence MUST be a structured citation {"path", "line"} whose "path" and "line" appear in the "Citable evidence lines" list above (a new-file line number inside a changed hunk); a citation outside every changed hunk or to an untouched file voids the whole verdict.
 `;
     const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
     const extracted = extractVerdictJson(raw, nonce);
@@ -250,12 +275,11 @@ Each criteria[].evidence MUST be a structured citation {"path", "line"} pointing
             meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
     }
     const { verdict: v, inconsistencies } = checkJudgeVerdict(extracted, expectedIds);
-    // v1.70: each citation must point at a line the diff actually changed — validated against the hunks
-    // of `diff` (the exact string embedded in the prompt above), never the worktree or any other artifact.
-    // A citation to an untouched file or a line outside every changed hunk is a hallucinated verdict:
-    // treated as unparseable so GATE-09 retries the judge on a failover channel. (A legacy free-text quote
-    // still validates by substring, for the fake seam and pre-v1.70 fixtures.)
-    const changed = changedLinesByFile(diff);
+    // v1.70 / OBS-129: each citation must fall inside a changed hunk of `diff` (the exact string embedded in
+    // the prompt above and enumerated in the citable-lines index), never the worktree or any other artifact.
+    // A citation to an untouched file or outside every changed hunk is a hallucinated verdict: treated as
+    // unparseable so GATE-09 retries the judge on a failover channel. (A legacy free-text quote still
+    // validates by substring, for the fake seam and pre-v1.70 fixtures.) `changed` is computed above.
     const fabricated = v.criteria.filter((row) => !citesChangedLocation(row.evidence, changed, diff));
     if (fabricated.length) {
         return { gate: "acceptance", pass: false,

package/dist/route/preference.d.ts

@@ -25,3 +25,12 @@ export declare function disallowedBy(c: {
     adapter: string;
     model: string;
 }, routing: TickmarkrConfig["routing"]): Disallowed | null;
+export interface DenyPreferCollision {
+    kind: "prefer" | "pin";
+    shape: string;
+    detail: string;
+    disallowed: Disallowed;
+}
+export declare function preferEntryDenied(p: string, cfg: TickmarkrConfig): Disallowed | null;
+export declare function denyPreferCollisions(cfg: TickmarkrConfig): DenyPreferCollision[];
+export declare function denyPreferCollisionLine({ kind, shape, detail, disallowed }: DenyPreferCollision): string;