tickmarkr 1.72.0 → 1.73.0

package/dist/cli/commands/approve.js

@@ -1,5 +1,6 @@
 import { userInfo } from "node:os";
-import { ATTEMPT_CAP_RELEASE, Journal } from "../../run/journal.js";
+import { GATE_NAMES } from "../../graph/schema.js";
+import { ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal } from "../../run/journal.js";
 // GATE-08 (v1.12): approve a parked human gate so the next `tickmarkr resume <runId>` dispatches it.
 //
 // The approval is a JOURNAL EVENT (task-approved) carrying who and when — it touches ONLY the
@@ -31,15 +32,32 @@ export async function approve(argv, cwd = process.cwd()) {
     }
     // OBS-18: only the most recent task-human for this task decides whether this approval grants a
     // fresh attempt budget. The closed daemon-issued kind, never a human prose string, controls release.
-    const lastHuman = journal.read().filter((e) => e.event === "task-human" && e.taskId === taskId).at(-1);
+    const events = journal.read();
+    let lastHumanIndex = -1;
+    for (let i = events.length - 1; i >= 0; i--) {
+        if (events[i].event === "task-human" && events[i].taskId === taskId) {
+            lastHumanIndex = i;
+            break;
+        }
+    }
+    const lastHuman = events[lastHumanIndex];
     const capPark = lastHuman?.data.kind === ATTEMPT_CAP_RELEASE;
+    const gateFailPark = lastHuman?.data.kind === "gate-fail";
+    const failedGate = gateFailPark
+        ? events.slice(0, lastHumanIndex).reverse().find((e) => e.event === "gate-result" && e.taskId === taskId && e.data.pass === false
+            && typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate))?.data.gate
+        : undefined;
+    if (gateFailPark && !failedGate) {
+        throw new Error(`task ${taskId} is parked on gate-fail but has no failed gate result — refusing to infer one`);
+    }
     journal.append("task-approved", taskId, {
         by,
         ...(reason ? { reason } : {}),
         via: "cli",
         ...(capPark ? { release: ATTEMPT_CAP_RELEASE } : {}),
+        ...(failedGate ? { release: GATE_SATISFIED_RELEASE, gate: failedGate } : {}),
     });
-    return `approved ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to dispatch it`;
+    return `approved ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to ${failedGate ? "continue past the approved gate" : "dispatch it"}`;
 }
 // hand-parsed argv — no CLI framework (house style). Flags --by <name> and --reason <text>; positionals
 // are runId then taskId. Throws usage on missing positionals (mirrors resume.ts/unlock.ts).

package/dist/cli/commands/resume.js

@@ -8,17 +8,25 @@ const summaryGreen = (s) => s.failed.length === 0 && s.human.length === 0 && s.b
 export async function resume(argv, cwd = process.cwd()) {
     const runId = argv[0];
     if (!runId)
-        throw new Error("usage: tickmarkr resume <run-id>");
+        throw new Error("usage: tickmarkr resume <run-id> [--graph-changed] [--retry-failed]");
     // T3: --graph-changed is the operator's audited release of the engagement-identity guard (Sol #2 /
     // Fable F2) — the daemon refuses a mismatched/unbound journal unless this is set, then journals a
     // graph-rehash event naming both hashes. Strip the flag before runId resolution so a bare id still wins.
     const graphChanged = argv.includes("--graph-changed");
+    const retryFailed = argv.includes("--retry-failed");
     const cfg = loadConfig(cwd);
     const collisions = denyPreferCollisions(cfg);
     if (collisions.length) {
         throw new Error(collisions.map(denyPreferCollisionLine).join("; "));
     }
-    const s = await runDaemon(cwd, { runId, resume: true, graphChanged, driver: pickDriver(cfg), narrate: (event) => console.log(formatJournalNarration(event)) });
+    const s = await runDaemon(cwd, {
+        runId,
+        resume: true,
+        graphChanged,
+        retryFailed,
+        driver: pickDriver(cfg),
+        narrate: (event) => console.log(formatJournalNarration(event)),
+    });
     const out = `resumed ${s.runId} — ${formatSummary(s)}`;
     return { out, code: summaryGreen(s) ? 0 : 2 };
 }

package/dist/cli/commands/status.d.ts

@@ -3,6 +3,8 @@ import { type JournalEvent } from "../../run/journal.js";
 export type StatusOpts = {
     iterations?: number;
     sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    readWorkerOutput?: (taskId: string, attempt: number, runId: string) => Promise<string | undefined>;
 };
 export declare const GATE_KEYS: {
     readonly build: "B";

package/dist/cli/commands/status.js

@@ -1,8 +1,11 @@
 import { BANNER, GLYPHS, dim, fail, legend, ok, rule, statusRow, title, warn } from "../../brand.js";
+import { HerdrDriver } from "../../drivers/herdr.js";
+import { formatOwnedName } from "../../drivers/types.js";
 import { blockedTasks, graphDefinitionHash, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { foldActivity } from "../../run/activity.js";
 import { Journal, engagementComparable, isQualityFailureParkKind, recordedTaskFailureKind, runHasEnded, } from "../../run/journal.js";
+import { normalizeStallSnapshot } from "../../run/stall.js";
 // ponytail: fixed 2s refresh; promote to config.visibility.* only when an operator asks.
 const REFRESH_MS = 2000;
 const NOT_COMPARABLE_NOTICE = "graph recompiled since this run — task states not comparable; run `tickmarkr run` to execute";
@@ -10,6 +13,87 @@ const NOT_COMPARABLE_NOTICE = "graph recompiled since this run — task states n
 // first frame, so a live `--watch` printed once and exited 0 (OBS-11). Never unref this.
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export const GATE_KEYS = { build: "B", test: "T", lint: "L", evidence: "E", scope: "S", acceptance: "A", review: "R" };
+const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+const ASCII_SPINNER = ["|", "/", "-", "\\"];
+const SAVE_TERMINAL_TITLE = "\x1b[22;0t";
+const RESTORE_TERMINAL_TITLE = "\x1b[23;0t";
+const taskPhase = (value) => {
+    if (value === "worker" || value === "gates" || value === "judge" || value === "review" || value === "merge")
+        return value;
+    if (typeof value !== "string" || !value.startsWith("gate:"))
+        return undefined;
+    return GATE_NAMES.includes(value.slice("gate:".length)) ? value : undefined;
+};
+const phaseGate = (phase) => {
+    if (phase === "judge")
+        return "acceptance";
+    if (phase === "review")
+        return "review";
+    return phase.startsWith("gate:") ? phase.slice("gate:".length) : undefined;
+};
+// A phase is live only between its append-only start marker and the matching real outcome. A newer
+// start for the same task supersedes the prior phase (gates → named gate, worker retry → worker).
+// No clock participates in this fold: time only decorates the derived live interval at render time.
+const livePhases = (events) => {
+    const live = new Map();
+    for (let order = 0; order < events.length; order++) {
+        const event = events[order];
+        if (event.event === "run-start" || event.event === "run-resume" || event.event === "run-end" || event.event === "superseded") {
+            live.clear();
+            continue;
+        }
+        if (event.event === "phase-start" && event.taskId) {
+            const phase = taskPhase(event.data.phase);
+            const startedAt = Date.parse(event.ts);
+            const attempt = typeof event.data.attempt === "number" && Number.isInteger(event.data.attempt) && event.data.attempt >= 0
+                ? event.data.attempt
+                : 0;
+            if (phase && Number.isFinite(startedAt))
+                live.set(event.taskId, { taskId: event.taskId, phase, startedAt, order, attempt });
+            continue;
+        }
+        if (!event.taskId)
+            continue;
+        const active = live.get(event.taskId);
+        if (!active)
+            continue;
+        const gate = phaseGate(active.phase);
+        const matched = (active.phase === "worker" && event.event === "worker-result")
+            || (active.phase === "gates" && event.event === "gate-result")
+            || (gate !== undefined && event.event === "gate-result" && event.data.gate === gate)
+            || (active.phase === "merge" && event.event === "merge")
+            || event.event === "task-done"
+            || event.event === "task-failed"
+            || event.event === "task-human"
+            || event.event === "task-approved"
+            || event.event === "task-dispatch";
+        if (matched)
+            live.delete(event.taskId);
+    }
+    return live;
+};
+const phaseLabel = (phase) => phase.startsWith("gate:") ? `gate ${phase.slice("gate:".length)}` : phase;
+const fmtElapsed = (ms) => {
+    const seconds = Math.max(0, Math.floor(ms / 1000));
+    if (seconds < 60)
+        return `${seconds}s`;
+    const minutes = Math.floor(seconds / 60);
+    if (minutes < 60)
+        return `${minutes}m${seconds % 60}s`;
+    const hours = Math.floor(minutes / 60);
+    return `${hours}h${minutes % 60}m${seconds % 60}s`;
+};
+const workerOutputAge = (phase, now, worker) => now - (worker?.phaseStartedAt === phase.startedAt && worker.hasOutput ? worker.lastOutputAt : phase.startedAt);
+const phaseDetail = (phase, now, worker) => {
+    const elapsed = fmtElapsed(now - phase.startedAt);
+    if (phase.phase !== "worker")
+        return `${phaseLabel(phase.phase)} · ${elapsed} elapsed`;
+    const age = fmtElapsed(workerOutputAge(phase, now, worker));
+    const output = worker?.phaseStartedAt === phase.startedAt && worker.hasOutput
+        ? `last output ${age} ago`
+        : `no output ${age}`;
+    return `${phaseLabel(phase.phase)} · ${elapsed} elapsed · ${output}`;
+};
 const attemptStartIdx = (events, taskId) => {
     let idx = -1;
     for (let i = 0; i < events.length; i++) {
@@ -114,11 +198,11 @@ const terminalFailureCause = (events) => {
     }
     return undefined;
 };
-const liveness = (events) => {
+const liveness = (events, now = Date.now()) => {
     const last = events.at(-1);
     if (!last)
         return "last event unknown · daemon pid unknown";
-    const age = fmtAge(Date.now() - Date.parse(last.ts));
+    const age = fmtAge(now - Date.parse(last.ts));
     const pid = daemonPid(events);
     const cause = terminalFailureCause(events);
     if (pid === undefined)
@@ -136,7 +220,7 @@ const liveness = (events) => {
     } // EPERM ⇒ alive
     return `last event ${age} ago · daemon pid ${pid} ${state}${cause ? ` · ${cause}` : ""}`;
 };
-const renderFrame = (cwd) => {
+const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness = new Map()) => {
     const g = loadGraph(cwd);
     const runId = Journal.latestRunId(cwd, { withJournal: true });
     const assignments = new Map();
@@ -179,6 +263,12 @@ const renderFrame = (cwd) => {
     const width = process.stdout.columns ?? 120;
     const done = effective.tasks.filter((t) => t.status === "done").length;
     const ended = comparable && runHasEnded(events);
+    const taskIds = new Set(g.tasks.map((task) => task.id));
+    const phases = comparable ? livePhases(events) : new Map();
+    for (const taskId of phases.keys())
+        if (!taskIds.has(taskId))
+            phases.delete(taskId);
+    const hotPhase = [...phases.values()].sort((a, b) => a.order - b.order).at(-1);
     const cells = g.tasks.map((t) => {
         const st = replayed?.get(t.id) ?? t.status;
         const failureKind = comparable ? recordedTaskFailureKind(events, t.id) : undefined;
@@ -188,27 +278,34 @@ const renderFrame = (cwd) => {
         const redTier = terminal && (ended
             || (failureKind !== undefined && isQualityFailureParkKind(failureKind))
             || (st === "failed" && failureKind === undefined));
-        const isStarved = starved.has(t.id);
-        const phrase = isStarved ? undefined : activity.cells.get(t.id);
+        const livePhase = phases.get(t.id);
+        const isStarved = !livePhase && starved.has(t.id);
+        const phrase = livePhase ? phaseDetail(livePhase, now, workerLiveness.get(t.id)) : isStarved ? undefined : activity.cells.get(t.id);
         const label = isStarved ? " starved" : phrase ? ` ${phrase}` : "";
         const channel = assignments.get(t.id) ?? "-";
         const ctx = contexts.get(t.id);
         const assignCol = ctx !== undefined ? `${channel}${divider}ctx ${ctx}` : channel;
-        return { t, st, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, states: comparable ? gateStates(t, events) : defaultGateStates(t) };
+        return { t, st, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, livePhase, states: comparable ? gateStates(t, events) : defaultGateStates(t) };
     });
     if (!unicode) {
-        // machine/CI surface — layout unchanged (pipes, greps, and the golden pins depend on it)
-        const rows = cells.map(({ t, st, label, assignCol, states }) => {
+        // machine/CI surface — journals without phase-start stay byte-identical; new phase-aware frames
+        // use an ASCII spinner so pipes never receive terminal-only braille/ANSI.
+        const rows = cells.map(({ t, st, label, assignCol, livePhase, states }) => {
             const chain = gateChain(states, false);
-            const prefix = `  ${taskBox(st)} ${t.id} `;
-            const suffix = `  ${chain}  ${String(st)}${label}  ${assignCol}`;
+            const prefix = livePhase ? `  ${ASCII_SPINNER[animationFrame % ASCII_SPINNER.length]} ${t.id} ` : `  ${taskBox(st)} ${t.id} `;
+            const suffix = `  ${chain}  ${livePhase ? "running" : String(st)}${label}  ${assignCol}`;
             return `${prefix}${shortGoal(t.goal, Math.max(0, width - prefix.length - suffix.length))}${suffix}`;
         });
         const header = runId
-            ? `tickmarkr status${divider}run ${runId}${supersededBy ? `${divider}superseded by ${supersededBy}` : ""}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events).replaceAll(" · ", divider)}${divider}${done}/${g.tasks.length} done`
+            ? `tickmarkr status${divider}run ${runId}${supersededBy ? `${divider}superseded by ${supersededBy}` : ""}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events, now).replaceAll(" · ", divider)}${divider}${done}/${g.tasks.length} done`
             : `tickmarkr status${divider}no runs yet${divider}${done}/${g.tasks.length} done`;
         const legendLine = `  gates: ${GATE_NAMES.map((gate) => `${GATE_KEYS[gate]} ${gate}`).join(divider)}`;
-        return [header, legendLine, ...rows].join("\n");
+        return {
+            content: [header, legendLine, ...rows].join("\n"),
+            ...(hotPhase ? { hotPhase } : {}),
+            ...(runId ? { runId } : {}),
+            workerPhases: [...phases.values()].filter((phase) => phase.phase === "worker"),
+        };
     }
     // TTY: cockpit frame composed through src/brand.ts (CLI-DESIGN.md) — dominant run title,
     // dim chrome, semantic color only on verdicts, completion gauge, and column-aligned status
@@ -219,7 +316,7 @@ const renderFrame = (cwd) => {
     const gaugeCells = 10;
     const fill = g.tasks.length ? Math.round((done / g.tasks.length) * gaugeCells) : 0;
     const gauge = (fill ? (anyFailed ? fail : ok)("█".repeat(fill)) : "") + (fill < gaugeCells ? dim("░".repeat(gaugeCells - fill)) : "");
-    const live = liveness(events)
+    const live = liveness(events, now)
         .replace(/\bdead\b/, fail("dead"))
         .replace(/\bfinished\b/, dim("finished"))
         .replace(/\balive\b/, ok("alive"))
@@ -241,7 +338,7 @@ const renderFrame = (cwd) => {
     // aligned under the goal: gate chain, live activity phrase (or channel), ctx. Long channel names
     // and activity phrases live on line 2 only, so they can never squeeze the goal or wrap line 1.
     const taskVerdict = (c) => c.st === "done" ? "pass" : c.redTier ? "fail" : c.st === "failed" || c.st === "human" ? "warn" : "neutral";
-    const statusWord = (c) => c.redTier ? "failed" : c.st === "failed" ? "warn" : String(c.st);
+    const statusWord = (c) => c.livePhase ? "running" : c.redTier ? "failed" : c.st === "failed" ? "warn" : String(c.st);
     const idW = Math.max(...cells.map((c) => c.t.id.length), 2);
     // plain-text status suffixes for width math only — starved / failed gate names / approval hint
     const suffixPlain = (c) => (c.isStarved ? " · starved" : "") + failedSuffix(c.states) + humanGateSuffix(c.t, c.st, c.states);
@@ -251,9 +348,11 @@ const renderFrame = (cwd) => {
     const goalW = Math.max(8, ...goals.map((s) => s.length));
     const indent = " ".repeat(idW + 5); // line 2 starts under the goal column
     const rows = cells.map((c, i) => {
-        const { t, st, failureKind, redTier, states, isStarved, phrase, channel, ctx } = c;
+        const { t, st, failureKind, redTier, states, isStarved, phrase, channel, ctx, livePhase } = c;
         const word = statusWord(c);
-        const stWord = st === "done" ? ok(word) : redTier ? fail(word) : st === "failed" || st === "human" ? warn(word) : word;
+        const staleWorker = livePhase?.phase === "worker"
+            && workerOutputAge(livePhase, now, workerLiveness.get(t.id)) >= 60_000;
+        const stWord = staleWorker ? warn(word) : st === "done" ? ok(word) : redTier ? fail(word) : st === "failed" || st === "human" ? warn(word) : word;
         // a fail names its gate in words right here — the one moment gate identity is needed on a row
         const f = failedGates(states);
         const human = humanGateSuffix(t, st, states);
@@ -261,7 +360,10 @@ const renderFrame = (cwd) => {
             (isStarved ? dot + fail("starved") : "") +
             (f.length ? dot + fail(f.join(", ")) : "") +
             (human ? dot + warn("awaiting approval") : "");
-        const line1 = `  ${statusRow(taskVerdict(c), `${t.id.padEnd(idW)} ${goals[i].padEnd(goalW)}  ${statusCell}`)}`;
+        const taskLabel = `${t.id.padEnd(idW)} ${goals[i].padEnd(goalW)}  ${statusCell}`;
+        const line1 = livePhase
+            ? `  ${(staleWorker ? warn : dim)(SPINNER[animationFrame % SPINNER.length])} ${taskLabel}`
+            : `  ${statusRow(taskVerdict(c), taskLabel)}`;
         // activity already names its channel for in-flight attempts — never repeat it
         const detail = [
             ...(phrase ? [phrase, ...(phrase.includes(channel) || channel === "-" ? [] : [channel])] : [channel]),
@@ -272,28 +374,115 @@ const renderFrame = (cwd) => {
     }).flat();
     if (!nowLine.length)
         rows.pop(); // cards end blank-separated; drop the dangling one
-    return [header, hr, gatesLegend, "", ...rows, ...nowLine].join("\n");
+    return {
+        content: [header, hr, gatesLegend, "", ...rows, ...nowLine].join("\n"),
+        ...(hotPhase ? { hotPhase } : {}),
+        ...(runId ? { runId } : {}),
+        workerPhases: [...phases.values()].filter((phase) => phase.phase === "worker"),
+    };
 };
 export async function status(argv, cwd = process.cwd(), opts = {}) {
     // cockpit surface: banner + frame on a TTY (doctor's pattern); pipes get the bare frame
-    if (!argv.includes("--watch"))
-        return visual() ? BANNER + renderFrame(cwd) : renderFrame(cwd);
+    if (!argv.includes("--watch")) {
+        const { content } = renderFrame(cwd, opts.now?.() ?? Date.now());
+        return visual() ? BANNER + content : content;
+    }
     const iterations = opts.iterations ?? Infinity;
     const sleep = opts.sleep ?? defaultSleep;
+    const now = opts.now ?? Date.now;
     const bounded = Number.isFinite(iterations);
     const frames = [];
     const sep = "\n---\n";
     const tty = visual();
-    for (let i = 0; i < iterations; i++) {
-        const frame = renderFrame(cwd);
-        if (tty)
-            process.stdout.write(`\x1b[2J\x1b[H${BANNER}${frame}\n${legend(` watching · refresh ${REFRESH_MS / 1000}s · ^C to quit`)}`);
-        else
-            process.stdout.write(frame + sep);
-        if (bounded)
-            frames.push(frame);
-        if (i + 1 < iterations)
-            await sleep(REFRESH_MS);
+    const workerLiveness = new Map();
+    const herdr = HerdrDriver.available() ? new HerdrDriver() : undefined;
+    const readWorkerOutput = opts.readWorkerOutput ?? (herdr
+        ? async (taskId, attempt, runId) => {
+            const name = formatOwnedName({ role: "worker", taskId, attempt, runId });
+            try {
+                return await herdr.read({ id: name, name, cwd }, 80);
+            }
+            catch {
+                return undefined;
+            }
+        }
+        : undefined);
+    const observeWorkerOutput = async (active, runId, observedAt) => {
+        const activeIds = new Set(active.map((phase) => phase.taskId));
+        for (const taskId of workerLiveness.keys())
+            if (!activeIds.has(taskId))
+                workerLiveness.delete(taskId);
+        if (!readWorkerOutput || !runId)
+            return;
+        await Promise.all(active.map(async (phase) => {
+            const output = await readWorkerOutput(phase.taskId, phase.attempt, runId);
+            if (output === undefined)
+                return;
+            const snapshot = normalizeStallSnapshot(output);
+            const prior = workerLiveness.get(phase.taskId);
+            if (!prior || prior.phaseStartedAt !== phase.startedAt) {
+                const hasOutput = snapshot.trim().length > 0;
+                workerLiveness.set(phase.taskId, {
+                    phaseStartedAt: phase.startedAt,
+                    snapshot,
+                    hasOutput,
+                    lastOutputAt: hasOutput ? observedAt : phase.startedAt,
+                });
+                return;
+            }
+            if (snapshot !== prior.snapshot && snapshot.trim().length > 0) {
+                prior.hasOutput = true;
+                prior.lastOutputAt = observedAt;
+            }
+            prior.snapshot = snapshot;
+        }));
+    };
+    let titleSaved = false;
+    const restoreTitle = () => {
+        if (!titleSaved)
+            return;
+        titleSaved = false;
+        process.stdout.write(RESTORE_TERMINAL_TITLE);
+    };
+    const updateTitle = (hotPhase, nowMs) => {
+        if (!hotPhase) {
+            if (titleSaved) {
+                process.removeListener("exit", restoreTitle);
+                restoreTitle();
+            }
+            return;
+        }
+        if (!titleSaved) {
+            process.stdout.write(SAVE_TERMINAL_TITLE);
+            titleSaved = true;
+            process.once("exit", restoreTitle);
+        }
+        process.stdout.write(`\x1b]0;⏳ ${hotPhase.taskId} ${phaseLabel(hotPhase.phase)} ${fmtElapsed(nowMs - hotPhase.startedAt)}\x07`);
+    };
+    try {
+        for (let i = 0; i < iterations; i++) {
+            const nowMs = now();
+            const frame = renderFrame(cwd, nowMs, i, workerLiveness);
+            if (tty) {
+                updateTitle(frame.hotPhase, nowMs);
+                process.stdout.write(`\x1b[2J\x1b[H${BANNER}${frame.content}\n${legend(` watching · refresh ${REFRESH_MS / 1000}s · ^C to quit`)}`);
+            }
+            else {
+                process.stdout.write(frame.content + sep);
+            }
+            if (bounded)
+                frames.push(frame.content);
+            if (i + 1 < iterations) {
+                await observeWorkerOutput(frame.workerPhases, frame.runId, nowMs);
+                await sleep(REFRESH_MS);
+            }
+        }
+    }
+    finally {
+        if (titleSaved) {
+            process.removeListener("exit", restoreTitle);
+            restoreTitle();
+        }
     }
     return bounded ? frames.join(sep) : "";
 }

package/dist/cli/commands/ui.d.ts

@@ -1,5 +1,9 @@
-import { type StudioOptions } from "../../tui/app.js";
-export declare function ui(_argv: string[], io?: Partial<StudioOptions>): Promise<string | {
+type StudioIO = {
+    input: NodeJS.ReadStream;
+    output: NodeJS.WriteStream;
+};
+export declare function ui(_argv: string[], io?: Partial<StudioIO>): Promise<string | {
     out: string;
     code: number;
 }>;
+export {};

package/dist/cli/commands/ui.js

@@ -1,4 +1,3 @@
-import { StudioApp } from "../../tui/app.js";
 const NON_TTY_MSG = "tickmarkr ui: studio requires a TTY — use `tickmarkr fleet --print` or `tickmarkr status --watch` for line-mode output";
 export async function ui(_argv, io = {}) {
     const input = io.input ?? process.stdin;
@@ -6,8 +5,7 @@ export async function ui(_argv, io = {}) {
     if (input.isTTY !== true || output.isTTY !== true) {
         return { out: NON_TTY_MSG, code: 1 };
     }
-    const app = new StudioApp({ input, output });
-    app.start();
-    await app.exited;
+    const { runStudioInk } = await import("../../tui/ink/studio-app.js");
+    await runStudioInk({ input, output });
     return "ui: closed";
 }

package/dist/config/config.d.ts

@@ -109,6 +109,10 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
         deny: z.ZodOptional<z.ZodObject<{
             adapters: z.ZodOptional<z.ZodArray<z.ZodString>>;
             models: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            workers: z.ZodOptional<z.ZodObject<{
+                adapters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                models: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
         }, z.core.$strip>>;
     }, z.core.$strip>;
     tiers: z.ZodRecord<z.ZodString, z.ZodObject<{

package/dist/config/config.js

@@ -51,6 +51,9 @@ const PrefBlockSchema = z.object({
     adapters: z.array(z.string()).optional(),
     models: z.array(z.string()).optional(),
 });
+const DenyBlockSchema = PrefBlockSchema.extend({
+    workers: PrefBlockSchema.optional(),
+});
 // v1.20 REC-02: operator-maintained price table for the usage/cost report (src/report/cost.ts). Two
 // channel economics, never conflated (spec cost model): API = tokens × per-Mtok rate; sub = flat plan
 // amortized over a windows/month RANGE (+ an API-equivalent counterfactual when the model has a rate).
@@ -125,7 +128,7 @@ export const TickmarkrConfigSchema = z.object({
         // Pre-v1.21 doctor.json lacks per-model verdicts. Keep legacy unknown-is-routable behavior opt-in.
         allowUnverifiedModels: z.boolean(),
         allow: PrefBlockSchema.optional(),
-        deny: PrefBlockSchema.optional(),
+        deny: DenyBlockSchema.optional(),
     }),
     tiers: z.record(z.string(), TierEntrySchema),
     pricing: z.record(z.string(), z.number()),
@@ -471,6 +474,8 @@ export function configTemplate(overlay) {
 #   deny:                                      # optional fleet denylist; deny beats allow on conflict
 #     models:
 #       - pi:zai/glm-5.2  # OBS-57: pi passes run-start probe but hangs at finish without TICKMARKR_RESULT — remove after no-trailer demotion ships (v1.46 provider-outage taxonomy)
+#     workers:                                  # optional worker-only deny; flat adapters/models still deny every role
+#       models: [kimi:kimi-code/k3]
 #   # incident-born deny/pin entries MUST name OBS id + root cause + removal condition (see docs/codebase/CONVENTIONS.md)
 #   # entry grammar: adapter id | model id | adapter:model (entries in either list accept all three forms)
 #   # a hint pinning a denied channel FAILS at plan time (RoutingError) — never silent reroute

package/dist/drivers/herdr.d.ts

@@ -12,12 +12,16 @@ export declare class HerdrDriver implements ExecutorDriver {
     private groups;
     private groupSerial;
     private deliverySerial;
+    private dispatchLeases;
+    private deliveredPanes;
     private ws;
     private callerPane;
     private watches;
     constructor(bin?: string, workersPerTab?: number);
     private serial;
     private deliveryQueue;
+    private reserveDispatch;
+    private verifyPaneIdentityBinding;
     private deliveryMatches;
     static available(): boolean;
     private herdr;

package/dist/drivers/herdr.js

@@ -25,8 +25,11 @@ export class HerdrDriver {
     // grouped slot()/close() mutate shared group state across awaits — serialize them so two
     // concurrent first members can never both create the group tab (mergeSerial idiom, daemon.ts)
     groupSerial = Promise.resolve();
-    // OBS-119: concurrent deliveries contend on herdr's send path — one chain per driver (mergeSerial idiom)
+    // OBS-120: canonical dispatch slots hold this chain from allocation through verified binding and
+    // delivery. Legacy/manual slots still serialize each delivery on the same chain (OBS-119).
     deliverySerial = Promise.resolve();
+    dispatchLeases = new WeakMap();
+    deliveredPanes = new WeakMap();
     // VIS-10: the run's workspace id, captured once at construction (the daemon inherits it from the
     // operator's env before the driver is built). Required at slot() time, never in the constructor —
     // pickDriver and its unit test construct HerdrDriver without env, so slot() is the trust gate.
@@ -47,6 +50,41 @@ export class HerdrDriver {
         this.deliverySerial = p.catch(() => undefined);
         return p;
     }
+    // OBS-120: ExecutorDriver exposes slot() and run() separately, so a canonical tickmarkr slot
+    // carries a lease across that API seam. The next dispatch cannot allocate until this slot's first
+    // run either delivers or fails. Allocation errors release immediately; no failed dispatch poisons
+    // the queue. The daemon calls run() directly after preparing the command for every owned slot.
+    reserveDispatch(allocate) {
+        let release;
+        const held = new Promise((resolve) => { release = resolve; });
+        const start = this.deliverySerial.then(() => undefined, () => undefined);
+        this.deliverySerial = start.then(() => held);
+        return start.then(async () => {
+            let slot;
+            try {
+                slot = await allocate();
+                this.dispatchLeases.set(slot, { release });
+                return slot;
+            }
+            catch (error) {
+                if (slot) {
+                    try {
+                        await this.close(slot);
+                    }
+                    catch { /* allocation already failed closed; cleanup is best-effort */ }
+                }
+                release();
+                throw error;
+            }
+        });
+    }
+    async verifyPaneIdentityBinding(slot) {
+        const paneId = await this.namedPaneId(slot.name);
+        if (paneId !== slot.id) {
+            throw new Error(`herdr pane identity binding verification failed for ${slot.name}: allocated ${slot.id}, resolved ${paneId ?? "none"} — refusing delivery`);
+        }
+        return paneId;
+    }
     // ponytail: narrow panes hard-wrap the input line — collapse whitespace before comparing.
     deliveryMatches(transcript, cmd) {
         const norm = (s) => s.replace(/\s+/g, "");
@@ -78,8 +116,12 @@ export class HerdrDriver {
             return null;
         }
     }
-    // pane ids compact when panes close — resolve fresh via the durable agent name (spec §5)
+    // Before delivery, resolve fresh via the durable name because pane ids can compact. After delivery,
+    // pin the verified target so early liveness cannot drift to a label rebound onto another pane.
     async paneId(slot) {
+        const delivered = this.deliveredPanes.get(slot);
+        if (delivered)
+            return delivered;
         return await this.namedPaneId(slot.name) ?? slot.id;
     }
     // VIS-09 P43-03: runtime width for the layout gate (43-MEASUREMENT.md licensing condition 2).
@@ -104,12 +146,18 @@ export class HerdrDriver {
         // reconcile.ts and this driver's own renameGroupTab/glyphFor decode role/taskId/attempt from
         // those shapes without a call-site migration; T2 retires this branch by always passing `owned`.
         const resolved = opts?.owned ? formatOwnedName(opts.owned) : name;
+        const allocate = opts?.group
+            ? () => this.serial(() => this.groupSlot(cwd, resolved, opts.group))
+            : () => this.tabSlot(cwd, resolved, opts?.label);
+        // Production dispatch names are canonical even when the gate call site supplies the already-
+        // formatted name rather than SlotOpts.owned. Hold one lease across slot() → run(); legacy/manual
+        // slots retain their existing allocation-only semantics for compatibility.
+        if (parseOwnedName(resolved))
+            return this.reserveDispatch(allocate);
         // group wins if both are set (a group tab is already stage-labeled; passing both is a caller bug).
         // label (without group) → dedicated labeled tab via tabSlot's third param: no groups-map entry, no
         // refcount, no groupSerial, no degrade latch — dedicated tabs have no shared state to guard (SUP-01).
-        if (opts?.group)
-            return this.serial(() => this.groupSlot(cwd, resolved, opts.group));
-        return this.tabSlot(cwd, resolved, opts?.label); // label undefined → defaults to name (today's behavior)
+        return allocate(); // label undefined → defaults to name (today's behavior)
     }
     // today's per-slot tab path, plus the VIS-04 orphan reap
     // label defaults to the slot name; group tabs pass the STAGE name instead — a first-member label
@@ -320,10 +368,26 @@ export class HerdrDriver {
     // cleared (C-u), and retyped, bounded; persistent corruption fails closed WITH the captured
     // transcript — the dispatch-time pincer the ledger asks for, not post-hoc `git:` archaeology.
     async run(slot, cmd) {
-        return this.deliveryQueue(() => this.deliver(slot, cmd));
+        const lease = this.dispatchLeases.get(slot);
+        if (lease) {
+            this.dispatchLeases.delete(slot);
+            try {
+                const paneId = await this.verifyPaneIdentityBinding(slot);
+                await this.deliver(slot, cmd, paneId);
+                this.deliveredPanes.set(slot, paneId);
+            }
+            finally {
+                lease.release();
+            }
+            return;
+        }
+        return this.deliveryQueue(async () => {
+            const paneId = await this.paneId(slot);
+            await this.deliver(slot, cmd, paneId);
+            this.deliveredPanes.set(slot, paneId);
+        });
     }
-    async deliver(slot, cmd) {
-        const pane = await this.paneId(slot);
+    async deliver(slot, cmd, pane) {
         let transcript = "";
         for (let attempt = 0; attempt < DELIVERY_ATTEMPTS; attempt++) {
             if (attempt > 0) {