tickmarkr 1.77.0 → 1.79.0

package/dist/adapters/claude-code.d.ts

@@ -1,5 +1,16 @@
 import { type AuthHealth, type TrustDialog, type WorkerAdapter } from "./types.js";
+export declare const CLAUDE_ALIAS_IDENTITY_STAMPS: {
+    readonly fable: "claude-fable-5";
+    readonly opus: "claude-opus-4-8";
+    readonly sonnet: "claude-sonnet-5";
+    readonly haiku: "claude-haiku-4-5-20251001";
+};
+export type ClaudeAlias = keyof typeof CLAUDE_ALIAS_IDENTITY_STAMPS;
+export type ClaudeAliasIdentityProbe = (cwd: string, alias: ClaudeAlias) => string | undefined;
 export declare const CLAUDE_TRUST_DIALOG: TrustDialog;
 export declare function claudeSlug(real: string): string;
+export declare function readClaudeAliasIdentity(cwd: string, alias: ClaudeAlias): string | undefined;
+export declare function probeClaudeAliasIdentity(cwd: string, alias: ClaudeAlias): string | undefined;
+export declare function resolveClaudeAliasIdentity(cwd: string, alias: ClaudeAlias, probe?: ClaudeAliasIdentityProbe): string | undefined;
 export declare function probeVersion(bin: string): AuthHealth;
 export declare const claudeCode: WorkerAdapter;

package/dist/adapters/claude-code.js

@@ -3,7 +3,7 @@ import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { parseWorkerResult } from "./prompt.js";
-import { channelsFromConfig, shq, TokenUsageSchema } from "./types.js";
+import { channelsFromConfig, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
 // SPEND-01/SPEND-11: claude writes a per-session JSONL to ~/.claude/projects/<slug>/ where slug is the
 // realpath'd cwd with every non-alphanumeric char replaced by "-" (verified 114/114 — 36-DIAGNOSIS.md).
 // The old `/`-only formula missed the "." in `.tickmarkr/worktrees/…` — ENOENT on every worktree dispatch.
@@ -20,6 +20,20 @@ import { channelsFromConfig, shq, TokenUsageSchema } from "./types.js";
 // Phase 18's operator-price × tokens derivation, not a CLI claim.
 const MAX_SESSION_FILES = 20; // newest-first; a long-lived project dir can hold many sessions
 const MAX_SESSION_BYTES = 8_000_000; // per-file cap; a runaway JSONL cannot make the read unbounded
+// OBS-145: these aliases float at the Claude CLI layer, while their tier/pricing decisions were
+// made for the dated identities below (claude-code seeds stamped 2026-07-09 — doctor's own lint).
+// Updating a stamp is a deliberate benchmark-policy act; doctor only compares against it and never
+// edits tiers, pricing, learned scores, or routing. `opus` is deliberately left at 4-8: the OBS-145
+// drill probed the alias at claude-opus-4-8 matching its stamp, then captured it re-pointing to
+// claude-opus-5 ~30 min later with zero events fired. The 2026-07-24 fit added an EXPLICIT
+// claude-opus-5 channel to the repo overlay — it did not re-date this alias's stamps, so the
+// alias channel still carries 4-8-dated tier/pricing while serving 5. That warning is true.
+export const CLAUDE_ALIAS_IDENTITY_STAMPS = {
+    fable: "claude-fable-5",
+    opus: "claude-opus-4-8",
+    sonnet: "claude-sonnet-5",
+    haiku: "claude-haiku-4-5-20251001",
+};
 // v1.75 T2 / OBS-137: current Claude Code workspace-trust prompt (2.1.218). The full question
 // distinguishes this startup gate from routine agent text; Enter accepts the selected trust option.
 export const CLAUDE_TRUST_DIALOG = {
@@ -29,6 +43,95 @@ export const CLAUDE_TRUST_DIALOG = {
 export function claudeSlug(real) {
     return real.replace(/[^A-Za-z0-9]/g, "-");
 }
+// newest-first by mtime, bounded — mtime picks WHICH files to scan, never a record's cursor.
+// Shared by collectUsage (spend) and readClaudeAliasIdentity (OBS-145): same store, same bounds.
+function newestSessionFiles(dir) {
+    return readdirSync(dir)
+        .filter((f) => f.endsWith(".jsonl"))
+        .map((f) => {
+        try {
+            return { f, m: statSync(join(dir, f)).mtimeMs };
+        }
+        catch {
+            return undefined; // a stat failure just drops that file
+        }
+    })
+        .filter((x) => x !== undefined)
+        .sort((a, b) => b.m - a.m)
+        .slice(0, MAX_SESSION_FILES)
+        .map((x) => x.f);
+}
+const belongsToAliasFamily = (identity, alias) => identity === alias || identity.split(/[^A-Za-z0-9]+/).includes(alias);
+// Zero-token first choice: Claude assistant records state the resolved message.model. The newest
+// matching family record in this cwd wins. Every failure is advisory/unknown, never an exception.
+export function readClaudeAliasIdentity(cwd, alias) {
+    try {
+        const real = realpathSync(cwd);
+        const dir = join(homedir(), ".claude", "projects", claudeSlug(real));
+        let newest;
+        for (const f of newestSessionFiles(dir)) {
+            let text;
+            try {
+                text = readFileSync(join(dir, f), "utf8").slice(0, MAX_SESSION_BYTES);
+            }
+            catch {
+                continue;
+            }
+            for (const line of text.split("\n")) {
+                if (!line.trim())
+                    continue;
+                let raw;
+                try {
+                    raw = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                const rec = raw;
+                if (rec.cwd !== real || typeof rec.message?.model !== "string")
+                    continue;
+                const identity = rec.message.model;
+                const timestamp = Date.parse(String(rec.timestamp));
+                if (!MODEL_ID_RE.test(identity) || !belongsToAliasFamily(identity, alias) || !Number.isFinite(timestamp))
+                    continue;
+                if (!newest || timestamp > newest.timestamp)
+                    newest = { identity, timestamp };
+            }
+        }
+        return newest?.identity;
+    }
+    catch {
+        return undefined;
+    }
+}
+// Store silence earns one minimal stated-identity turn. The output contract is intentionally strict:
+// one safe model id from the requested alias family, otherwise unknown/fail-open. Vitest never spawns
+// a real agent CLI; tests inject the probe callback at resolveClaudeAliasIdentity instead.
+export function probeClaudeAliasIdentity(cwd, alias) {
+    if (process.env.VITEST)
+        return undefined;
+    try {
+        const r = spawnSync("claude", [
+            "-p",
+            "State the exact model identifier serving this request. Reply with only that identifier.",
+            "--model", alias,
+            "--permission-mode", "bypassPermissions",
+            "--strict-mcp-config",
+            "--mcp-config", '{"mcpServers":{}}',
+            "--output-format", "text",
+        ], { cwd, encoding: "utf8", timeout: 60000, stdio: ["ignore", "pipe", "pipe"] });
+        if (r.error || r.status !== 0)
+            return undefined;
+        const identity = (r.stdout || "").trim();
+        return MODEL_ID_RE.test(identity) && belongsToAliasFamily(identity, alias) ? identity : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function resolveClaudeAliasIdentity(cwd, alias, probe = probeClaudeAliasIdentity) {
+    return readClaudeAliasIdentity(cwd, alias) ?? probe(cwd, alias);
+}
 export function probeVersion(bin) {
     const r = spawnSync(bin, ["--version"], { encoding: "utf8", timeout: 10000 });
     if (r.error || r.status !== 0)
@@ -75,24 +178,10 @@ export const claudeCode = {
             const real = realpathSync(cwd); // resolve symlinks (darwin /tmp → /private/tmp)
             const slug = claudeSlug(real);
             const dir = join(homedir(), ".claude", "projects", slug);
-            // newest-first by mtime, bounded — mtime picks WHICH files to scan, never a record's cursor.
-            const files = readdirSync(dir)
-                .filter((f) => f.endsWith(".jsonl"))
-                .map((f) => {
-                try {
-                    return { f, m: statSync(join(dir, f)).mtimeMs };
-                }
-                catch {
-                    return undefined; // a stat failure just drops that file
-                }
-            })
-                .filter((x) => x !== undefined)
-                .sort((a, b) => b.m - a.m)
-                .slice(0, MAX_SESSION_FILES);
             let input = 0, output = 0, kept = false;
             let cacheRead, cacheWrite;
             const seen = new Set(); // message.id is globally unique across session files in one call
-            for (const { f } of files) {
+            for (const f of newestSessionFiles(dir)) {
                 let text;
                 try {
                     text = readFileSync(join(dir, f), "utf8").slice(0, MAX_SESSION_BYTES);

package/dist/adapters/kimi.d.ts

@@ -13,9 +13,15 @@ export declare function kimiBannerModel(banner: string): string | undefined;
 export declare function kimiBannerSessionId(banner: string): string | undefined;
 export type KimiBannerConfirm = {
     ok: true;
+    status: "confirmed";
+    sessionId?: string;
+} | {
+    status: "unknown";
+    printedModel?: string;
     sessionId?: string;
 } | {
     ok: false;
+    status: "mismatch";
     error: string;
 };
 export declare function confirmKimiSeedBanner(banner: string, assignedModel: string): KimiBannerConfirm;

package/dist/adapters/kimi.js

@@ -96,11 +96,26 @@ export async function probeKimiDoctorTurn(cwd) {
 // Prefer a banner Session line when present so seed-mode captures the id from the launch banner
 // itself rather than waiting for a completion-time resume trailer (which the TUI may never emit).
 const RESUME_TRAILER_RE = /^\s*To resume this session: kimi -r (session_[0-9a-f-]+)\s*$/;
-const BANNER_SESSION_LINE_RE = /^\s*Session:\s*(session_[0-9a-f-]+)\s*$/;
+const BANNER_SESSION_RE = /^Session:\s*(session_[0-9a-f-]+)$/;
+const BANNER_MODEL_RE = /^Model:\s*(.+)$/;
+function kimiBannerLines(banner) {
+    // The live TUI renders banner fields as indented rows inside `│ ... │`. Strip only that
+    // per-line margin/chrome, following prompt.ts's pane-text precedent; preserve field content.
+    return banner.split("\n")
+        .map((line) => line.replace(/^[\s│|]+/, "").replace(/[\s│|]+$/, ""));
+}
+function kimiBannerPrintedModel(banner) {
+    for (const line of kimiBannerLines(banner)) {
+        const printedModel = BANNER_MODEL_RE.exec(line)?.[1]?.trim();
+        if (printedModel)
+            return printedModel;
+    }
+    return undefined;
+}
 export function kimiSessionId(output) {
     let id;
-    for (const line of output.split("\n")) {
-        const banner = BANNER_SESSION_LINE_RE.exec(line);
+    for (const line of kimiBannerLines(output)) {
+        const banner = BANNER_SESSION_RE.exec(line);
         if (banner) {
             id = banner[1];
             continue;
@@ -113,29 +128,48 @@ export function kimiSessionId(output) {
 }
 // v1.69 T7: the cold-start banner prints the model alias and session id. Parse them from the
 // banner text already captured for the readiness match — no new probe, no extra dispatch. Kimi
-// 0.29.0 may print either the full config key or its display suffix; normalize both idempotently
-// to the full channel identifier routing uses.
-const BANNER_MODEL_RE = /^Model:\s*(.+)$/m;
-const BANNER_SESSION_RE = /^Session:\s*(session_[0-9a-f-]+)$/m;
+// may print a display name, the full config key, or its legacy suffix. Resolve only names with a
+// known channel mapping: inventing `kimi-code/<future display>` would turn unknown into mismatch.
+const KIMI_BANNER_MODEL_CHANNELS = new Map([
+    ["K3", "kimi-code/k3"],
+    ["k3", "kimi-code/k3"],
+    ["kimi-code/k3", "kimi-code/k3"],
+    ["K2.7 Coding", "kimi-code/kimi-for-coding"],
+    ["kimi-for-coding", "kimi-code/kimi-for-coding"],
+    ["kimi-code/kimi-for-coding", "kimi-code/kimi-for-coding"],
+    ["K2.7 Coding Highspeed", "kimi-code/kimi-for-coding-highspeed"],
+    ["kimi-for-coding-highspeed", "kimi-code/kimi-for-coding-highspeed"],
+    ["kimi-code/kimi-for-coding-highspeed", "kimi-code/kimi-for-coding-highspeed"],
+]);
 export function kimiBannerModel(banner) {
-    const m = BANNER_MODEL_RE.exec(banner);
-    if (!m)
-        return undefined;
-    const printedModel = m[1].trim();
-    if (!printedModel)
-        return undefined;
-    return printedModel.startsWith("kimi-code/") ? printedModel : `kimi-code/${printedModel}`;
+    const printedModel = kimiBannerPrintedModel(banner);
+    return printedModel === undefined ? undefined : KIMI_BANNER_MODEL_CHANNELS.get(printedModel);
 }
 export function kimiBannerSessionId(banner) {
-    return BANNER_SESSION_RE.exec(banner)?.[1];
+    for (const line of kimiBannerLines(banner)) {
+        const sessionId = BANNER_SESSION_RE.exec(line)?.[1];
+        if (sessionId)
+            return sessionId;
+    }
+    return undefined;
 }
-// Fail closed on a named-model mismatch; a missing Model line is not a mismatch (banner partial).
+// Fail closed on a mapped-model mismatch. Unknown/missing names remain non-blocking for forward
+// compatibility, but carry an explicit unknown status rather than masquerading as confirmation.
 export function confirmKimiSeedBanner(banner, assignedModel) {
+    const sessionId = kimiBannerSessionId(banner);
+    const printedModel = kimiBannerPrintedModel(banner);
     const saw = kimiBannerModel(banner);
-    if (saw !== undefined && saw !== assignedModel) {
-        return { ok: false, error: `model mismatch: expected ${assignedModel}, saw ${saw}` };
+    if (printedModel === undefined || saw === undefined) {
+        return {
+            status: "unknown",
+            ...(printedModel === undefined ? {} : { printedModel }),
+            ...(sessionId === undefined ? {} : { sessionId }),
+        };
+    }
+    if (saw !== assignedModel) {
+        return { ok: false, status: "mismatch", error: `model mismatch: expected ${assignedModel}, saw ${saw}` };
     }
-    return { ok: true, sessionId: kimiBannerSessionId(banner) };
+    return { ok: true, status: "confirmed", ...(sessionId === undefined ? {} : { sessionId }) };
 }
 const kimiTuiLaunch = (model) => `kimi -y -m ${shq(model)}`;
 const KIMI_ANSI_SGR_RE = /\u001B\[[0-9;]*m/g;
@@ -144,7 +178,11 @@ const KIMI_EDITOR_INPUT_RE = /^│ > .*│$/;
 const KIMI_EDITOR_EMPTY_RE = /^│ > +│$/;
 const KIMI_EDITOR_BOTTOM_RE = /^╰─+╯$/;
 function matchesKimiEditorBox(paneText, empty) {
-    const lines = paneText.replace(KIMI_ANSI_SGR_RE, "").split("\n");
+    // OBS-152: kimi renders its whole TUI indented one column, so `^`-anchored row matches never fire
+    // on a LIVE editor box — probe 6 timed out readiness against a frame whose box was fully painted
+    // and interactive. Trim per line: the left margin is chrome, and what actually distinguishes the
+    // editor from the welcome panel (also a bordered box) is the three-row adjacency asserted below.
+    const lines = paneText.replace(KIMI_ANSI_SGR_RE, "").split("\n").map((line) => line.trim());
     const input = empty ? KIMI_EDITOR_EMPTY_RE : KIMI_EDITOR_INPUT_RE;
     return lines.some((line, index) => input.test(line)
         && index > 0
@@ -170,7 +208,14 @@ const KIMI_SEED = {
     launch: kimiTuiLaunch,
     readinessMatch: "Send /help for help information.",
     seedLine: (promptFile) => `Read ${promptFile} and do exactly what it says.`,
-    confirmBanner: confirmKimiSeedBanner,
+    confirmBanner: (banner, assignedModel) => {
+        const confirmation = confirmKimiSeedBanner(banner, assignedModel);
+        // The generic seed contract is binary: unknown display names remain admissible while the
+        // Kimi-specific result above truthfully keeps them distinct from a confirmed identity.
+        return confirmation.status === "unknown"
+            ? { ok: true, status: confirmation.status, sessionId: confirmation.sessionId }
+            : confirmation;
+    },
 };
 // v1.69 T7 / v1.71 T2: thin wrapper over the daemon's generic dispatch path for kimi-only tests.
 export async function runKimiInteractiveSeed(opts) {

package/dist/adapters/registry.js

@@ -203,7 +203,12 @@ const MODEL_PROBE_PROMPT = "Reply with exactly OK and nothing else.";
 // 60s: a healthy MCP-free codex probe measured 29.9s round-trip (2026-07-15) — 30s had zero headroom.
 const MODEL_PROBE_TIMEOUT_MS = 60000;
 // Auth-words only match when tied to a failure word; bare "auth"/"OAuth"/"authored" never fail (v1.27 T2).
-const AUTH_FAILURE_RE = /\b4\d\d\b|\bauth(?:entication|orization)?\s+(?:error|failed|failure|denied)|unauthori[sz]ed|forbidden|access denied|credit(?:s)?\s+(?:exhausted|error|denied)/i;
+// OBS-150: the 4xx alternative must refuse digit-group context. Bare `\b4\d\d\b` matched "485" inside the
+// token footer "tokens used 26,485" and failed a HEALTHY probe closed — a ~1-in-10 dice roll on EVERY model
+// probe of any adapter that prints a comma-grouped token count. Lookarounds reject a group that is part of a
+// larger number (26,485 · 1.400 · 400.5) while keeping real bare codes (401 · "error 429" · "403 Forbidden."
+// — trailing sentence punctuation still matches, only a following DIGIT means "decimal, not status code").
+const AUTH_FAILURE_RE = /\b(?<![\d.,])4\d\d\b(?![.,]\d)|\bauth(?:entication|orization)?\s+(?:error|failed|failure|denied)|unauthori[sz]ed|forbidden|access denied|credit(?:s)?\s+(?:exhausted|error|denied)/i;
 const PROBE_REASON_CAP = 240;
 // v1.55 T3: the tail must open at a word boundary — a mid-word slice ("odel 'grok-…'") reads as
 // corruption in operator-facing diagnostics. Input is already space-normalized, so " " is the only

package/dist/cli/commands/doctor.d.ts

@@ -1,7 +1,9 @@
+import { type ClaudeAlias } from "../../adapters/claude-code.js";
 import type { WorkerAdapter } from "../../adapters/types.js";
 import { type KimiDoctorTurnResult } from "../../adapters/kimi.js";
 export type DoctorOpts = {
     banner?: boolean;
     kimiTurnProbe?: (cwd: string) => Promise<KimiDoctorTurnResult>;
+    resolveClaudeAliasIdentity?: (cwd: string, alias: ClaudeAlias) => string | undefined;
 };
 export declare function doctor(_argv: string[], cwd?: string, adapters?: WorkerAdapter[], opts?: DoctorOpts): Promise<string>;

package/dist/cli/commands/doctor.js

@@ -1,6 +1,7 @@
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { allAdapters, binaryShadowWarnings, detectCandidateClis, flagDriftWarnings, modelAliasExclusions, modelAliasLine, probeAll, probeModels, readAutoPrefer, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
+import { CLAUDE_ALIAS_IDENTITY_STAMPS, claudeCode, resolveClaudeAliasIdentity } from "../../adapters/claude-code.js";
 import { BANNER, dim, fail, kvRow, legend, ok, rule, statusRow, title } from "../../brand.js";
 import { tickmarkrDir, stateDirName } from "../../graph/graph.js";
 import { declaredModelWindow, hasWindowsConfig, modelLints, suggestOverlay, ttyVisual } from "../../adapters/model-lints.js";
@@ -120,6 +121,28 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     // v1.65 T3: hardcoded-flag drift — advisory warn rows only. Runs AFTER writeDoctor so the verdicts
     // can never leak into doctor.json, and discoverChannels/routing never read them.
     rows.push(...flagDriftWarnings(adapters, health).map(attentionRow));
+    // OBS-145: resolved-identity drift is the same class of display-only doctor warning. Stamps live
+    // beside the alias-owning adapter; the comparison runs only for configured floating aliases and
+    // never enters health/doctor.json, config, channel discovery, learned profiles, or route().
+    const identityResolver = opts.resolveClaudeAliasIdentity
+        ?? (adapters.includes(claudeCode) ? resolveClaudeAliasIdentity : undefined);
+    if (identityResolver && health["claude-code"]?.installed) {
+        const configured = cfg.tiers["claude-code"]?.models ?? {};
+        for (const [alias, stampedIdentity] of Object.entries(CLAUDE_ALIAS_IDENTITY_STAMPS)) {
+            if (!(alias in configured))
+                continue;
+            let resolvedIdentity;
+            try {
+                resolvedIdentity = identityResolver(cwd, alias);
+            }
+            catch {
+                continue; // advisory source failure is unknown, never a doctor failure
+            }
+            if (resolvedIdentity && resolvedIdentity !== stampedIdentity) {
+                rows.push(attentionRow(`resolved-identity drift: claude-code:${alias} resolved to ${resolvedIdentity}, stamped identity ${stampedIdentity} — reclassify per benchmark policy (advisory — routing unchanged)`));
+            }
+        }
+    }
     // MODEL-05/06: print-only drift fragment; advisory, whole-line-commented additions, tickmarkr NEVER applies it.
     // TTY gets a one-line summary + the fragment as a file (the full dump drowned everything else,
     // v1.33.1 onboarding); machine/CI surface keeps the inline dump — layout is pinned by tests.

package/dist/cli/commands/status.d.ts

@@ -1,3 +1,4 @@
+import { type DecisionEvent, type DecisionWebhookPost } from "../../drivers/types.js";
 import { type Task, type TaskStatus } from "../../graph/schema.js";
 import { type JournalEvent } from "../../run/journal.js";
 export type StatusOpts = {
@@ -5,6 +6,8 @@ export type StatusOpts = {
     sleep?: (ms: number) => Promise<void>;
     now?: () => number;
     readWorkerOutput?: (taskId: string, attempt: number, runId: string) => Promise<string | undefined>;
+    webhookUrl?: string;
+    postWebhook?: DecisionWebhookPost;
 };
 export declare const GATE_KEYS: {
     readonly build: "B";
@@ -15,6 +18,7 @@ export declare const GATE_KEYS: {
     readonly acceptance: "A";
     readonly review: "R";
 };
+export declare const decisionEventsFromJournal: (events: JournalEvent[], runId: string, stateDir?: string) => DecisionEvent[];
 export declare const taskBox: (status: TaskStatus) => string;
 export declare const gateBox: (state: "open" | "pass" | "fail" | "skip", unicode: boolean) => string;
 export type GateState = "open" | "pass" | "fail" | "skip";

package/dist/cli/commands/status.js

@@ -1,7 +1,7 @@
 import { BANNER, GLYPHS, dim, fail, legend, ok, rule, statusRow, title, warn } from "../../brand.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
-import { formatOwnedName } from "../../drivers/types.js";
-import { blockedTasks, graphDefinitionHash, loadGraph } from "../../graph/graph.js";
+import { formatOwnedName, } from "../../drivers/types.js";
+import { blockedTasks, graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { foldActivity } from "../../run/activity.js";
 import { Journal, engagementComparable, isQualityFailureParkKind, recordedTaskFailureKind, runHasEnded, } from "../../run/journal.js";
@@ -18,6 +18,89 @@ const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇",
 const ASCII_SPINNER = ["|", "/", "-", "\\"];
 const SAVE_TERMINAL_TITLE = "\x1b[22;0t";
 const RESTORE_TERMINAL_TITLE = "\x1b[23;0t";
+const decisionEvidence = (stateDir, runId, sequence) => `${stateDir}/runs/${runId}/journal.jsonl#L${sequence}`;
+// v1.79 T4: a deterministic JSONL projection over journal truth. Sequence/evidence come from the
+// append-only line position, timestamps and claims come from the row, and no watcher-local clock or
+// filesystem write participates. Re-reading the same bytes therefore returns the same event bytes.
+export const decisionEventsFromJournal = (events, runId, stateDir = ".tickmarkr") => events.flatMap((event, index) => {
+    const sequence = index + 1;
+    const base = {
+        version: 1,
+        sequence,
+        ts: event.ts,
+        runId,
+        evidence: decisionEvidence(stateDir, runId, sequence),
+        ...(event.taskId ? { taskId: event.taskId } : {}),
+    };
+    if (event.event === "phase-start" && typeof event.data.phase === "string") {
+        return [{ ...base, type: "phase-change", tier: "routine", phase: event.data.phase }];
+    }
+    if (event.event === "gate-result" && typeof event.data.gate === "string") {
+        const verdict = event.data.skipped === true
+            ? "skipped"
+            : event.data.pass === true
+                ? "passed"
+                : event.data.pass === false
+                    ? "failed"
+                    : "unknown";
+        return [{
+                ...base,
+                type: "gate-verdict",
+                tier: verdict === "failed" ? "decision" : "routine",
+                gate: event.data.gate,
+                verdict,
+            }];
+    }
+    if (event.event === "escalation") {
+        return [{
+                ...base,
+                type: "escalation",
+                tier: "decision",
+                ...(typeof event.data.step === "string" ? { step: event.data.step } : {}),
+                ...(typeof event.data.attempt === "number" ? { attempt: event.data.attempt } : {}),
+            }];
+    }
+    if (event.event === "task-human" && event.taskId) {
+        return [{
+                ...base,
+                type: "human-decision-required",
+                tier: "decision",
+                approvalCommand: `tickmarkr approve ${runId} ${event.taskId}`,
+                ...(typeof event.data.kind === "string" ? { kind: event.data.kind } : {}),
+                ...(typeof event.data.reason === "string" ? { reason: event.data.reason } : {}),
+            }];
+    }
+    if (event.event === "run-end") {
+        return [{
+                ...base,
+                type: "run-end",
+                tier: "decision",
+                summary: event.data,
+            }];
+    }
+    return [];
+});
+const optionValue = (argv, name) => {
+    const inline = argv.find((arg) => arg.startsWith(`${name}=`));
+    if (inline)
+        return inline.slice(name.length + 1) || undefined;
+    const index = argv.indexOf(name);
+    const value = index >= 0 ? argv[index + 1] : undefined;
+    return value && !value.startsWith("-") ? value : undefined;
+};
+const defaultPostWebhook = (url, event) => fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(event),
+}).then(() => undefined);
+const postWebhookFireAndForget = (post, url, event) => {
+    try {
+        void Promise.resolve(post(url, event)).catch(() => undefined);
+    }
+    catch {
+        // Webhooks are observational. A synchronous bridge failure is as inert as a rejected request.
+    }
+};
 const taskPhase = (value) => {
     if (value === "worker" || value === "gates" || value === "judge" || value === "review" || value === "merge")
         return value;
@@ -204,6 +287,91 @@ const terminalFailureCause = (events) => {
     }
     return undefined;
 };
+const tipFailureEvidence = (events, start, end) => {
+    const gates = new Set();
+    let fingerprints = 0;
+    let hasFingerprintCount = false;
+    for (let i = start; i <= end; i++) {
+        const event = events[i];
+        if (event.event !== "tip-verify-failed")
+            continue;
+        if (typeof event.data.gate === "string" && event.data.gate.trim())
+            gates.add(event.data.gate.trim());
+        if (Array.isArray(event.data.fingerprints)) {
+            fingerprints += event.data.fingerprints.length;
+            hasFingerprintCount = true;
+        }
+    }
+    return { gates: [...gates], ...(hasFingerprintCount ? { fingerprints } : {}) };
+};
+const priorLifecycleIndex = (events, end) => {
+    for (let i = end; i >= 0; i--) {
+        if (events[i].event === "run-start" || events[i].event === "run-resume")
+            return i;
+    }
+    return 0;
+};
+// OBS-146: tip verification is a run phase, folded exclusively from append-only journal facts.
+// A completed run-end owns passed/failed; a later resume keeps the prior failure visible while
+// recording a re-verification attempt; an active run becomes pending only after a recorded merge
+// and recorded non-empty command set make a tip verification applicable. Unknown evidence stays
+// unknown rather than borrowing optimistic state from graph.json.
+const tipVerifyPhase = (events) => {
+    let lastRunEnd = -1;
+    let lastLifecycle = -1;
+    let attempts = 0;
+    let hasCommands = false;
+    let hasMerge = false;
+    for (let i = 0; i < events.length; i++) {
+        const event = events[i];
+        if (event.event === "run-start" || event.event === "run-resume") {
+            lastLifecycle = i;
+            attempts++;
+            if (event.event === "run-start" && typeof event.data.commands === "object" && event.data.commands !== null
+                && !Array.isArray(event.data.commands) && Object.keys(event.data.commands).length > 0) {
+                hasCommands = true;
+            }
+        }
+        else if (event.event === "run-end") {
+            lastRunEnd = i;
+        }
+        else if (event.event === "merge") {
+            hasMerge = true;
+        }
+    }
+    if (lastRunEnd >= 0 && events[lastRunEnd].data.tipVerify === "failed") {
+        const failureStart = priorLifecycleIndex(events, lastRunEnd);
+        const priorFailure = tipFailureEvidence(events, failureStart, lastRunEnd);
+        if (lastLifecycle > lastRunEnd) {
+            const currentFailure = tipFailureEvidence(events, lastLifecycle, events.length - 1);
+            if (currentFailure.gates.length > 0 || currentFailure.fingerprints !== undefined) {
+                return { state: "failed", ...currentFailure };
+            }
+            return { state: "re-verifying", ...priorFailure, attempt: Math.max(2, attempts) };
+        }
+        return { state: "failed", ...priorFailure };
+    }
+    if (lastLifecycle > lastRunEnd) {
+        const currentFailure = tipFailureEvidence(events, lastLifecycle, events.length - 1);
+        if (currentFailure.gates.length > 0 || currentFailure.fingerprints !== undefined) {
+            return { state: "failed", ...currentFailure };
+        }
+        if (hasCommands && hasMerge)
+            return { state: "pending", gates: [] };
+    }
+    return undefined;
+};
+const tipVerifyText = (phase) => {
+    if (phase.state === "pending")
+        return "tip-verify: pending";
+    const gates = phase.gates.length ? phase.gates.join(", ") : "gate unknown";
+    const failed = `tip-verify: FAILED (${gates})`;
+    const reverify = phase.state === "re-verifying" ? ` → re-verifying (attempt ${phase.attempt})` : "";
+    const fingerprints = phase.fingerprints === undefined
+        ? ""
+        : ` · ${phase.fingerprints} fingerprint${phase.fingerprints === 1 ? "" : "s"}`;
+    return `${failed}${reverify}${fingerprints}`;
+};
 const liveness = (events, now = Date.now()) => {
     const last = events.at(-1);
     if (!last)
@@ -289,6 +457,7 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     const width = process.stdout.columns ?? 120;
     const done = effective.tasks.filter((t) => t.status === "done").length;
     const ended = comparable && runHasEnded(events);
+    const tipPhase = comparable ? tipVerifyPhase(events) : undefined;
     const taskIds = new Set(g.tasks.map((task) => task.id));
     const phases = comparable ? livePhases(events) : new Map();
     for (const taskId of phases.keys())
@@ -326,7 +495,7 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
             return `${prefix}${shortGoal(t.goal, Math.max(0, width - prefix.length - suffix.length))}${suffix}`;
         });
         const header = runId
-            ? `tickmarkr status${divider}run ${runId}${supersededBy ? `${divider}superseded by ${supersededBy}` : ""}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events, now).replaceAll(" · ", divider)}${divider}${done}/${g.tasks.length} done`
+            ? `tickmarkr status${divider}run ${runId}${supersededBy ? `${divider}superseded by ${supersededBy}` : ""}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events, now).replaceAll(" · ", divider)}${tipPhase ? `${divider}${tipVerifyText(tipPhase)}` : ""}${divider}${tipPhase ? `${done}/${g.tasks.length} tasks done${divider}run not verified` : `${done}/${g.tasks.length} done`}`
             : `tickmarkr status${divider}no runs yet${divider}${done}/${g.tasks.length} done`;
         const legendLine = `  gates: ${GATE_NAMES.map((gate) => `${GATE_KEYS[gate]} ${gate}`).join(divider)}`;
         return {
@@ -344,18 +513,25 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     const anyFailed = cells.some((c) => c.redTier);
     const gaugeCells = 10;
     const fill = g.tasks.length ? Math.round((done / g.tasks.length) * gaugeCells) : 0;
-    const gauge = (fill ? (anyFailed ? fail : ok)("█".repeat(fill)) : "") + (fill < gaugeCells ? dim("░".repeat(gaugeCells - fill)) : "");
+    const tipFailed = tipPhase?.state === "failed";
+    const progressTone = anyFailed || tipFailed ? fail : tipPhase ? warn : ok;
+    const gauge = (fill ? progressTone("█".repeat(fill)) : "") + (fill < gaugeCells ? dim("░".repeat(gaugeCells - fill)) : "");
     const live = liveness(events, now)
         .replace(/\bdead\b/, fail("dead"))
         .replace(/\bfinished\b/, dim("finished"))
         .replace(/\balive\b/, ok("alive"))
         .replaceAll(" · ", dot);
-    const tally = `${done}/${g.tasks.length} done`;
+    const tally = tipPhase
+        ? `${progressTone(`${done}/${g.tasks.length} tasks done`)}${dot}${progressTone("run not verified")}`
+        : `${done}/${g.tasks.length} done`;
+    const tipStatus = tipPhase
+        ? `${tipFailed ? fail(tipVerifyText(tipPhase)) : warn(tipVerifyText(tipPhase))}${dot}`
+        : "";
     const header = ` ${title(runId ? `run ${runId}` : "tickmarkr")}${dot}` +
         (runId
-            ? `${supersededBy ? `${warn(`superseded by ${supersededBy}`)}${dot}` : ""}${!comparable ? `${warn(NOT_COMPARABLE_NOTICE)}${dot}` : ""}${live}${dot}`
+            ? `${supersededBy ? `${warn(`superseded by ${supersededBy}`)}${dot}` : ""}${!comparable ? `${warn(NOT_COMPARABLE_NOTICE)}${dot}` : ""}${live}${dot}${tipStatus}`
             : `no runs yet${dot}`) +
-        `${gauge} ${done === g.tasks.length && g.tasks.length > 0 ? ok(tally) : tally}`;
+        `${gauge} ${tipPhase ? tally : done === g.tasks.length && g.tasks.length > 0 ? ok(tally) : tally}`;
     const hr = rule(Math.min(width, 100));
     // OBS-104 run-level now line: names the most recent journal event. TTY frame only — the non-TTY
     // machine surface is byte-pinned (status-brand golden) and must not drift. Rendered BELOW the task
@@ -417,15 +593,21 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
         const { content } = renderFrame(cwd, opts.now?.() ?? Date.now());
         return visual() ? BANNER + content : content;
     }
+    const eventStream = argv.some((arg) => arg === "--events" || arg === "--jsonl" || arg === "--decision-events");
+    const webhookUrl = opts.webhookUrl
+        ?? optionValue(argv, "--webhook")
+        ?? process.env.TICKMARKR_DECISION_WEBHOOK;
+    const postWebhook = opts.postWebhook ?? defaultPostWebhook;
     const iterations = opts.iterations ?? Infinity;
     const sleep = opts.sleep ?? defaultSleep;
     const now = opts.now ?? Date.now;
     const bounded = Number.isFinite(iterations);
     const frames = [];
+    const eventLines = [];
     const sep = "\n---\n";
-    const tty = visual();
+    const tty = !eventStream && visual();
     const workerLiveness = new Map();
-    const herdr = HerdrDriver.available() ? new HerdrDriver() : undefined;
+    const herdr = !eventStream && HerdrDriver.available() ? new HerdrDriver() : undefined;
     const readWorkerOutput = opts.readWorkerOutput ?? (herdr
         ? async (taskId, attempt, runId) => {
             const name = formatOwnedName({ role: "worker", taskId, attempt, runId });
@@ -467,6 +649,30 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
             prior.snapshot = snapshot;
         }));
     };
+    let decisionRunId;
+    let journalCursor = 0;
+    const consumeDecisionEvents = () => {
+        const runId = Journal.latestRunId(cwd, { withJournal: true });
+        if (!runId)
+            return [];
+        if (decisionRunId !== runId) {
+            decisionRunId = runId;
+            journalCursor = 0;
+        }
+        const journalEvents = Journal.open(cwd, runId).read();
+        if (journalEvents.length < journalCursor)
+            journalCursor = 0;
+        const fresh = decisionEventsFromJournal(journalEvents, runId, stateDirName(cwd))
+            .filter((event) => event.sequence > journalCursor);
+        journalCursor = journalEvents.length;
+        if (webhookUrl) {
+            for (const event of fresh) {
+                if (event.tier === "decision")
+                    postWebhookFireAndForget(postWebhook, webhookUrl, event);
+            }
+        }
+        return fresh;
+    };
     let titleSaved = false;
     const restoreTitle = () => {
         if (!titleSaved)
@@ -492,18 +698,31 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
     try {
         for (let i = 0; i < iterations; i++) {
             const nowMs = now();
-            const frame = renderFrame(cwd, nowMs, i, workerLiveness);
-            if (tty) {
-                updateTitle(frame.hotPhase, nowMs);
-                process.stdout.write(`\x1b[2J\x1b[H${BANNER}${frame.content}\n${legend(` watching · refresh ${REFRESH_MS / 1000}s · ^C to quit`)}`);
+            const decisionEvents = eventStream || webhookUrl ? consumeDecisionEvents() : [];
+            let frame;
+            if (eventStream) {
+                for (const event of decisionEvents) {
+                    const line = JSON.stringify(event);
+                    process.stdout.write(line + "\n");
+                    if (bounded)
+                        eventLines.push(line);
+                }
             }
             else {
-                process.stdout.write(frame.content + sep);
+                frame = renderFrame(cwd, nowMs, i, workerLiveness);
+                if (tty) {
+                    updateTitle(frame.hotPhase, nowMs);
+                    process.stdout.write(`\x1b[2J\x1b[H${BANNER}${frame.content}\n${legend(` watching · refresh ${REFRESH_MS / 1000}s · ^C to quit`)}`);
+                }
+                else {
+                    process.stdout.write(frame.content + sep);
+                }
+                if (bounded)
+                    frames.push(frame.content);
             }
-            if (bounded)
-                frames.push(frame.content);
             if (i + 1 < iterations) {
-                await observeWorkerOutput(frame.workerPhases, frame.runId, nowMs);
+                if (frame)
+                    await observeWorkerOutput(frame.workerPhases, frame.runId, nowMs);
                 await sleep(REFRESH_MS);
             }
         }
@@ -514,5 +733,5 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
             restoreTitle();
         }
     }
-    return bounded ? frames.join(sep) : "";
+    return bounded ? eventStream ? eventLines.join("\n") : frames.join(sep) : "";
 }

package/dist/drivers/herdr.d.ts

@@ -2,6 +2,10 @@ import { type ExecutorDriver, type NotifyOpts, type Slot, type SlotOpts } from "
 export declare const TRAILER_SAFE_FLOOR_COLS = 108;
 export declare const TRAILER_WIDTH_MARGIN = 2;
 export declare const DELIVERY_ATTEMPTS = 3;
+export interface HerdrTimeSource {
+    now: () => number;
+    sleep: (ms: number) => Promise<void>;
+}
 export declare class DeliveryReadinessError extends Error {
     readonly waitedMs: number;
     readonly transcript: string;
@@ -13,6 +17,7 @@ export declare function workerSplitDirection(paneCols: number | null, safeFloor?
 export declare class HerdrDriver implements ExecutorDriver {
     private bin;
     private workersPerTab;
+    private time;
     id: string;
     interactive: boolean;
     private groups;
@@ -24,12 +29,13 @@ export declare class HerdrDriver implements ExecutorDriver {
     private ws;
     private callerPane;
     private watches;
-    constructor(bin?: string, workersPerTab?: number);
+    constructor(bin?: string, workersPerTab?: number, time?: HerdrTimeSource);
     private serial;
     private deliveryQueue;
     private reserveDispatch;
     private verifyPaneIdentityBinding;
     private deliveryMatches;
+    private shellExecutionEchoed;
     private submissionRegistered;
     static available(): boolean;
     private herdr;

package/dist/drivers/herdr.js

@@ -14,6 +14,10 @@ const DELIVERY_READ_LINES = 80;
 const DELIVERY_SETTLE_READ_ATTEMPTS = 6;
 const DELIVERY_SETTLE_POLL_MS = 100;
 const DELIVERY_READINESS_TIMEOUT_MS = 1_000;
+const SYSTEM_TIME = {
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+};
 // OBS-142: a typed identity lets the daemon's next task distinguish cold-start variance from
 // structural driver faults without parsing prose. The message also carries the bounded wait and
 // final pane evidence so a terminal failure is diagnosable on its own.
@@ -37,6 +41,7 @@ export function workerSplitDirection(paneCols, safeFloor = TRAILER_SAFE_FLOOR_CO
 export class HerdrDriver {
     bin;
     workersPerTab;
+    time;
     id = "herdr";
     interactive = true;
     groups = new Map();
@@ -55,9 +60,10 @@ export class HerdrDriver {
     ws = process.env.HERDR_WORKSPACE_ID;
     callerPane = process.env.HERDR_PANE_ID;
     watches = new Map();
-    constructor(bin = "herdr", workersPerTab = 3) {
+    constructor(bin = "herdr", workersPerTab = 3, time = SYSTEM_TIME) {
         this.bin = bin;
         this.workersPerTab = workersPerTab;
+        this.time = time;
     }
     serial(fn) {
         const p = this.groupSerial.then(fn, fn);
@@ -106,14 +112,39 @@ export class HerdrDriver {
     }
     // ponytail: narrow panes hard-wrap the input line — collapse whitespace before comparing.
     deliveryMatches(transcript, cmd) {
-        const norm = (s) => s.replace(/\s+/g, "");
+        // OBS-154: a TUI editor re-wraps a long delivery across its own bordered rows, so the pane text
+        // carries `│` between fragments we typed as ONE line. Stripping whitespace alone left the needle
+        // uncontainable, so the read-back could not recognize its own SUCCESSFUL delivery and the OBS-85
+        // guard then refused to retype onto what it had been told was corruption (probe 6b).
+        // This is the opposite question to shellExecutionEchoed, which deliberately REJECTS box rows: a
+        // shell echo must come from a shell prompt, whereas here we only ask whether our text landed —
+        // and inside the editor box is exactly where it is supposed to land.
+        const norm = (s) => s.replace(/[│┃|]/g, "").replace(/\s+/g, "");
         const hay = norm(transcript);
         const needle = norm(cmd);
         return needle.length > 0 && hay.includes(needle);
     }
+    shellExecutionEchoed(transcript, cmd) {
+        const norm = (s) => s.replace(/\u001B\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\s+/g, " ").trim();
+        const needle = norm(cmd);
+        if (!needle)
+            return false;
+        return transcript.split("\n").some((rawLine) => {
+            const line = norm(rawLine);
+            if (line === needle || !line.endsWith(needle))
+                return false;
+            const prefix = line.slice(0, -needle.length).trimEnd();
+            if (/[│┃╭╰┌└]/.test(prefix))
+                return false;
+            return /^(?:[$%#>]|[➜❯❱›»λ])(?:\s|$)/.test(prefix)
+                || /[$%#>✗❯❱›»λ]$/.test(prefix);
+        });
+    }
     // Submission requires positive post-Enter evidence. A prompt echoed above a fresh input target
     // proves registration; a declared box that is visibly empty after the verified paste also proves
-    // it consumed the prompt. Prompt absence alone is never success (OBS-142).
+    // it consumed the prompt. At the launch stage, a structurally prompt-prefixed shell execution echo
+    // is stronger evidence than waiting for first paint from the launched interface (OBS-144).
+    // Prompt absence alone is never success (OBS-142).
     submissionRegistered(transcript, cmd, inputBox) {
         const norm = (s) => s.replace(/\s+/g, "");
         const hay = norm(transcript);
@@ -121,6 +152,8 @@ export class HerdrDriver {
         const promptAt = hay.lastIndexOf(needle);
         if (needle.length === 0)
             return false;
+        if (inputBox?.launchCommand?.(cmd) === true && this.shellExecutionEchoed(transcript, cmd))
+            return true;
         if (promptAt < 0)
             return inputBox !== undefined && matchesEmptyInputBox(transcript, inputBox);
         if (inputBox && matchesInputBox(transcript, inputBox)) {
@@ -527,7 +560,7 @@ export class HerdrDriver {
             }
             transcript = read.stdout;
             if (readAttempt < readAttempts - 1) {
-                await new Promise((resolve) => setTimeout(resolve, DELIVERY_SETTLE_POLL_MS));
+                await this.time.sleep(DELIVERY_SETTLE_POLL_MS);
             }
         }
         return { ok: false, transcript, recognizedInputBox: false };
@@ -536,19 +569,19 @@ export class HerdrDriver {
         const inputBox = this.inputBoxes.get(slot);
         const requireInputBox = inputBox !== undefined && inputBox.launchCommand?.(cmd) !== true;
         const timeoutMs = inputBox?.readinessTimeoutMs ?? DELIVERY_READINESS_TIMEOUT_MS;
-        const started = Date.now();
+        const started = this.time.now();
         let previous;
         let transcript = "";
         let reads = 0;
         while (true) {
-            const elapsedBeforeRead = Date.now() - started;
+            const elapsedBeforeRead = this.time.now() - started;
             const remainingBeforeRead = timeoutMs - elapsedBeforeRead;
             if (remainingBeforeRead <= 0)
                 throw new DeliveryReadinessError(elapsedBeforeRead, transcript);
             const read = await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${DELIVERY_READ_LINES}`, slot.cwd, Math.max(1, Math.ceil(remainingBeforeRead)));
             reads++;
             transcript = read.stdout || transcript;
-            const waitedMs = Date.now() - started;
+            const waitedMs = this.time.now() - started;
             if (read.code !== 0) {
                 // Once at least one valid frame has been observed, a read that consumes the remainder of
                 // the readiness budget is the bounded window expiring, not a new submission/protocol
@@ -574,7 +607,7 @@ export class HerdrDriver {
             // The second read is immediate: an already-painted stable target proves readiness with no
             // added delay. Only observed change spends a poll interval, and every path remains bounded.
             if (reads > 1) {
-                await new Promise((resolve) => setTimeout(resolve, Math.min(DELIVERY_SETTLE_POLL_MS, remaining)));
+                await this.time.sleep(Math.min(DELIVERY_SETTLE_POLL_MS, remaining));
             }
         }
     }

package/dist/drivers/types.d.ts

@@ -5,11 +5,32 @@ export interface Slot {
     tabId?: string;
     group?: string;
 }
-export type NotifyTier = "routine" | "attention";
+export type NotifyTier = "routine" | "attention" | "decision";
 export interface NotifyOpts {
     tier?: NotifyTier;
     sound?: "none" | "done" | "request";
 }
+export type DecisionEventType = "phase-change" | "gate-verdict" | "escalation" | "human-decision-required" | "run-end";
+export interface DecisionEvent {
+    version: 1;
+    sequence: number;
+    type: DecisionEventType;
+    tier: "routine" | "decision";
+    ts: string;
+    runId: string;
+    taskId?: string;
+    evidence: string;
+    phase?: string;
+    gate?: string;
+    verdict?: "passed" | "failed" | "skipped" | "unknown";
+    step?: string;
+    attempt?: number;
+    kind?: string;
+    reason?: string;
+    approvalCommand?: string;
+    summary?: Record<string, unknown>;
+}
+export type DecisionWebhookPost = (url: string, event: DecisionEvent) => void | Promise<unknown>;
 export interface SlotOpts {
     group?: string;
     label?: string;

package/dist/gates/acceptance.d.ts

@@ -14,6 +14,11 @@ export interface JudgeVerdict {
         reason: string;
         evidence: string | EvidenceCitation;
     }>;
+    comments?: Array<{
+        path: string;
+        line: number;
+        body: string;
+    }>;
 }
 export declare function judgeCriterionId(index: number): string;
 export declare function testFiltered(testCmd: string, name: string): string;

package/dist/gates/acceptance.js

@@ -4,7 +4,7 @@ import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
 import { checkDiffCap, fetchTaskDiff } from "./review.js";
-import { COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
 const JUDGE_TIMEOUT_MS = 900_000;
 const CitationSchema = z.object({ path: z.string(), line: z.number().int() });
@@ -278,9 +278,10 @@ ${citable || "(the diff changes no lines)"}
 ${verdictNonceLine(nonce)}
 
 Respond with ONLY this JSON (no prose before or after):
-{"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "...", "evidence": {"path": "path/to/file", "line": 42}}]}
+{"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "...", "evidence": {"path": "path/to/file", "line": 42}}], "comments": [{"path": "path/to/file", "line": 42, "body": "actionable feedback"}]}
 Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) exactly once.
 Each criteria[].evidence MUST be a structured citation {"path", "line"} whose "path" and "line" appear in the "Citable evidence lines" list above (a new-file line number inside a changed hunk); a citation outside every changed hunk or to an untouched file voids the whole verdict.
+The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
     const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
     const extracted = extractVerdictJson(raw, nonce);
@@ -309,5 +310,6 @@ Each criteria[].evidence MUST be a structured citation {"path", "line"} whose "p
     if (!v.pass)
         lines.push("judge verdict pass=false");
     lines.push(...inconsistencies);
-    return { gate: "acceptance", pass, details: warn + detBlock + (lines.join("\n") || "judge passed") };
+    const prose = warn + detBlock + (lines.join("\n") || "judge passed");
+    return { gate: "acceptance", pass, details: appendAnchoredReview(prose, extracted) };
 }

package/dist/gates/llm.d.ts

@@ -4,6 +4,14 @@ export declare const GATE_PANE_SEP = " \u00B7 ";
 export declare const COMPLETION_FAKING_CHECKLIST = "## Completion-faking checklist\nHunt for these concrete completion-faking shortcuts before ruling on any criterion:\n- hardcoded-result: output or fixture hardcoded to satisfy the stated criterion instead of real logic\n- test-weakening: tests skipped, deleted, or assertions loosened until failing behavior looks green\n- vacuous-assertion: a test that cannot fail (asserts a constant, asserts its own setup, no assertion)\n- fixture-overfit: implementation narrowed to the exact test inputs rather than the described behavior\n- echo-not-implement: criterion text echoed in names, comments, or strings without the behavior itself\n- stub-left-behind: TODO, throw, or no-op stub where the real implementation should be\n- error-swallowing: catch or fallback that hides failures instead of handling them\n- self-mocking: the code under test mocked or faked so the test exercises the mock\n- check-bypass: lint, type, or CI checks disabled, relaxed, or excluded to get green\n- rename-as-work: code moved or renamed and presented as the requested change\n- scope-padding: unrelated edits padding the diff while the criterion's behavior is untouched\nWhen a criterion fails, the verdict MUST name which shortcut above it matches, or state that none does.";
 /** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
 export declare function generateVerdictNonce(): string;
+export interface AnchoredComment {
+    path: string;
+    line: number;
+    body: string;
+}
+export declare function parseAnchoredComments(verdict: unknown): AnchoredComment[];
+export declare function renderAnchoredReview(verdict: unknown): string;
+export declare function appendAnchoredReview(prose: string, verdict: unknown): string;
 export declare function verdictNonceLine(nonce: string): string;
 export declare function extractPromptNonce(prompt: string): string | null;
 export declare function gateExitTrailer(nonce: string): string;
@@ -32,6 +40,7 @@ export declare function captureLlmOutput<T>(run: () => Promise<T>): Promise<{
 }>;
 export declare function runHeadless(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, timeoutMs?: number): Promise<string>;
 export declare function runViaDriver(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via: LlmVia, timeoutMs?: number): Promise<string>;
+export declare function dewrapPaneVerdict(out: string, nonce: string): string;
 export declare function runLlm(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via?: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function extractJson<T>(raw: string): T | null;
 /** Fable F3: verdict JSON must echo the call nonce — skip unbound or mismatched objects. */

package/dist/gates/llm.js

@@ -27,6 +27,39 @@ When a criterion fails, the verdict MUST name which shortcut above it matches, o
 export function generateVerdictNonce() {
     return randomBytes(4).toString("hex");
 }
+// v1.79 T5: comments are an optional side channel on an otherwise authoritative verdict. The whole
+// block is accepted only when every row names one actionable path:line; absent or malformed input
+// becomes no comments and therefore preserves the pre-comments prose bytes and verdict semantics.
+export function parseAnchoredComments(verdict) {
+    if (!verdict || typeof verdict !== "object")
+        return [];
+    const raw = verdict.comments;
+    if (!Array.isArray(raw) || raw.length === 0)
+        return [];
+    const comments = [];
+    for (const row of raw) {
+        if (!row || typeof row !== "object")
+            return [];
+        const { path, line, body } = row;
+        const cleanPath = typeof path === "string" ? path.trim() : "";
+        const cleanBody = typeof body === "string" ? body.trim() : "";
+        if (!cleanPath || /[\r\n]/.test(cleanPath) || !Number.isInteger(line) || line < 1 || !cleanBody) {
+            return [];
+        }
+        comments.push({ path: cleanPath, line: line, body: cleanBody });
+    }
+    return comments;
+}
+export function renderAnchoredReview(verdict) {
+    const comments = parseAnchoredComments(verdict);
+    if (comments.length === 0)
+        return "";
+    return `## Anchored review\n${comments.map((c) => `- ${c.path}:${c.line} — ${c.body}`).join("\n")}`;
+}
+export function appendAnchoredReview(prose, verdict) {
+    const block = renderAnchoredReview(verdict);
+    return block ? `${prose}\n\n${block}` : prose;
+}
 export function verdictNonceLine(nonce) {
     return `VERDICT_NONCE: ${nonce}`;
 }
@@ -128,6 +161,47 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
     if (!via.keep)
         await via.driver.close(slot);
     out = augmentFakeVerdictOutput(adapter, out, nonce, prompt);
+    return dewrapPaneVerdict(out, nonce);
+}
+// OBS-155: a TUI renders the verdict as a bullet and HARD-wraps it at pane width with a 2-space
+// continuation indent, splitting words mid-token — so literal newlines land inside JSON string
+// literals and ZERO lines begin with `{`. `--source recent-unwrapped` cannot undo it: the wrap is
+// the TUI's own rendering, not a terminal soft wrap (driver.read already requests that source, and
+// the captured k3 transcript arrived wrapped anyway). A perfect verdict was therefore scored a
+// flake and rescued by a retry on another channel — 70 such judge-retries are on record across
+// k3, fable AND sol, so this is a width-dependent flake generator under every pane-mode gate.
+//
+// Fail-closed by construction, per the overseer's constraints: reconstruction is bounded to the
+// brace-delimited region, the rejoined text must PARSE, and it must carry THIS call's nonce.
+// Anything else returns the bytes untouched, so an unparseable verdict stays a failure. The
+// reconstruction is APPENDED, never substituted: extractJson takes the last balanced object, so
+// the good copy wins while the original rendering survives verbatim for the evidence capture.
+export function dewrapPaneVerdict(out, nonce) {
+    if (!out.includes(nonce))
+        return out;
+    const lines = out.split("\n");
+    const start = lines.findIndex((line) => /^\s*(?:[•*-]\s+)?\{/.test(line));
+    if (start < 0)
+        return out;
+    for (let end = start; end < lines.length; end++) {
+        const joined = lines
+            .slice(start, end + 1)
+            .map((line, i) => (i === 0 ? line.replace(/^\s*(?:[•*-]\s+)?/, "") : line.replace(/^\s+/, "")))
+            .join("")
+            .trimEnd();
+        if (!joined.endsWith("}"))
+            continue;
+        try {
+            const parsed = JSON.parse(joined);
+            // the nonce IS the acceptance test — never reconstruct a verdict this call did not ask for
+            if (parsed && typeof parsed === "object" && parsed.nonce === nonce) {
+                return `${out}\n${joined}`;
+            }
+        }
+        catch {
+            /* not yet a complete object — keep extending within the bounded region */
+        }
+    }
     return out;
 }
 export async function runLlm(adapter, model, prompt, cwd, via, timeoutMs = 300000) {

package/dist/gates/review.d.ts

@@ -14,6 +14,11 @@ export interface ReviewVerdict {
     approve?: boolean;
     issues?: string[];
     findings?: ReviewFinding[];
+    comments?: Array<{
+        path: string;
+        line: number;
+        body: string;
+    }>;
 }
 export declare function fetchTaskDiff(worktree: string, baseRef: string): Promise<{
     full: string;

package/dist/gates/review.js

@@ -4,7 +4,7 @@ import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { marginalCostRank } from "../route/router.js";
-import { COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // legacy flat `issues` shape — every issue blocks; the approve flag must agree with the list.
 function classifyReviewIssues(approve, issues) {
     const inconsistencies = [];
@@ -158,8 +158,9 @@ block approval. For a minor concern you have decided not to block on, set "defer
 one-line "rationale" — it is recorded in the review, never dropped.
 
 Respond with ONLY this JSON:
-{"nonce": "${nonce}", "approve": true|false, "findings": [{"note": "...", "severity": "material"|"minor", "defer": false, "rationale": ""}]}
+{"nonce": "${nonce}", "approve": true|false, "findings": [{"note": "...", "severity": "material"|"minor", "defer": false, "rationale": ""}], "comments": [{"path": "path/to/file", "line": 42, "body": "actionable feedback"}]}
 Approve iff no material finding remains; an empty findings list is a clean approval.
+The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
     const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? { driver: via.driver, keep: via.keep, onSlot: via.onSlot, name: via.nameFor("review", reviewer.adapter), label: via.labelFor("review") } : undefined, 
     // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
@@ -182,10 +183,11 @@ Approve iff no material finding remains; an empty findings list is a clean appro
     const decided = findings !== null
         ? classifyReviewFindings(findings)
         : classifyReviewIssues(v.approve, v.issues);
+    const prose = `reviewer ${reviewer.adapter}:${reviewer.model} (${reviewer.vendor}): ${decided.headline}${decided.lines.length ? "\n" + decided.lines.join("\n") : ""}`;
     return {
         gate: "review",
         pass: decided.pass,
-        details: `reviewer ${reviewer.adapter}:${reviewer.model} (${reviewer.vendor}): ${decided.headline}${decided.lines.length ? "\n" + decided.lines.join("\n") : ""}`,
+        details: appendAnchoredReview(prose, v),
         meta: { reviewer: channelKey(reviewer) },
     };
 }

package/dist/run/journal.d.ts

@@ -85,12 +85,12 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     }>>;
     signalQuality: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<0>, z.ZodLiteral<0.25>, z.ZodLiteral<0.5>, z.ZodLiteral<0.75>, z.ZodLiteral<1>]>>;
     signalBasis: z.ZodOptional<z.ZodEnum<{
+        skipped: "skipped";
         proved: "proved";
         "review-agree": "review-agree";
         "judge-only": "judge-only";
         legacy: "legacy";
         vacuous: "vacuous";
-        skipped: "skipped";
     }>>;
     kind: z.ZodOptional<z.ZodLiteral<"judge">>;
     judgeOutcome: z.ZodOptional<z.ZodEnum<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.77.0",
+  "version": "1.79.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",