tickmarkr 1.83.0 → 1.85.0

package/dist/adapters/claude-code.d.ts

@@ -8,6 +8,7 @@ export declare const CLAUDE_ALIAS_IDENTITY_STAMPS: {
 export type ClaudeAlias = keyof typeof CLAUDE_ALIAS_IDENTITY_STAMPS;
 export type ClaudeAliasIdentityProbe = (cwd: string, alias: ClaudeAlias) => string | undefined;
 export declare const CLAUDE_TRUST_DIALOG: TrustDialog;
+export declare const CLAUDE_INPUT_BOX: import("./types.js").InputBox;
 export declare function claudeSlug(real: string): string;
 export declare function readClaudeAliasIdentity(cwd: string, alias: ClaudeAlias): string | undefined;
 export declare function probeClaudeAliasIdentity(cwd: string, alias: ClaudeAlias): string | undefined;

package/dist/adapters/claude-code.js

@@ -3,7 +3,7 @@ import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { parseWorkerResult } from "./prompt.js";
-import { channelsFromConfig, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
+import { channelsFromConfig, declareInputBox, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
 // SPEND-01/SPEND-11: claude writes a per-session JSONL to ~/.claude/projects/<slug>/ where slug is the
 // realpath'd cwd with every non-alphanumeric char replaced by "-" (verified 114/114 — 36-DIAGNOSIS.md).
 // The old `/`-only formula missed the "." in `.tickmarkr/worktrees/…` — ENOENT on every worktree dispatch.
@@ -40,6 +40,61 @@ export const CLAUDE_TRUST_DIALOG = {
     fingerprint: "Quick safety check: Is this a project you created or one you trust?",
     key: "Enter",
 };
+// OBS-201/262 nudge deliverability: claude-code is the ONLY member of NUDGEABLE_ADAPTERS, and the
+// driver's deliverTyped pincer (readiness stable-frame → type → read-back → verified submit) needs a
+// declared input box for any delivery whose command is not the adapter's own launch line — which a
+// nudge never is. Without this declaration `requireInputBox` was false, readiness fell back to
+// "the pane no longer echoes the command", and submission fell through to the positional fallback:
+// the rescue that OBS-262 widened the gate for could not be verifiably delivered to the one adapter
+// allowed to receive it.
+//
+// CAPTURED, not guessed (claude 2.1.220, tmux 120x30, 2026-08-03 — the state-to-PIXELS law):
+//     ────────────────────────────────────────────  ← full-width rule
+//     ❯ You are still assigned this task…       ← caret, NBSP, then the typed turn
+//     ────────────────────────────────────────────  ← full-width rule
+// Two findings the kimi-shaped guess would have got wrong, and both are fatal on their own:
+//   1. claude's editor is NOT a bordered ╭─╮ box — it is one row FENCED BY TWO RULES, so a
+//      `│ > ` fingerprint or a border-adjacency walk never fires.
+//   2. the caret is padded with U+00A0, not a space. A `"❯ "` fingerprint with an ASCII space
+//      matches nothing, ever — the OBS-152 failure mode exactly (six versions of "kimi is broken"
+//      were all anchored matchers meeting a TUI that renders differently than assumed).
+// `match` means THE EDITOR IS PAINTED and is deliberately true for an empty editor (readiness);
+// `emptyMatch` is the stricter "painted AND carrying nothing", which is what proves a submit
+// registered. Callers deciding submission must test emptyMatch first — see submissionRegistered.
+const CLAUDE_ANSI_SGR_RE = /\u001B\[[0-9;]*m/g;
+const CLAUDE_RULE_RE = /^─{8,}$/;
+const CLAUDE_CARET_RE = /^❯\u00A0/;
+const CLAUDE_CARET_EMPTY_RE = /^❯\u00A0\s*$/;
+// A wrapped or multi-line turn grows the editor downward before the closing rule.
+// ponytail: a fixed window, not a parser — raise it if a real capture ever shows a taller editor.
+const CLAUDE_MAX_EDITOR_ROWS = 8;
+function matchesClaudeEditor(paneText, empty) {
+    // Trim ASCII margins ONLY: String.trim() eats U+00A0, which would erase the very byte that
+    // distinguishes claude's caret padding from an ordinary prompt line.
+    const lines = paneText.replace(CLAUDE_ANSI_SGR_RE, "").split("\n").map((l) => l.replace(/^[ \t]+|[ \t]+$/g, ""));
+    const caret = empty ? CLAUDE_CARET_EMPTY_RE : CLAUDE_CARET_RE;
+    return lines.some((line, i) => {
+        if (!caret.test(line))
+            return false;
+        if (i === 0 || !CLAUDE_RULE_RE.test(lines[i - 1]))
+            return false;
+        for (let below = i + 1; below < lines.length && below <= i + CLAUDE_MAX_EDITOR_ROWS; below++) {
+            if (CLAUDE_RULE_RE.test(lines[below]))
+                return true;
+        }
+        return false;
+    });
+}
+export const CLAUDE_INPUT_BOX = declareInputBox("claude-code", {
+    fingerprint: "❯\u00A0",
+    match: (paneText) => matchesClaudeEditor(paneText, false),
+    emptyMatch: (paneText) => matchesClaudeEditor(paneText, true),
+    // The launch line settles on a clean shell line; the editor paints after it. Both interactive
+    // entry points count — a resumed session re-enters the same TUI (OBS-142's launch distinction).
+    launchCommand: (command) => command.startsWith("claude --model ") || command.startsWith("claude -r "),
+    // The 2026-08-03 capture reached a painted editor ~10s after the trust answer on a warm install.
+    readinessTimeoutMs: 30_000,
+});
 export function claudeSlug(real) {
     return real.replace(/[^A-Za-z0-9]/g, "-");
 }
@@ -168,6 +223,7 @@ export const claudeCode = {
     // the daemon safely answers only the exact adapter-declared dialog once per slot.
     interactiveCommand: (promptFile, model) => `claude --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`,
     trustDialog: CLAUDE_TRUST_DIALOG,
+    inputBox: CLAUDE_INPUT_BOX,
     resumeCommand: (sessionId, promptFile, model) => `claude -r ${shq(sessionId)} --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };

package/dist/adapters/fake.js

@@ -35,14 +35,23 @@ export class FakeAdapter {
         // contains TICKMARKR-JUDGE — a review/consult prompt never touches it (research Pitfall 3).
         let prompt = "";
         let isJudge = false;
+        // v1.85 T4: the role THIS prompt is, when it can be told. The three scratch files are shared per
+        // script path, so a build that writes a role it is not can clobber a concurrently-dispatched
+        // sibling's file between that sibling's build and its `cat` — which is exactly what a round that
+        // launches judge and review together does. Writing only the matching role removes the race: the
+        // other roles' `grep` guards below can never fire for this prompt, so their files are never read.
+        let role;
         try {
             prompt = readFileSync(promptFile, "utf8");
             isJudge = /TICKMARKR-(?:JUDGE|SCOPE)/.test(prompt);
+            role = isJudge ? "judge" : /TICKMARKR-REVIEW/.test(prompt) ? "review" : /TICKMARKR-CONSULT/.test(prompt) ? "consult" : undefined;
         }
         catch {
             // unreadable promptFile: can't detect role; serve static values (legacy headless-call behavior)
         }
         const serve = (key) => {
+            if (role !== undefined && key !== role)
+                return join(dirname(this.scriptPath), `${key}.json`);
             let val = this.script[key];
             if (key === "judge" && isJudge && Array.isArray(val)) {
                 // array served sequentially per judge prompt, clamped to last (steps[min(n,len-1)] idiom)

package/dist/adapters/types.d.ts

@@ -86,6 +86,7 @@ export interface InputBox {
     fingerprint: string;
     match?(paneText: string): boolean;
     emptyMatch?(paneText: string): boolean;
+    occupiedMatch?(paneText: string): boolean;
     launchCommand?(command: string): boolean;
     readinessTimeoutMs?: number;
 }
@@ -93,6 +94,8 @@ export declare function declareInputBox(adapterId: string, inputBox: InputBox):
 export declare function declaredInputBoxForWorkerName(workerName: string): InputBox | undefined;
 export declare function matchesInputBox(paneText: string, inputBox: InputBox): boolean;
 export declare function matchesEmptyInputBox(paneText: string, inputBox: InputBox): boolean;
+export declare function matchesOccupiedInputBox(paneText: string, inputBox: InputBox): boolean;
+export declare function missingInputStateDeclarations(inputBox: InputBox | undefined): string[];
 export interface WorkerAdapter {
     id: string;
     vendor: string;

package/dist/adapters/types.js

@@ -45,6 +45,27 @@ export function matchesInputBox(paneText, inputBox) {
 export function matchesEmptyInputBox(paneText, inputBox) {
     return inputBox.emptyMatch?.(paneText) === true;
 }
+// The OCCUPIED state: the adapter's own pin when it has one, else painted-and-not-empty, which two
+// adapter declarations decide between them. Either way the answer comes from the adapter, never from
+// where the prompt happens to sit in the transcript.
+export function matchesOccupiedInputBox(paneText, inputBox) {
+    if (inputBox.occupiedMatch)
+        return inputBox.occupiedMatch(paneText) === true;
+    return matchesInputBox(paneText, inputBox) && !matchesEmptyInputBox(paneText, inputBox);
+}
+// v1.85 T5: which input-state declarations a typed delivery needs and this adapter has not made.
+// Empty is always required (it is the only positive submission evidence); occupied needs either its
+// own matcher or the `match` that derives it. A non-empty result is a fail-closed refusal, named.
+export function missingInputStateDeclarations(inputBox) {
+    if (!inputBox)
+        return ["inputBox"];
+    const missing = [];
+    if (!inputBox.emptyMatch)
+        missing.push("emptyMatch");
+    if (!inputBox.occupiedMatch && !inputBox.match)
+        missing.push("occupiedMatch");
+    return missing;
+}
 export function channelsFromConfig(adapterId, cfg) {
     const e = cfg.tiers[adapterId];
     if (!e)

package/dist/cli/commands/status.js

@@ -1,3 +1,5 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import { BANNER, GLYPHS, dim, fail, legend, ok, rule, statusRow, title, warn } from "../../brand.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
 import { formatOwnedName, } from "../../drivers/types.js";
@@ -6,10 +8,52 @@ import { GATE_NAMES } from "../../graph/schema.js";
 import { foldActivity } from "../../run/activity.js";
 import { Journal, engagementComparable, isQualityFailureParkKind, recordedTaskFailureKind, runHasEnded, } from "../../run/journal.js";
 import { normalizeStallSnapshot } from "../../run/stall.js";
+import { deriveRunCockpitData, } from "../../tui/cockpit/derive.js";
 // ponytail: fixed 2s refresh; promote to config.visibility.* only when an operator asks.
 const REFRESH_MS = 2000;
 const NOT_COMPARABLE_NOTICE = "graph recompiled since this run — task states not comparable; resume with `--graph-changed` to audit this recompile";
 const PRIOR_GRAPH_MARKER = "prior graph";
+// One compact host-zone label per screen. Each event below is still converted from its own
+// complete UTC instant, so the zone's historical rules — including a transition within one frame
+// — stay intact rather than being rendered through this label's single sampled offset.
+const localZoneLabel = (reference = new Date()) => {
+    const offset = -reference.getTimezoneOffset();
+    if (offset === 0)
+        return "UTC";
+    const sign = offset < 0 ? "-" : "+";
+    const hours = String(Math.floor(Math.abs(offset) / 60)).padStart(2, "0");
+    const minutes = Math.abs(offset) % 60;
+    return minutes === 0
+        ? `${sign}${hours}`
+        : `${sign}${hours}:${String(minutes).padStart(2, "0")}`;
+};
+const localClockText = (content, reference = new Date()) => {
+    return content.replace(/\b([01]\d|2[0-3]):([0-5]\d):([0-5]\d)\b/gu, (_whole, h, m, s) => {
+        const instant = new Date(Date.UTC(reference.getUTCFullYear(), reference.getUTCMonth(), reference.getUTCDate(), Number(h), Number(m), Number(s)));
+        return [instant.getHours(), instant.getMinutes(), instant.getSeconds()]
+            .map((part) => String(part).padStart(2, "0"))
+            .join(":");
+    });
+};
+/** The complete journal instant behind a folded clock phrase, not a screen-wide offset sample. */
+const taskClockReference = (events, taskId, content, fallback) => {
+    const utcClock = content.match(/\b(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d\b/u)?.[0];
+    if (utcClock === undefined)
+        return fallback;
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event.taskId !== taskId || event.ts.slice(11, 19) !== utcClock)
+            continue;
+        const instant = new Date(event.ts);
+        if (Number.isFinite(instant.getTime()))
+            return instant;
+    }
+    return fallback;
+};
+// Every attempt number a cell phrase carries is the engagement's own ladder (foldActivity counts
+// dispatch labels from 1). Name that ruler wherever a bare one appears, not only in the one phrase
+// shipping today — a phrase added upstream must not reach the operator unruled.
+const labelAttemptRuler = (text) => text.replace(/(?<!engagement |run )\battempt (?=\d)/gu, "engagement attempt ");
 // The timer must keep the process ALIVE: an unref'd timer here let the event loop drain after the
 // first frame, so a live `--watch` printed once and exited 0 (OBS-11). Never unref this.
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -196,6 +240,25 @@ export const taskBox = (status) => {
         return "[!]";
     return "[ ]";
 };
+const graphTaskStatus = (state, fallback) => {
+    if (state === "completed" || state === "done")
+        return "done";
+    if (state === "interrupted")
+        return "failed";
+    return state ?? fallback;
+};
+const surfaceStatusWord = (state) => {
+    if (state === "human")
+        return "parked";
+    return state;
+};
+const surfaceTaskBox = (state, merged) => {
+    if (merged)
+        return "[x]";
+    if (state === "failed" || state === "human")
+        return "[!]";
+    return "[ ]";
+};
 export const gateBox = (state, unicode) => {
     if (unicode) {
         // shared glyph vocabulary: pass/fail verdicts, dash for skip, dim circle for not-yet-run
@@ -366,7 +429,7 @@ const tipVerifyText = (phase) => {
         return "tip-verify: pending";
     const gates = phase.gates.length ? phase.gates.join(", ") : "gate unknown";
     const failed = `tip-verify: FAILED (${gates})`;
-    const reverify = phase.state === "re-verifying" ? ` → re-verifying (attempt ${phase.attempt})` : "";
+    const reverify = phase.state === "re-verifying" ? ` → re-verifying (run attempt ${phase.attempt})` : "";
     const fingerprints = phase.fingerprints === undefined
         ? ""
         : ` · ${phase.fingerprints} fingerprint${phase.fingerprints === 1 ? "" : "s"}`;
@@ -412,11 +475,24 @@ const statusEngagement = (events, loadedHash) => {
     }
     return { comparable: baseline.comparable };
 };
-const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness = new Map()) => {
+// The journal's own reader rule (src/run/journal.ts readJsonl), applied to bytes already in hand:
+// skip blanks, drop a line that will not parse (a torn trailing write after a crash), keep the rest.
+const parseJournalSnapshot = (raw) => raw.split("\n").flatMap((line) => {
+    if (!line.trim())
+        return [];
+    try {
+        return [JSON.parse(line)];
+    }
+    catch {
+        return [];
+    }
+});
+const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness = new Map(), journalRowsOnly = false) => {
     const g = loadGraph(cwd);
     const runId = Journal.latestRunId(cwd, { withJournal: true });
     const assignments = new Map();
     let replayed = null;
+    let cockpit;
     let events = [];
     const contexts = new Map();
     let comparable = false;
@@ -424,7 +500,19 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     let supersededBy; // v1.53 T5: this run is dead — a newer run replaced it
     if (runId) {
         const j = Journal.open(cwd, runId);
-        events = j.read();
+        // ONE byte snapshot per frame. The cockpit fold and every decoration below — foldActivity,
+        // livePhases, tipVerifyPhase, gateSnapshot, the failure and liveness readings — fold THESE
+        // bytes and nothing else, so a line the daemon appends mid-frame can never pair newer task
+        // rows against older activity, phases, gates or tip state. `Journal.open` refuses a run
+        // without a journal, so the file is there to read.
+        const raw = readFileSync(join(j.dir, "journal.jsonl"), "utf8");
+        events = parseJournalSnapshot(raw);
+        // The daemon creates journal.jsonl with lock-reclaimed before run-start and a reader may also
+        // catch an empty/torn first write. Those snapshots own no task fold yet; once run-start exists,
+        // however, a fold failure is unexpected and must surface instead of becoming a false empty run.
+        if (journalRowsOnly && events.some((event) => event.event === "run-start")) {
+            cockpit = deriveRunCockpitData({ fileName: `${runId}.journal.jsonl`, raw }, "status", { graph: g });
+        }
         const sup = [...events].reverse().find((e) => e.event === "superseded" && typeof e.data.by === "string");
         supersededBy = sup?.data.by;
         // The resume comparator is the fail-closed baseline; a matching graph-rehash is the daemon's
@@ -433,12 +521,14 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
         comparable = engagement.comparable;
         rehashAt = engagement.rehashAt;
         if (comparable) {
-            replayed = j.replayStatuses();
+            if (!journalRowsOnly)
+                replayed = j.replayStatuses();
             for (const e of events) {
-                if (e.event === "task-dispatch" && e.taskId) {
+                if (!journalRowsOnly && e.event === "task-dispatch" && e.taskId) {
                     const a = e.data.assignment;
-                    if (typeof a.adapter === "string" && typeof a.model === "string")
+                    if (typeof a.adapter === "string" && typeof a.model === "string") {
                         assignments.set(e.taskId, `${a.adapter}:${a.model}`);
+                    }
                 }
                 if (e.event === "context-sample" && e.taskId && typeof e.data.tokens === "number" && Number.isFinite(e.data.tokens)) {
                     contexts.set(e.taskId, e.data.tokens); // last write wins
@@ -446,7 +536,34 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
             }
         }
     }
-    const effective = { ...g, tasks: g.tasks.map((t) => ({ ...t, status: replayed?.get(t.id) ?? t.status })) };
+    const taskRows = new Map(cockpit?.taskRows.map((row) => [row.taskId, row]) ?? []);
+    const clockFallback = new Date(now);
+    const recordedClock = new Date(events.at(-1)?.ts ?? now);
+    const zoneReference = Number.isFinite(recordedClock.getTime()) ? recordedClock : clockFallback;
+    const effective = {
+        ...g,
+        tasks: g.tasks.map((task) => ({
+            ...task,
+            status: comparable
+                ? journalRowsOnly
+                    ? graphTaskStatus(taskRows.get(task.id)?.state, task.status)
+                    : replayed?.get(task.id) ?? task.status
+                : task.status,
+        })),
+    };
+    const renderedTasks = journalRowsOnly
+        ? cockpit !== undefined && comparable
+            ? g.tasks.filter((task) => {
+                const row = taskRows.get(task.id);
+                return row !== undefined && (row.state !== undefined
+                    || row.lastEventTime !== undefined
+                    || row.attempts !== undefined
+                    || row.actor !== undefined
+                    || row.merged === true
+                    || row.parkKind !== undefined);
+            })
+            : []
+        : g.tasks;
     const starved = new Set(blockedTasks(effective).map((t) => t.id));
     // OBS-104: ONE activity fold feeds both surfaces — never re-derived here. Comparable events only
     // (a recompiled graph's journal must not animate the wrong tasks); with no or stale journal the
@@ -455,7 +572,10 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     const unicode = visual();
     const divider = unicode ? " · " : " / ";
     const width = process.stdout.columns ?? 120;
-    const done = effective.tasks.filter((t) => t.status === "done").length;
+    const done = journalRowsOnly
+        ? renderedTasks.filter((task) => graphTaskStatus(taskRows.get(task.id)?.state, task.status) === "done").length
+        : effective.tasks.filter((task) => task.status === "done").length;
+    const total = g.tasks.length;
     const ended = comparable && runHasEnded(events);
     const tipPhase = comparable ? tipVerifyPhase(events) : undefined;
     const taskIds = new Set(g.tasks.map((task) => task.id));
@@ -464,8 +584,10 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
         if (!taskIds.has(taskId))
             phases.delete(taskId);
     const hotPhase = [...phases.values()].sort((a, b) => a.order - b.order).at(-1);
-    const cells = g.tasks.map((t) => {
-        const st = replayed?.get(t.id) ?? t.status;
+    const cells = renderedTasks.map((t) => {
+        const folded = journalRowsOnly && comparable ? taskRows.get(t.id) : undefined;
+        const st = folded?.state ?? replayed?.get(t.id) ?? t.status;
+        const merged = journalRowsOnly ? folded?.merged === true : st === "done" || st === "completed";
         const failureKind = comparable ? recordedTaskFailureKind(events, t.id) : undefined;
         const terminal = st === "failed" || st === "human";
         // Unknown legacy task-failed events stay red. Typed availability noise is warn-tier only while
@@ -475,28 +597,34 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
             || (st === "failed" && failureKind === undefined));
         const livePhase = phases.get(t.id);
         const isStarved = !livePhase && starved.has(t.id);
-        const phrase = livePhase ? phaseDetail(livePhase, now, workerLiveness.get(t.id)) : isStarved ? undefined : activity.cells.get(t.id);
+        const rawPhrase = livePhase ? phaseDetail(livePhase, now, workerLiveness.get(t.id)) : isStarved ? undefined : activity.cells.get(t.id);
+        const phrase = rawPhrase === undefined
+            ? undefined
+            : journalRowsOnly
+                ? labelAttemptRuler(localClockText(rawPhrase, taskClockReference(events, t.id, rawPhrase, clockFallback)))
+                : rawPhrase;
         const label = isStarved ? " starved" : phrase ? ` ${phrase}` : "";
-        const channel = assignments.get(t.id) ?? "-";
+        const channel = journalRowsOnly ? folded?.actor ?? "-" : assignments.get(t.id) ?? "-";
         const ctx = contexts.get(t.id);
         const assignCol = ctx !== undefined ? `${channel}${divider}ctx ${ctx}` : channel;
         const gates = comparable
             ? gateSnapshot(t, events, rehashAt)
             : { states: defaultGateStates(t), priorGraph: false };
-        return { t, st, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, livePhase, ...gates };
+        return { t, st, merged, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, livePhase, ...gates };
     });
     if (!unicode) {
         // machine/CI surface — journals without phase-start stay byte-identical; new phase-aware frames
         // use an ASCII spinner so pipes never receive terminal-only braille/ANSI.
-        const rows = cells.map(({ t, st, label, assignCol, livePhase, states, priorGraph }) => {
+        const rows = cells.map(({ t, st, merged, label, assignCol, livePhase, states, priorGraph }) => {
             const chain = gateChain(states, false);
-            const prefix = livePhase ? `  ${ASCII_SPINNER[animationFrame % ASCII_SPINNER.length]} ${t.id} ` : `  ${taskBox(st)} ${t.id} `;
-            const suffix = `  ${chain}${priorGraph ? ` ${PRIOR_GRAPH_MARKER}` : ""}  ${livePhase ? "running" : String(st)}${label}  ${assignCol}`;
+            const prefix = livePhase ? `  ${ASCII_SPINNER[animationFrame % ASCII_SPINNER.length]} ${t.id} ` : `  ${surfaceTaskBox(st, merged)} ${t.id} `;
+            const suffix = `  ${chain}${priorGraph ? ` ${PRIOR_GRAPH_MARKER}` : ""}  ${livePhase ? "running" : surfaceStatusWord(st)}${label}  ${assignCol}`;
             return `${prefix}${shortGoal(t.goal, Math.max(0, width - prefix.length - suffix.length))}${suffix}`;
         });
+        const zone = journalRowsOnly ? `${divider}zone ${localZoneLabel(zoneReference)}` : "";
         const header = runId
-            ? `tickmarkr status${divider}run ${runId}${supersededBy ? `${divider}superseded by ${supersededBy}` : ""}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events, now).replaceAll(" · ", divider)}${tipPhase ? `${divider}${tipVerifyText(tipPhase)}` : ""}${divider}${tipPhase ? `${done}/${g.tasks.length} tasks done${divider}run not verified` : `${done}/${g.tasks.length} done`}`
-            : `tickmarkr status${divider}no runs yet${divider}${done}/${g.tasks.length} done`;
+            ? `tickmarkr status${divider}run ${runId}${zone}${supersededBy ? `${divider}superseded by ${supersededBy}` : ""}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events, now).replaceAll(" · ", divider)}${tipPhase ? `${divider}${tipVerifyText(tipPhase)}` : ""}${divider}${tipPhase ? `${done}/${total} tasks done${divider}run not verified` : `${done}/${total} done`}`
+            : `tickmarkr status${zone}${divider}no runs yet${divider}${done}/${total} done`;
         const legendLine = `  gates: ${GATE_NAMES.map((gate) => `${GATE_KEYS[gate]} ${gate}`).join(divider)}`;
         return {
             content: [header, legendLine, ...rows].join("\n"),
@@ -512,7 +640,7 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     const dot = dim(" · ");
     const anyFailed = cells.some((c) => c.redTier);
     const gaugeCells = 10;
-    const fill = g.tasks.length ? Math.round((done / g.tasks.length) * gaugeCells) : 0;
+    const fill = total ? Math.round((done / total) * gaugeCells) : 0;
     const tipFailed = tipPhase?.state === "failed";
     const progressTone = anyFailed || tipFailed ? fail : tipPhase ? warn : ok;
     const gauge = (fill ? progressTone("█".repeat(fill)) : "") + (fill < gaugeCells ? dim("░".repeat(gaugeCells - fill)) : "");
@@ -522,16 +650,17 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
         .replace(/\balive\b/, ok("alive"))
         .replaceAll(" · ", dot);
     const tally = tipPhase
-        ? `${progressTone(`${done}/${g.tasks.length} tasks done`)}${dot}${progressTone("run not verified")}`
-        : `${done}/${g.tasks.length} done`;
+        ? `${progressTone(`${done}/${total} tasks done`)}${dot}${progressTone("run not verified")}`
+        : `${done}/${total} done`;
     const tipStatus = tipPhase
         ? `${tipFailed ? fail(tipVerifyText(tipPhase)) : warn(tipVerifyText(tipPhase))}${dot}`
         : "";
-    const header = ` ${title(runId ? `run ${runId}` : "tickmarkr")}${dot}` +
+    const zone = journalRowsOnly ? `zone ${localZoneLabel(zoneReference)}${dot}` : "";
+    const header = ` ${title(runId ? `run ${runId}` : "tickmarkr")}${dot}${zone}` +
         (runId
             ? `${supersededBy ? `${warn(`superseded by ${supersededBy}`)}${dot}` : ""}${!comparable ? `${warn(NOT_COMPARABLE_NOTICE)}${dot}` : ""}${live}${dot}${tipStatus}`
             : `no runs yet${dot}`) +
-        `${gauge} ${tipPhase ? tally : done === g.tasks.length && g.tasks.length > 0 ? ok(tally) : tally}`;
+        `${gauge} ${tipPhase ? tally : done === total && total > 0 ? ok(tally) : tally}`;
     const hr = rule(Math.min(width, 100));
     // OBS-104 run-level now line: names the most recent journal event. TTY frame only — the non-TTY
     // machine surface is byte-pinned (status-brand golden) and must not drift. Rendered BELOW the task
@@ -542,25 +671,26 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     // id, goal at full width, and only SHORT status words. Line 2 carries the machinery, dim and
     // aligned under the goal: gate chain, live activity phrase (or channel), ctx. Long channel names
     // and activity phrases live on line 2 only, so they can never squeeze the goal or wrap line 1.
-    const taskVerdict = (c) => c.st === "done" ? "pass" : c.redTier ? "fail" : c.st === "failed" || c.st === "human" ? "warn" : "neutral";
-    const statusWord = (c) => c.livePhase ? "running" : c.redTier ? "failed" : c.st === "failed" ? "warn" : String(c.st);
+    const taskVerdict = (c) => c.merged ? "pass" : c.redTier ? "fail" : c.st === "failed" || c.st === "human" ? "warn" : "neutral";
+    const statusWord = (c) => c.livePhase ? "running" : c.redTier ? "failed" : c.st === "failed" ? "warn" : surfaceStatusWord(c.st);
     const idW = Math.max(...cells.map((c) => c.t.id.length), 2);
     // plain-text status suffixes for width math only — starved / failed gate names / approval hint
-    const suffixPlain = (c) => (c.isStarved ? " · starved" : "") + failedSuffix(c.states) + humanGateSuffix(c.t, c.st, c.states);
+    const suffixPlain = (c) => (c.isStarved ? " · starved" : "") + failedSuffix(c.states)
+        + humanGateSuffix(c.t, graphTaskStatus(c.st, c.t.status), c.states);
     const stW = Math.max(...cells.map((c) => statusWord(c).length + suffixPlain(c).length));
     const avail = Math.max(8, width - (5 + idW) - 2 - stW);
     const goals = cells.map((c) => shortGoal(c.t.goal, avail));
     const goalW = Math.max(8, ...goals.map((s) => s.length));
     const indent = " ".repeat(idW + 5); // line 2 starts under the goal column
     const rows = cells.map((c, i) => {
-        const { t, st, failureKind, redTier, states, priorGraph, isStarved, phrase, channel, ctx, livePhase } = c;
+        const { t, st, merged, failureKind, redTier, states, priorGraph, isStarved, phrase, channel, ctx, livePhase } = c;
         const word = statusWord(c);
         const staleWorker = livePhase?.phase === "worker"
             && workerOutputAge(livePhase, now, workerLiveness.get(t.id)) >= 60_000;
-        const stWord = staleWorker ? warn(word) : st === "done" ? ok(word) : redTier ? fail(word) : st === "failed" || st === "human" ? warn(word) : word;
+        const stWord = staleWorker ? warn(word) : merged ? ok(word) : redTier ? fail(word) : st === "failed" || st === "human" ? warn(word) : word;
         // a fail names its gate in words right here — the one moment gate identity is needed on a row
         const f = failedGates(states);
-        const human = humanGateSuffix(t, st, states);
+        const human = humanGateSuffix(t, graphTaskStatus(st, t.status), states);
         const statusCell = stWord +
             (isStarved ? dot + fail("starved") : "") +
             (f.length ? dot + fail(f.join(", ")) : "") +
@@ -709,7 +839,7 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
                 }
             }
             else {
-                frame = renderFrame(cwd, nowMs, i, workerLiveness);
+                frame = renderFrame(cwd, nowMs, i, workerLiveness, true);
                 if (tty) {
                     updateTitle(frame.hotPhase, nowMs);
                     process.stdout.write(`\x1b[2J\x1b[H${BANNER}${frame.content}\n${legend(` watching · refresh ${REFRESH_MS / 1000}s · ^C to quit`)}`);

package/dist/compile/collateral.d.ts

@@ -1,3 +1,4 @@
+import { type TickmarkrConfig } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
 /**
  * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
@@ -28,5 +29,88 @@ export declare function separabilityErrors(tasks: ReadonlyArray<Pick<Task, "id"
  * diff at the 130k cap; it took 28 dispatches and never passed review, while T3 (4 items) took 5.
  */
 export declare function taskBudgetErrors(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>): string[];
-/** Every Task Unit Contract violation in one pass, ready to throw. */
-export declare function taskUnitContractErrors(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "deps" | "acceptance">>): string[];
+/**
+ * Max acceptance × files[] surface per task (OVERSEER-RULING-20260731-velocity, R2:
+ * `surface = acceptance.length × files.length > 24` fails compile). EVERY criterion counts —
+ * a judge item is still a thing one worker must satisfy and one reviewer must verify in the
+ * same pass, and counting only test oracles let judge-heavy tasks bypass the bound (the first
+ * T6 attempt was rejected for exactly that narrowing). The calibration corpus pins the bound:
+ * v1.84's original T1 measures 6×5=30 and fails; v1.79's tasks pass — its widest, T5 at
+ * 4×7=28, rides the recorded exception below rather than redefining the metric.
+ */
+export declare const MAX_TASK_SURFACE = 24;
+/**
+ * Max goal words per acceptance criterion (v1.84's T1 measured 75). Gameable only by adding
+ * criteria — which is the point: every law migrated from goal prose to a criterion moves its
+ * enforcement from the 40-minute review round to the 2-minute judge.
+ */
+export declare const MAX_GOAL_WORDS_PER_CRITERION = 60;
+/**
+ * A recorded surface exception — an explicit contract amendment, never a silent bypass. Each
+ * entry matches exactly ONE historical task shape: task id, acceptance count, and the full
+ * files[] list must all be identical, so nothing an author writes later can ride one (matching
+ * would require copying a recorded files[] verbatim — an audible spec edit any reviewer sees).
+ */
+export interface SurfaceException {
+    /** Task id as authored in the spec the exception was recorded for. */
+    id: string;
+    /** Exact acceptance-criterion count of the excepted task. */
+    acceptance: number;
+    /** Exact files[] of the excepted task (order-insensitive; sorted at recording time). */
+    files: string[];
+    /** Where the amendment is recorded and why it exists. */
+    reason: string;
+}
+export declare const SURFACE_CONTRACT_EXCEPTIONS: ReadonlyArray<SurfaceException>;
+/**
+ * R2 surface bound: acceptance criteria × files[] patterns, one error per offending task.
+ * `exceptions` defaults to the recorded contract amendments; tests pass [] to prove an
+ * exception is load-bearing.
+ */
+export declare function surfaceErrors(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>, exceptions?: ReadonlyArray<SurfaceException>): string[];
+/** R2 goal-density bound: goal words per acceptance criterion, one error per offending task. */
+export declare function goalDensityErrors(tasks: ReadonlyArray<Pick<Task, "id" | "goal" | "acceptance">>): string[];
+/**
+ * R2 symbol ownership: a code identifier named in a judge or test criterion that resolves uniquely
+ * to a definition OUTSIDE the task's files[] is unsatisfiable by construction — the v1.84 T1
+ * planFrame defect, which burned two review rounds because the enabling symbol lived in another
+ * task's file. Zero definition sites (plain-language false positive, external symbol, or a file
+ * the task itself creates) and ambiguous tokens (multiple definition sites) stay silent. The index
+ * must be COMPLETE: any code path that cannot be read is its own error — the rule fails closed
+ * rather than trust a partial scan.
+ */
+export declare function symbolOwnershipErrors(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>, repoRoot: string): string[];
+/**
+ * The participation half of the config — everything the review-policy rules read. `byShape` rides
+ * along because `gates.byShape.<shape>.review: false` is a second, NON-monotone participation switch:
+ * review.policy can only raise a task's policy, but a shape override can omit the review gate outright
+ * (src/gates/run-gates.ts `enabled`). Path-keyed participation is only true if both are read together.
+ */
+export type ReviewParticipation = TickmarkrConfig["review"] & {
+    byShape?: TickmarkrConfig["gates"]["byShape"];
+};
+/**
+ * R3 review participation (OVERSEER-RULING-20260731-velocity; OBS-186). The compiler assigns
+ * `reviewPolicy` from the DECLARED files[] — `judge-only` only when every declared path is provably
+ * docs/CHANGELOG/RELEASING/version-mirror leaf work — and the operator's floor may raise it. A task
+ * that would SKIP review while touching `review.criticalPaths` is the exact shape OBS-186 caught in
+ * the field: the riskiest task in the bundle silently declining the one gate that exists for it. That
+ * cannot be a warning, because nothing downstream would stop it — the gate would honour the policy.
+ */
+export declare function reviewParticipationErrors(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "shape">>, review: ReviewParticipation): string[];
+/**
+ * Every Task Unit Contract violation in one pass, ready to throw. `repoRoot` backs the
+ * symbol-ownership lint and the participation config, and defaults to the invocation directory —
+ * correct for the CLI/daemon, which compile from inside the target repo.
+ *
+ * KNOWN GAP (R2 review, T6/T7 scope): the compile seam in src/compile/index.ts
+ * (`enforceTaskUnitContract`) does not thread `compileSource`'s `root` argument into this call, so a
+ * PROGRAMMATIC compile whose target repo differs from process.cwd() resolves the wrong root and can
+ * miss that repo's own `review.criticalPaths`. Threading it is one line in src/compile/index.ts,
+ * outside this task's file scope. Two things bound the exposure meanwhile, both live: the critical
+ * set here is the UNION with the shipped defaults, so a wrong root can never lower enforcement below
+ * the shipped floor; and the review GATE — which is handed the run's real config — refuses to skip a
+ * critical path itself (src/gates/review.ts), so a lint this seam misses costs a late verdict rather
+ * than an unreviewed one. The compile lint is the early warning; the gate is the fail-closed backstop.
+ */
+export declare function taskUnitContractErrors(tasks: ReadonlyArray<Pick<Task, "id" | "goal" | "files" | "deps" | "acceptance" | "shape">>, repoRoot?: string, review?: ReviewParticipation): string[];