tickmarkr 1.84.0 → 1.86.0

package/dist/adapters/claude-code.js

@@ -3,7 +3,7 @@ import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { parseWorkerResult } from "./prompt.js";
-import { channelsFromConfig, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
+import { channelsFromConfig, declareInputBox, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
 // SPEND-01/SPEND-11: claude writes a per-session JSONL to ~/.claude/projects/<slug>/ where slug is the
 // realpath'd cwd with every non-alphanumeric char replaced by "-" (verified 114/114 — 36-DIAGNOSIS.md).
 // The old `/`-only formula missed the "." in `.tickmarkr/worktrees/…` — ENOENT on every worktree dispatch.
@@ -40,6 +40,63 @@ export const CLAUDE_TRUST_DIALOG = {
     fingerprint: "Quick safety check: Is this a project you created or one you trust?",
     key: "Enter",
 };
+// OBS-201/262 nudge deliverability: claude-code is the ONLY member of NUDGEABLE_ADAPTERS, and the
+// driver's deliverTyped pincer (readiness stable-frame → type → read-back → verified submit) needs a
+// declared input box for any delivery whose command is not the adapter's own launch line — which a
+// nudge never is. Without this declaration `requireInputBox` was false, readiness fell back to
+// "the pane no longer echoes the command", and submission fell through to the positional fallback:
+// the rescue that OBS-262 widened the gate for could not be verifiably delivered to the one adapter
+// allowed to receive it.
+//
+// CAPTURED, not guessed (claude 2.1.220, tmux 120x30, 2026-08-03 — the state-to-PIXELS law):
+//     ────────────────────────────────────────────  ← full-width rule
+//     ❯ You are still assigned this task…       ← caret, NBSP, then the typed turn
+//     ────────────────────────────────────────────  ← full-width rule
+// Two findings the kimi-shaped guess would have got wrong, and both are fatal on their own:
+//   1. claude's editor is NOT a bordered ╭─╮ box — it is one row FENCED BY TWO RULES, so a
+//      `│ > ` fingerprint or a border-adjacency walk never fires.
+//   2. the caret is padded with U+00A0, not a space. A `"❯ "` fingerprint with an ASCII space
+//      matches nothing, ever — the OBS-152 failure mode exactly (six versions of "kimi is broken"
+//      were all anchored matchers meeting a TUI that renders differently than assumed).
+// `match` means THE EDITOR IS PAINTED and is deliberately true for an empty editor (readiness);
+// `emptyMatch` is the stricter "painted AND carrying nothing", which is what proves a submit
+// registered. Callers deciding submission must test emptyMatch first — see submissionRegistered.
+const CLAUDE_ANSI_SGR_RE = /\u001B\[[0-9;]*m/g;
+const CLAUDE_RULE_RE = /^─{8,}$/;
+const CLAUDE_CARET_RE = /^❯\u00A0/;
+const CLAUDE_CARET_EMPTY_RE = /^❯\u00A0\s*$/;
+// A wrapped or multi-line turn grows the editor downward before the closing rule.
+// ponytail: a fixed window, not a parser — raise it if a real capture ever shows a taller editor.
+const CLAUDE_MAX_EDITOR_ROWS = 8;
+function matchesClaudeEditor(paneText, empty) {
+    // Trim ASCII margins ONLY: String.trim() eats U+00A0, which would erase the very byte that
+    // distinguishes claude's caret padding from an ordinary prompt line.
+    const lines = paneText.replace(CLAUDE_ANSI_SGR_RE, "").split("\n").map((l) => l.replace(/^[ \t]+|[ \t]+$/g, ""));
+    const caret = empty ? CLAUDE_CARET_EMPTY_RE : CLAUDE_CARET_RE;
+    return lines.some((line, i) => {
+        if (!caret.test(line))
+            return false;
+        if (i === 0 || !CLAUDE_RULE_RE.test(lines[i - 1]))
+            return false;
+        for (let below = i + 1; below < lines.length && below <= i + CLAUDE_MAX_EDITOR_ROWS; below++) {
+            if (CLAUDE_RULE_RE.test(lines[below]))
+                return true;
+        }
+        return false;
+    });
+}
+export const CLAUDE_INPUT_BOX = declareInputBox("claude-code", {
+    fingerprint: "❯\u00A0",
+    match: (paneText) => matchesClaudeEditor(paneText, false),
+    emptyMatch: (paneText) => matchesClaudeEditor(paneText, true),
+    // OBS-342: daemon-built launches carry intent through paneDispatchCommand; their wrapper bytes are
+    // never re-parsed here. The first-delivery fact keeps direct driver consumers on the same honest
+    // lifecycle: a fresh claude-code worker slot is a shell awaiting its launch, every later delivery
+    // is a TUI turn awaiting this box. Both interactive and resume builders share that contract.
+    firstDeliveryIsLaunch: true,
+    // The 2026-08-03 capture reached a painted editor ~10s after the trust answer on a warm install.
+    readinessTimeoutMs: 30_000,
+});
 export function claudeSlug(real) {
     return real.replace(/[^A-Za-z0-9]/g, "-");
 }
@@ -168,6 +225,7 @@ export const claudeCode = {
     // the daemon safely answers only the exact adapter-declared dialog once per slot.
     interactiveCommand: (promptFile, model) => `claude --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`,
     trustDialog: CLAUDE_TRUST_DIALOG,
+    inputBox: CLAUDE_INPUT_BOX,
     resumeCommand: (sessionId, promptFile, model) => `claude -r ${shq(sessionId)} --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };

package/dist/adapters/fake.js

@@ -35,21 +35,33 @@ export class FakeAdapter {
         // contains TICKMARKR-JUDGE — a review/consult prompt never touches it (research Pitfall 3).
         let prompt = "";
         let isJudge = false;
+        // v1.85 T4: the role THIS prompt is, when it can be told. The three scratch files are shared per
+        // script path, so a build that writes a role it is not can clobber a concurrently-dispatched
+        // sibling's file between that sibling's build and its `cat` — which is exactly what a round that
+        // launches judge and review together does. Writing only the matching role removes the race: the
+        // other roles' `grep` guards below can never fire for this prompt, so their files are never read.
+        let role;
         try {
             prompt = readFileSync(promptFile, "utf8");
             isJudge = /TICKMARKR-(?:JUDGE|SCOPE)/.test(prompt);
+            role = isJudge ? "judge" : /TICKMARKR-REVIEW/.test(prompt) ? "review" : /TICKMARKR-CONSULT/.test(prompt) ? "consult" : undefined;
         }
         catch {
             // unreadable promptFile: can't detect role; serve static values (legacy headless-call behavior)
         }
+        const nonce = this.nonceFor(promptFile);
         const serve = (key) => {
+            if (role !== undefined && key !== role)
+                return join(dirname(this.scriptPath), `${key}.json`);
             let val = this.script[key];
             if (key === "judge" && isJudge && Array.isArray(val)) {
                 // array served sequentially per judge prompt, clamped to last (steps[min(n,len-1)] idiom)
                 val = val[Math.min(this.judgeIdx, val.length - 1)];
                 this.judgeIdx++;
             }
-            if (key === "judge" && isJudge && val && typeof val === "object" && !Array.isArray(val)) {
+            // Legacy zero-token judge scripts may omit per-criterion evidence. Shape that scripted response
+            // here, where the fake authors it, instead of teaching the shared LLM transport about adapter ids.
+            if (key === "judge" && prompt.startsWith("TICKMARKR-JUDGE") && val && typeof val === "object" && !Array.isArray(val)) {
                 const verdict = val;
                 if (verdict.pass === true && Array.isArray(verdict.criteria) && verdict.criteria.length === 0) {
                     const items = prompt.match(/## Acceptance criteria \(judge\)\n([\s\S]*?)\n\n## Diff/)?.[1]
@@ -57,8 +69,31 @@ export class FakeAdapter {
                     val = { ...verdict, criteria: items.map((criterion) => ({ criterion, met: true, reason: "scripted fake pass" })) };
                 }
             }
-            const p = join(dirname(this.scriptPath), `${key}.json`);
-            writeFileSync(p, JSON.stringify(val ?? {}, null, 1));
+            if (key === "judge" && isJudge && val && typeof val === "object" && !Array.isArray(val)) {
+                const verdict = val;
+                const line = /```diff\n([\s\S]*?)```/.exec(prompt)?.[1].split("\n").find((candidate) => candidate.trim());
+                if (line && Array.isArray(verdict.criteria)) {
+                    val = {
+                        ...verdict,
+                        criteria: verdict.criteria.map((row) => row && typeof row === "object" && !("evidence" in row) ? { ...row, evidence: line } : row),
+                    };
+                }
+            }
+            // The configured fake adapter binds the nonce read from this prompt before one object is emitted.
+            // Renamed subclasses model other CLIs and retain their own producer contract. Missing nonces stay
+            // missing so the classifier can distinguish silence from participation.
+            if (this.id === "fake" && nonce && val && typeof val === "object" && !Array.isArray(val)) {
+                const { nonce: _scriptedNonce, ...verdict } = val;
+                val = { nonce, ...verdict };
+            }
+            // Concurrent gates share one FakeAdapter script. A nonce-specific response path keeps one call's
+            // responder-authored bytes from being replaced by a sibling between command construction and cat.
+            const responseNonce = this.id === "fake" ? nonce : "";
+            const p = join(dirname(this.scriptPath), `${key}${responseNonce ? `-${responseNonce}` : ""}.json`);
+            const json = JSON.stringify(val ?? {}, null, 1)
+                .split("\n").map((line) => line.trim()).join(" ")
+                .replace(/^\{ /, "{").replace(/ \}$/, "}");
+            writeFileSync(p, json);
             return p;
         };
         return `bash -c 'grep -Eq "TICKMARKR-(JUDGE|SCOPE)" ${shq(promptFile)} && cat ${shq(serve("judge"))}; grep -q TICKMARKR-REVIEW ${shq(promptFile)} && cat ${shq(serve("review"))}; grep -q TICKMARKR-CONSULT ${shq(promptFile)} && cat ${shq(serve("consult"))}; true'`;
@@ -111,7 +146,10 @@ export class FakeAdapter {
     // parseWorkerResult(output, nonce) succeeds exactly as before the nonce existed
     nonceFor(promptFile) {
         try {
-            return /TICKMARKR_RESULT_([0-9a-z]+)/.exec(readFileSync(promptFile, "utf8"))?.[1] ?? "";
+            const prompt = readFileSync(promptFile, "utf8");
+            return /VERDICT_NONCE:\s*([0-9a-f]+)/i.exec(prompt)?.[1]
+                ?? /TICKMARKR_RESULT_([0-9a-z]+)/.exec(prompt)?.[1]
+                ?? "";
         }
         catch {
             return "";

package/dist/adapters/model-lints.d.ts

@@ -1,14 +1,31 @@
-import { type TickmarkrConfig } from "../config/config.js";
+import { type TickmarkrConfig, type Tier } from "../config/config.js";
 import type { Task } from "../graph/schema.js";
 import { type AuthHealth, type WorkerAdapter } from "./types.js";
+import { type CatalogModelEvidence, type CatalogReadResult } from "./catalog-remote.js";
 export declare const SEED_STAMPED = "2026-07-09";
 export declare const MODEL_STALE_DAYS = 30;
 export declare const ttyVisual: () => boolean;
-/** True when any tier entry declares at least one model window. */
+export interface CatalogModelAdvisory {
+    coverage: "covered" | "uncovered";
+    evidence?: CatalogModelEvidence;
+    suggestion?: {
+        tier: Tier;
+        kind: "inference";
+        basis: "intelligence" | "price";
+        provenanceNote: string;
+    };
+    display: string;
+}
+export declare function catalogModelAdvisory(cfg: TickmarkrConfig, catalog: CatalogReadResult, adapter: string, model: string, resolvedModel?: string): CatalogModelAdvisory;
+/**
+ * Whether the doctor should add its optional window column. Keep non-TTY default output stable for
+ * machine consumers; an interactive seed-only matrix shows T14's fleet windows, and any explicit
+ * non-seed/overridden window keeps the historical operator-configured column behavior.
+ */
 export declare function hasWindowsConfig(cfg: TickmarkrConfig): boolean;
 export declare function declaredModelWindow(cfg: TickmarkrConfig, adapter: string, model: string): number | undefined;
-/** Best-effort plan-time payload estimate: prompt shell + context + files[] byte sizes. */
-export declare function estimateTaskPayloadTokens(task: Task, repoRoot: string, feedback?: string): number;
+/** A numeric estimate exists only when every payload path is measurable from the worker-visible tree. */
+export declare function estimateTaskPayloadTokens(task: Task, repoRoot: string, feedback?: string): number | undefined;
 export type RoutedAssignment = {
     taskId: string;
     adapter: string;
@@ -28,7 +45,10 @@ export declare function formatModelAuthLine(excluded: {
     reason: string;
     probedAt: string;
 }[], tty?: boolean, stateDir?: string): string;
-export declare function suggestOverlay(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], stateDir?: string): string;
+export declare function suggestOverlay(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[], stateDir?: string, opts?: {
+    catalog?: CatalogReadResult;
+    resolvedModel?: (adapter: string, model: string) => string | undefined;
+}): string;
 /** Unclassified models surfaced for fleet screen 2 (doctor matrix math, no tier fabrication). */
 export declare function fleetUnclassifiedModels(cfg: TickmarkrConfig, health: Record<string, AuthHealth>, adapters: WorkerAdapter[]): {
     adapter: string;

package/dist/adapters/model-lints.js

@@ -1,8 +1,10 @@
-import { existsSync, statSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { DEFAULT_CONFIG, TIER_RANK } from "../config/config.js";
 import { buildTaskPrompt } from "./prompt.js";
 import { MODEL_ID_RE } from "./types.js";
+import { resolveCatalogModel } from "./catalog-remote.js";
 export const SEED_STAMPED = "2026-07-09";
 // knowledge past this age gets a "rerun tickmarkr doctor" nudge (BLOCKED_POLL_MS-style named constant).
 export const MODEL_STALE_DAYS = 30;
@@ -15,41 +17,154 @@ const LINT_CAP = 5;
 const TTY_LINT_CAP = 3;
 const DEFAULT_STATE_DIR = ".tickmarkr";
 const doctorJsonRef = (stateDir) => ` — see ${stateDir}/doctor.json`;
+const DECLARED_SEED_PREFER_DISPOSITION = "no declared preference overrides it";
+const LEGACY_DOCTOR_SEED_PREFER_DISPOSITION = "auto-prefer is routing around it";
 export const ttyVisual = () => process.stdout.isTTY === true && process.env.NO_COLOR === undefined;
 // ponytail: chars/4 token heuristic — good enough for advisory plan lint; no tokenizer dep.
 const CHARS_PER_TOKEN = 4;
-/** True when any tier entry declares at least one model window. */
-export function hasWindowsConfig(cfg) {
+const intelligenceTier = (index) => index >= 65 ? "frontier" : index >= 40 ? "mid" : "cheap";
+const priceTier = (outputPerMtok) => outputPerMtok >= 12 ? "frontier" : outputPerMtok >= 2 ? "mid" : "cheap";
+function catalogEvidenceNote(evidence, catalog) {
+    const cost = evidence.inputCostPerMtok !== undefined && evidence.outputCostPerMtok !== undefined
+        ? `$${evidence.inputCostPerMtok}/$${evidence.outputCostPerMtok} per Mtok`
+        : "not reported";
+    const features = evidence.features.length ? evidence.features.join(",") : "none reported";
+    const intelligence = evidence.intelligenceIndex !== undefined
+        ? `; Artificial Analysis Intelligence Index=${evidence.intelligenceIndex}${evidence.intelligenceIndexVersion ? ` (version ${evidence.intelligenceIndexVersion})` : ""}`
+        : "";
+    const freshness = catalog.stale ? `${catalog.source} stale cache` : catalog.source;
+    return `models.dev id=${evidence.modelId}; cost=${cost}; context=${evidence.contextWindow ?? "not reported"}; features=${features}${intelligence}; catalog=${freshness}; fetchedAt=${catalog.catalog.fetchedAt}`;
+}
+export function catalogModelAdvisory(cfg, catalog, adapter, model, resolvedModel) {
+    const entry = cfg.tiers[adapter];
+    const evidence = resolveCatalogModel(catalog.catalog, {
+        // A tier vendor is NULLABLE (config.ts:64) — null means "declared as having none at tier level, so
+        // each model must declare its own". `resolveCatalogModel` takes an optional provider HINT
+        // (catalog-remote.ts:218), and "no hint" is `undefined` there, so null normalizes to undefined rather
+        // than travelling as a third state. Neither T17 nor T19 could see this seam: their files[] are
+        // disjoint, so no ordering edge was derived, they dispatched 7ms apart, and each worktree was cut
+        // before the other's change existed. Both gates passed truthfully; only the merged pair fails to
+        // compile (OBS-371).
+        provider: entry?.vendor ?? undefined,
+        model,
+        ...(resolvedModel ? { resolvedModel } : {}),
+    });
+    if (!evidence) {
+        return {
+            coverage: "uncovered",
+            display: `${model} — uncovered by ${catalog.source === "cache" ? "cached catalogs" : "vendored catalog"}; no tier suggestion`,
+        };
+    }
+    const note = catalogEvidenceNote(evidence, catalog);
+    const basis = evidence.intelligenceIndex !== undefined
+        ? { basis: "intelligence", tier: intelligenceTier(evidence.intelligenceIndex) }
+        : entry?.channel === "api" && evidence.outputCostPerMtok !== undefined
+            ? { basis: "price", tier: priceTier(evidence.outputCostPerMtok) }
+            : undefined;
+    if (!basis) {
+        const reason = entry?.channel === "sub" && evidence.outputCostPerMtok !== undefined
+            ? "subscription billing; no price-derived suggestion"
+            : "no tier suggestion from available evidence";
+        return { coverage: "covered", evidence, display: `${model} → ${note}; ${reason}` };
+    }
+    const provenanceNote = `SUGGESTED ${basis.tier} (${basis.basis} inference, not a measurement) — ${note}; operator confirmation required`;
+    return {
+        coverage: "covered",
+        evidence,
+        suggestion: { tier: basis.tier, kind: "inference", basis: basis.basis, provenanceNote },
+        display: `${model} → ${note}; ${provenanceNote}`,
+    };
+}
+function hasAnyWindows(cfg) {
     return Object.values(cfg.tiers).some((t) => t.windows && Object.keys(t.windows).length > 0);
 }
+/**
+ * Whether the doctor should add its optional window column. Keep non-TTY default output stable for
+ * machine consumers; an interactive seed-only matrix shows T14's fleet windows, and any explicit
+ * non-seed/overridden window keeps the historical operator-configured column behavior.
+ */
+export function hasWindowsConfig(cfg) {
+    const hasOperatorWindow = Object.entries(cfg.tiers).some(([adapter, entry]) => Object.entries(entry.windows ?? {}).some(([model, window]) => DEFAULT_CONFIG.tiers[adapter]?.windows?.[model] !== window));
+    if (hasOperatorWindow)
+        return true;
+    const seedOnly = Object.keys(cfg.tiers).every((adapter) => adapter in DEFAULT_CONFIG.tiers);
+    return ttyVisual() && seedOnly && hasAnyWindows(cfg);
+}
 export function declaredModelWindow(cfg, adapter, model) {
     return cfg.tiers[adapter]?.windows?.[model];
 }
-function fileBytes(repoRoot, rel) {
-    if (rel.includes("*") || rel.includes("?") || rel.includes("{"))
-        return 0; // glob — not measurable at plan time
-    try {
-        const p = join(repoRoot, rel);
-        if (!existsSync(p))
-            return 0;
-        return statSync(p).size;
-    }
-    catch {
-        return 0;
+const GLOB_CHARS = /[*?{[]/;
+// T13's visibility oracle is the committed base tree: workers are created from HEAD, not from the
+// author's checkout or index. Keep --full-tree load-bearing for callers below the repository root.
+function baseTreeAtHead(dir) {
+    const git = (...args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const top = git("rev-parse", "--show-toplevel");
+    const tree = git("ls-tree", "--full-tree", "-r", "--name-only", "HEAD");
+    if (top.status !== 0 || tree.status !== 0 || typeof top.stdout !== "string" || typeof tree.stdout !== "string")
+        return undefined;
+    return { root: top.stdout.trim(), tracked: new Set(tree.stdout.split("\n").filter(Boolean)) };
+}
+function fileBytes(repoRoot, rel, tree = baseTreeAtHead(repoRoot)) {
+    if (GLOB_CHARS.test(rel))
+        return { status: "unreadable", reason: "glob" };
+    if (!tree)
+        return { status: "unreadable", reason: "base-tree-unavailable" };
+    const path = rel.replace(/\/+$/, "");
+    if (!tree.tracked.has(path)) {
+        if ([...tree.tracked].some((tracked) => tracked.startsWith(`${path}/`))) {
+            return { status: "unreadable", reason: "directory" };
+        }
+        return { status: "unreadable", reason: existsSync(join(tree.root, path)) ? "untracked" : "absent" };
     }
+    // Read the blob size from HEAD too: an unstaged/staged checkout edit is not what the worker receives.
+    const size = spawnSync("git", ["-C", tree.root, "cat-file", "-s", `HEAD:${path}`], { encoding: "utf8" });
+    const bytes = Number.parseInt(typeof size.stdout === "string" ? size.stdout.trim() : "", 10);
+    return size.status === 0 && Number.isSafeInteger(bytes) && bytes >= 0
+        ? { status: "measured", bytes }
+        : { status: "unreadable", reason: "base-tree-read-failed" };
 }
-/** Best-effort plan-time payload estimate: prompt shell + context + files[] byte sizes. */
-export function estimateTaskPayloadTokens(task, repoRoot, feedback = "") {
+function taskPayloadResolution(task, repoRoot, feedback) {
     let bytes = buildTaskPrompt(task, feedback).length;
-    for (const p of task.context)
-        bytes += fileBytes(repoRoot, p);
-    for (const p of task.files)
-        bytes += fileBytes(repoRoot, p);
-    return Math.ceil(bytes / CHARS_PER_TOKEN);
+    const unreadable = [];
+    const tree = baseTreeAtHead(repoRoot);
+    const add = (field, path) => {
+        const measured = fileBytes(repoRoot, path, tree);
+        if (measured.status === "measured")
+            bytes += measured.bytes;
+        else
+            unreadable.push({ field, path, reason: measured.reason });
+    };
+    for (const path of task.context)
+        add("context", path);
+    for (const path of task.files)
+        add("files", path);
+    return { tokens: Math.ceil(bytes / CHARS_PER_TOKEN), unreadable };
+}
+/** A numeric estimate exists only when every payload path is measurable from the worker-visible tree. */
+export function estimateTaskPayloadTokens(task, repoRoot, feedback = "") {
+    const estimate = taskPayloadResolution(task, repoRoot, feedback);
+    return estimate.unreadable.length === 0 ? estimate.tokens : undefined;
+}
+function unreadablePayloadLint(taskId, unreadable) {
+    const describe = ({ field, path, reason }) => {
+        const prefix = `${field} ${JSON.stringify(path)}`;
+        if (reason === "untracked")
+            return `${prefix} is present in the checkout but not in the base tree`;
+        if (reason === "absent")
+            return `${prefix} is absent from the base tree and checkout`;
+        if (reason === "glob")
+            return `${prefix} is a glob and cannot be measured`;
+        if (reason === "directory")
+            return `${prefix} is a directory and cannot be measured as one file`;
+        if (reason === "base-tree-unavailable")
+            return `${prefix} cannot be checked because the base tree is unavailable`;
+        return `${prefix} could not be read from the base tree`;
+    };
+    return `${taskId}: payload unreadable — ${unreadable.map(describe).join(", ")}; context-window comparison skipped`;
 }
 /** Advisory only — absent windows config or undeclared model window ⇒ no lint. */
 export function contextWindowLints(tasks, assignments, cfg, repoRoot) {
-    if (!hasWindowsConfig(cfg))
+    if (!hasAnyWindows(cfg))
         return [];
     const byId = new Map(assignments.map((a) => [a.taskId, a]));
     const lints = [];
@@ -60,9 +175,13 @@ export function contextWindowLints(tasks, assignments, cfg, repoRoot) {
         const window = declaredModelWindow(cfg, a.adapter, a.model);
         if (window === undefined)
             continue;
-        const est = estimateTaskPayloadTokens(t, repoRoot);
-        if (est > window) {
-            lints.push(`${t.id}: payload ~${est} tokens exceeds ${a.adapter}:${a.model} window ${window}`);
+        const estimate = taskPayloadResolution(t, repoRoot, "");
+        if (estimate.unreadable.length > 0) {
+            lints.push(unreadablePayloadLint(t.id, estimate.unreadable));
+            continue;
+        }
+        if (estimate.tokens > window) {
+            lints.push(`${t.id}: payload ~${estimate.tokens} tokens exceeds ${a.adapter}:${a.model} window ${window}`);
         }
     }
     return lints;
@@ -78,8 +197,7 @@ const adapterHasAuthedChannel = (adapterId, shape, cfg, health, adapters) => {
         return true; // no per-model probe data — compat, not dead
     return a.channels(cfg).some((c) => TIER_RANK[c.tier] >= TIER_RANK[minTier] && h.modelAuth?.[c.model]?.authed === true);
 };
-// OBS-30 T2: warn when a built-in seed prefer names an adapter with zero authed channels this probe pass.
-export function seedPreferLints(cfg, health, adapters, overlayPreferShapes = new Set()) {
+function collectSeedPreferLints(cfg, health, adapters, overlayPreferShapes, disposition) {
     const lints = [];
     for (const shape of Object.keys(cfg.routing.map)) {
         if (overlayPreferShapes.has(shape))
@@ -89,18 +207,23 @@ export function seedPreferLints(cfg, health, adapters, overlayPreferShapes = new
             if (!cfg.tiers[adapterId])
                 continue;
             if (!adapterHasAuthedChannel(adapterId, shape, cfg, health, adapters)) {
-                lints.push(`routing seed names dead adapter '${adapterId}' for shape '${shape}' — auto-prefer is routing around it`);
+                lints.push(`routing seed names dead adapter '${adapterId}' for shape '${shape}' — ${disposition}`);
             }
         }
     }
     return lints;
 }
+// OBS-30 T2 / v1.86 T3: warn when a built-in seed prefer names an adapter with zero authed
+// channels and no operator-declared preference overrides that seed for the shape.
+export function seedPreferLints(cfg, health, adapters, overlayPreferShapes = new Set()) {
+    return collectSeedPreferLints(cfg, health, adapters, overlayPreferShapes, DECLARED_SEED_PREFER_DISPOSITION);
+}
 // v1.54 T3: dead-steering sweep — operator prefer entries (routing.map overlay shapes, review.prefer,
 // consult.prefer) that can never match an installed channel are named at plan time; v1.53 T2 pins the
 // no-match case as a silent no-op, which makes a typo invisible. Advisory only: reads config + doctor
-// health (no live probes), never touches routing. Seed map prefers stay seedPreferLints' turf (auto-prefer
-// routes around dead seeds) — mapShapes limits this sweep to operator-authored entries so a bare default
-// fleet isn't double-linted. Entry grammar mirrors preferIndex: adapter | adapter:model (first colon).
+// health (no live probes), never touches routing. Seed map prefers stay seedPreferLints' turf;
+// mapShapes limits this sweep to operator-authored entries so a bare default fleet isn't double-linted.
+// Entry grammar mirrors preferIndex: adapter | adapter:model (first colon).
 export function preferEntryLints(cfg, health, mapShapes = new Set()) {
     const lints = [];
     const sweep = (surface, entries) => {
@@ -122,17 +245,15 @@ export function preferEntryLints(cfg, health, mapShapes = new Set()) {
     sweep("consult.prefer", cfg.consult.prefer);
     return lints;
 }
-// Diffs detected models (doctor.json) against configured tiers, both directions, per adapter id in cfg.tiers.
+// Diffs detected models (doctor.json) against configured tiers, both directions, per installed adapter.
 // No `  ! ` prefix here — the consumer (doctor rows / plan lints) owns that. Pre-v1.5 doctor.json (models:[], no
 // modelsDetectedAt) is the compat baseline: `?.`/`?? []` everywhere, no zod (would reject old files).
 export function modelLints(cfg, health, adapters, opts) {
     const cap = opts?.tty ? TTY_LINT_CAP : LINT_CAP;
     const doctorRef = opts?.tty ? doctorJsonRef(opts.stateDir ?? DEFAULT_STATE_DIR) : "";
     const lints = [];
-    for (const id of Object.keys(cfg.tiers)) {
-        const adapter = adapters.find((a) => a.id === id);
-        if (!adapter)
-            continue; // fake/overlay-only tier entry with no adapter — nothing to diff against
+    for (const adapter of adapters) {
+        const id = adapter.id;
         if (!adapter.listModels) {
             lints.push(`${id}: no model-list surface — seeds stamped ${SEED_STAMPED}; verify manually`);
             continue;
@@ -144,7 +265,7 @@ export function modelLints(cfg, health, adapters, opts) {
                 lints.push(`${id}: no detection data — run tickmarkr doctor`);
             continue; // no data to diff or age
         }
-        const configured = Object.keys(cfg.tiers[id].models);
+        const configured = Object.keys(cfg.tiers[id]?.models ?? {});
         for (const model of configured) {
             if (!detected.includes(model)) {
                 lints.push(`${id}: tiers lists ${model} — CLI no longer reports it; tombstone it (${model}: null overlay) or verify the id`);
@@ -163,7 +284,13 @@ export function modelLints(cfg, health, adapters, opts) {
                 lints.push(`${id}: model knowledge is ${days} days old — rerun tickmarkr doctor`);
         }
     }
-    lints.push(...seedPreferLints(cfg, health, adapters, opts?.overlayPreferShapes));
+    // v1.34 T3 byte-pins non-TTY doctor output. Doctor consumers are the ones that provide stateDir;
+    // keep that machine-facing compatibility surface stable while plan and direct lint callers state
+    // the current declared-preference mechanism truthfully.
+    const seedDisposition = opts?.stateDir !== undefined && opts.tty !== true
+        ? LEGACY_DOCTOR_SEED_PREFER_DISPOSITION
+        : DECLARED_SEED_PREFER_DISPOSITION;
+    lints.push(...collectSeedPreferLints(cfg, health, adapters, opts?.overlayPreferShapes ?? new Set(), seedDisposition));
     return lints;
 }
 // T2/T6: one lint per exclusion, naming the probe reason and date. TTY truncates reasons to 60 chars and
@@ -183,17 +310,17 @@ export function formatModelAuthLine(excluded, tty, stateDir = DEFAULT_STATE_DIR)
 // machine never fabricates one — auto-tiering reopens the NaN-routing class). Removals render as LIVE
 // `<id>: null` tombstones (deepMerge deletes the key). Pure function: no fs, no routing contact.
 // Returns "" when no adapter has a delta. Mirrors modelLints' per-adapter guards exactly.
-export function suggestOverlay(cfg, health, adapters, stateDir = DEFAULT_STATE_DIR) {
+export function suggestOverlay(cfg, health, adapters, stateDir = DEFAULT_STATE_DIR, opts = {}) {
     const blocks = [];
-    for (const id of Object.keys(cfg.tiers)) {
-        const adapter = adapters.find((a) => a.id === id);
-        if (!adapter?.listModels)
-            continue; // no adapter / no list surface → nothing to diff (mirror modelLints)
+    for (const adapter of adapters) {
+        const id = adapter.id;
+        if (!adapter.listModels)
+            continue; // no list surface → nothing to diff (mirror modelLints)
         const h = health[id];
         const detected = h?.models ?? [];
         if (detected.length === 0)
             continue; // no detection data → don't guess a delta
-        const configured = Object.keys(cfg.tiers[id].models);
+        const configured = Object.keys(cfg.tiers[id]?.models ?? {});
         const date = h?.modelsDetectedAt?.split("T")[0]; // best-effort day stamp
         const detNote = date ? ` (detected ${date})` : "";
         const lines = [];
@@ -220,11 +347,17 @@ export function suggestOverlay(cfg, health, adapters, stateDir = DEFAULT_STATE_D
         for (const model of detected) {
             if (configured.includes(model) || !MODEL_ID_RE.test(model) || LINT_VARIANT_RE.test(model))
                 continue;
-            if (!cfgPrefixes.has(providerPrefix(model)) && !cfgCanon.has(canonical(model))) {
+            if (configured.length > 0 && !cfgPrefixes.has(providerPrefix(model)) && !cfgCanon.has(canonical(model))) {
                 omitted++;
                 continue;
             }
-            lines.push(`      # ${model}: ???   #${date ? ` detected ${date} —` : ""} classify per benchmark policy (AA Index + SWE-bench Pro, dated), then uncomment`);
+            const advisory = opts.catalog
+                ? catalogModelAdvisory(cfg, opts.catalog, id, model, opts.resolvedModel?.(id, model))
+                : undefined;
+            const guidance = advisory?.suggestion
+                ? `provenance note (operator confirmation required): ${advisory.suggestion.provenanceNote}; choose a tier, then uncomment`
+                : `classify per benchmark policy (AA Index + SWE-bench Pro, dated), then uncomment${advisory ? ` — ${advisory.display}` : ""}`;
+            lines.push(`      # ${model}: ???   #${date ? ` detected ${date} —` : ""} ${guidance}`);
         }
         if (omitted)
             lines.push(`      # (+${omitted} other detected id${omitted === 1 ? "" : "s"} not related to your configured models — see ${stateDir}/doctor.json)`);
@@ -258,14 +391,15 @@ function referenceWarning(cfg, adapterId, model) {
 /** Unclassified models surfaced for fleet screen 2 (doctor matrix math, no tier fabrication). */
 export function fleetUnclassifiedModels(cfg, health, adapters) {
     const out = [];
-    for (const id of Object.keys(cfg.tiers)) {
-        if (!adapters.some((a) => a.id === id))
-            continue;
+    for (const adapter of adapters) {
+        const id = adapter.id;
         const h = health[id];
+        if (!h?.installed)
+            continue;
         const detected = h?.models ?? [];
         if (!detected.length)
             continue;
-        const configured = new Set(Object.keys(cfg.tiers[id].models));
+        const configured = new Set(Object.keys(cfg.tiers[id]?.models ?? {}));
         const date = h?.modelsDetectedAt?.split("T")[0];
         for (const model of detected) {
             if (configured.has(model) || LINT_VARIANT_RE.test(model))

package/dist/adapters/model-windows.d.ts

@@ -0,0 +1,31 @@
+import { z } from "zod";
+declare const ModelWindowClaimSchema: z.ZodObject<{
+    modelId: z.ZodString;
+    window: z.ZodNumber;
+    source: z.ZodString;
+    readDate: z.ZodISODate;
+}, z.core.$strict>;
+export type ModelWindowClaim = Readonly<z.infer<typeof ModelWindowClaimSchema>>;
+export type ModelWindowResolution = {
+    status: "declared";
+    claim: ModelWindowClaim;
+} | {
+    status: "unknown";
+    modelId: string;
+};
+/**
+ * Validate cited model-window claims before production code can consume them.
+ * These values are vendor-published claims, not measurements made by tickmarkr.
+ */
+export declare function loadModelWindowClaims(input: unknown): readonly ModelWindowClaim[];
+/** The closed, production-readable catalog of cited context-window claims. */
+export declare const CITED_MODEL_WINDOWS: readonly Readonly<{
+    modelId: string;
+    window: number;
+    source: string;
+    readDate: string;
+}>[];
+export declare function resolveModelWindowClaim(modelId: string, input?: unknown): ModelWindowResolution;
+/** Fail when either side contains a model id absent from the other side. */
+export declare function assertModelWindowClaimsMatchSeededModels(seededModelIds: readonly string[], input?: unknown): void;
+export {};