tickmarkr 1.85.0 → 1.86.0

package/dist/gates/llm.js

@@ -69,29 +69,6 @@ export function extractPromptNonce(prompt) {
 export function gateExitTrailer(nonce) {
     return `printf '\\nTICKMARKR_''EXIT_${nonce}:%s\\n' $?`;
 }
-// v1.64: scripted fake judge verdicts predate the required per-criterion evidence field — quote the
-// first line of the prompt's own diff block into rows lacking one so zero-token fixtures keep their
-// outcomes. Rows scripting an explicit evidence value pass through verbatim (tests exercise both paths).
-function injectFakeEvidence(obj, prompt) {
-    if (!prompt.startsWith("TICKMARKR-JUDGE") || !Array.isArray(obj.criteria))
-        return obj;
-    const line = /```diff\n([\s\S]*?)```/.exec(prompt)?.[1].split("\n").find((l) => l.trim());
-    if (!line)
-        return obj;
-    const criteria = obj.criteria.map((row) => row && typeof row === "object" && !("evidence" in row) ? { ...row, evidence: line } : row);
-    return { ...obj, criteria };
-}
-// ponytail: fake adapter serves static verdict JSON without nonce; append a bound copy for zero-token tests.
-export function augmentFakeVerdictOutput(adapter, out, nonce, prompt = "") {
-    if (adapter.id !== "fake")
-        return out;
-    const obj = extractJson(out);
-    if (!obj || typeof obj !== "object" || obj.nonce === nonce)
-        return out;
-    if (typeof obj.nonce === "string")
-        return out;
-    return `${out}\n${JSON.stringify(injectFakeEvidence({ ...obj, nonce }, prompt))}`;
-}
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export function gatePaneName(role, taskId, suffix = "") {
     return `${role}${GATE_PANE_SEP}${taskId}${suffix}`;
@@ -130,11 +107,7 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
     const pf = join(mkdtempSync(join(tmpdir(), "tickmarkr-llm-")), "prompt.md");
     writeFileSync(pf, prompt);
     const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
-    const nonce = extractPromptNonce(prompt);
-    let out = r.stdout + "\n" + r.stderr;
-    if (nonce)
-        out = augmentFakeVerdictOutput(adapter, out, nonce, prompt);
-    return out;
+    return r.stdout + "\n" + r.stderr;
 }
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
 // as a visible named agent (herdr pane), with the quote-split completion wrapper.
@@ -157,10 +130,9 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
     // nonce-suffixed exit only: a displayed bare "TICKMARKR_EXIT:" or another call's marker must not
     // false-complete — same guard the worker path uses (daemon.ts:330-331).
     await via.driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, timeoutMs, { regex: true });
-    let out = await via.driver.read(slot, 400);
+    const out = await via.driver.read(slot, 400);
     if (!via.keep)
         await via.driver.close(slot);
-    out = augmentFakeVerdictOutput(adapter, out, nonce, prompt);
     return dewrapPaneVerdict(out, nonce);
 }
 // OBS-155: a TUI renders the verdict as a bullet and HARD-wraps it at pane width with a 2-space
@@ -179,6 +151,9 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
 export function dewrapPaneVerdict(out, nonce) {
     if (!out.includes(nonce))
         return out;
+    // Preserve already-readable responder bytes; only a genuinely wrapped verdict needs reconstruction.
+    if (extractVerdictJson(out, nonce))
+        return out;
     const lines = out.split("\n");
     // OBS-209: EVERY brace-start is a candidate, scanned newest-first. findIndex took only the first,
     // so any earlier line beginning with `{` — a quoted snippet, a lone brace in the reviewer's own

package/dist/gates/review.d.ts

@@ -3,6 +3,7 @@ import { type TickmarkrConfig } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
+import { type VerdictUnparseableCause } from "./verdict-cause.js";
 export type ReviewSeverity = "material" | "minor";
 export interface ReviewFinding {
     note: string;
@@ -44,5 +45,5 @@ export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
 prefer?: string[]): BillingChannel | null;
-export type ReviewUnparseableCause = "empty-output" | "no-verdict" | "malformed-verdict";
+export type ReviewUnparseableCause = VerdictUnparseableCause;
 export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string): Promise<GateResult>;

package/dist/gates/review.js

@@ -8,6 +8,7 @@ import { shOk } from "../run/git.js";
 import { redactSecrets } from "../run/redact.js";
 import { marginalCostRank } from "../route/router.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { classifyVerdictCause } from "./verdict-cause.js";
 // legacy flat `issues` shape — every issue blocks; the approve flag must agree with the list.
 function classifyReviewIssues(approve, issues) {
     const inconsistencies = [];
@@ -303,9 +304,9 @@ artifactDir) {
     // "a law caps complexity at 3, the gate starts at 7" unreachability OBS-186 measured.
     //
     // COLLATERAL this rescoped task closed: the run-gates/daemon participation assertions are rewritten
-    // path-keyed, the NamedFake review fixtures carry their own nonce trailer (llm.ts's injection is
-    // scoped to adapter id "fake" and a renamed fake is a different adapter to it — the check is not
-    // weakened, the fixture is fixed), the merge decision reads `gateSatisfied`, and the daemon writes a
+    // path-keyed, the NamedFake review fixtures author their own nonce-bound verdict (a renamed fake is
+    // a distinct responder and does not inherit the registered fake's producer contract — the check is
+    // not weakened, the fixture is fixed), the merge decision reads `gateSatisfied`, and the daemon writes a
     // parallel round's gate-result rows in GATE_NAMES order (src/run/daemon.ts).
     //
     // That last one is why: retiring the switch makes fixtures that used to SKIP review journal TWO
@@ -419,9 +420,7 @@ The top-level comments array is optional. Use it only for actionable line-anchor
     if (!v || (findings === null && (typeof v.approve !== "boolean" || !Array.isArray(v.issues)))) {
         // OBS-196: name the cause and persist the raw bytes — a ruled-on "unparseable" without its
         // evidence cannot be audited, and a cutoff must never be indistinguishable from a parse defect.
-        const cause = raw.trim().length === 0
-            ? "empty-output"
-            : !raw.includes(nonce) ? "no-verdict" : "malformed-verdict";
+        const cause = classifyVerdictCause(raw, nonce, "approve");
         let saved;
         if (artifactDir) {
             try {
@@ -432,10 +431,13 @@ The top-level comments array is optional. Use it only for actionable line-anchor
                 saved = undefined; // persistence is evidence, not a gate input — never fail the gate on it
             }
         }
+        const failure = cause === "malformed-verdict"
+            ? "review output unparseable"
+            : "review dispatch failed — no structurally valid nonce-bound response; output unparseable";
         return {
             gate: "review",
             pass: false,
-            details: `review output unparseable (reviewer ${reviewer.adapter}:${reviewer.model}; cause: ${cause}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
+            details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; cause: ${cause}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
             meta: { ...policyMeta, reviewer: channelKey(reviewer), unparseable: true, cause },
         };
     }

package/dist/gates/verdict-cause.d.ts

@@ -0,0 +1,4 @@
+export type VerdictDiscriminator = "approve" | "pass" | "ok" | "action";
+export type VerdictUnparseableCause = "empty-output" | "no-verdict" | "malformed-verdict";
+export declare function hasVerdictParticipationWitness(raw: string, nonce: string, discriminator: VerdictDiscriminator): boolean;
+export declare function classifyVerdictCause(raw: string, nonce: string, discriminator: VerdictDiscriminator): VerdictUnparseableCause;

package/dist/gates/verdict-cause.js

@@ -0,0 +1,63 @@
+const MAX_WITNESS_BYTES = 4096;
+const JSON_STRING_VALUE = String.raw `"(?:\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4})|[^"\\\u0000-\u001F])*"`;
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+// Pane renderers hard-wrap at physical columns and prefix continuation lines with whitespace or box
+// chrome. Joining those renderer lines is deliberately narrower than parsing: it restores split keys,
+// values and delimiters, but it does not require the response to be complete or valid JSON.
+function joinRendererLines(raw) {
+    return raw.replace(/\r\n?/g, "\n").split("\n")
+        .map((line) => line.replace(/^[\t │|]+/, "").replace(/[\t │|]+$/, ""))
+        .join("");
+}
+// Yield only the first structural prefix of each object candidate. Stopping at the next unquoted
+// opening brace prevents a nonce from one object binding a discriminator from another; the prompts
+// put their discriminator before any nested object, so no valid boundary shape is lost.
+function objectPrefixes(raw) {
+    const joined = joinRendererLines(raw);
+    const prefixes = [];
+    for (let open = joined.indexOf("{"); open !== -1; open = joined.indexOf("{", open + 1)) {
+        const ceiling = Math.min(joined.length, open + MAX_WITNESS_BYTES);
+        let end = ceiling;
+        let quoted = false;
+        let escaped = false;
+        for (let i = open + 1; i < ceiling; i++) {
+            const char = joined[i];
+            if (quoted) {
+                if (escaped)
+                    escaped = false;
+                else if (char === "\\")
+                    escaped = true;
+                else if (char === '"')
+                    quoted = false;
+                continue;
+            }
+            if (char === '"')
+                quoted = true;
+            else if (char === "{") {
+                end = i;
+                break;
+            }
+            else if (char === "}") {
+                end = i + 1;
+                break;
+            }
+        }
+        prefixes.push(joined.slice(open, end));
+    }
+    return prefixes;
+}
+export function hasVerdictParticipationWitness(raw, nonce, discriminator) {
+    const noncePattern = new RegExp(String.raw `"nonce"\s*:\s*${escapeRegex(JSON.stringify(nonce))}\s*[,]`);
+    const valuePattern = discriminator === "action" ? JSON_STRING_VALUE : "(?:true|false)";
+    const discriminatorPattern = new RegExp(String.raw `"${discriminator}"\s*:\s*${valuePattern}\s*[,}]`);
+    return objectPrefixes(raw).some((prefix) => noncePattern.test(prefix) && discriminatorPattern.test(prefix));
+}
+export function classifyVerdictCause(raw, nonce, discriminator) {
+    if (raw.trim().length === 0)
+        return "empty-output";
+    return hasVerdictParticipationWitness(raw, nonce, discriminator)
+        ? "malformed-verdict"
+        : "no-verdict";
+}

package/dist/graph/schema.d.ts

@@ -12,9 +12,11 @@ export type Oracle = (typeof ORACLES)[number];
 export declare const AcceptanceItemSchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
     oracle: z.ZodLiteral<"command">;
     command: z.ZodString;
+    text: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     oracle: z.ZodLiteral<"test">;
     test: z.ZodString;
+    text: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     oracle: z.ZodLiteral<"judge">;
     text: z.ZodString;
@@ -43,9 +45,11 @@ export declare const TaskSchema: z.ZodObject<{
     acceptance: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
         oracle: z.ZodLiteral<"command">;
         command: z.ZodString;
+        text: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
         oracle: z.ZodLiteral<"test">;
         test: z.ZodString;
+        text: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
         oracle: z.ZodLiteral<"judge">;
         text: z.ZodString;
@@ -133,9 +137,11 @@ export declare const RunGraphSchema: z.ZodObject<{
         acceptance: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
             oracle: z.ZodLiteral<"command">;
             command: z.ZodString;
+            text: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>, z.ZodObject<{
             oracle: z.ZodLiteral<"test">;
             test: z.ZodString;
+            text: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>, z.ZodObject<{
             oracle: z.ZodLiteral<"judge">;
             text: z.ZodString;

package/dist/graph/schema.js

@@ -11,11 +11,14 @@ export const TIERS = ["cheap", "mid", "frontier"];
 // A plain string is the read-old/write-new compat form — semantically a judge oracle (spec §2).
 export const ORACLES = ["command", "test", "judge"];
 // Typed acceptance oracle: command carries the thing to run, test the test name, judge free text.
-// Anything else (a typed object naming an unknown oracle) fails validation loudly here.
+// text is OPTIONAL non-empty on command/test (declared prose beside the oracle; judge requires it).
+// Declaring it matters: z.object strips unknown keys, and loadGraph revalidates on every read —
+// an undeclared text would be silently discarded at the next load. Anything else (a typed object
+// naming an unknown oracle, or a text that is not a non-empty string) fails validation loudly here.
 export const AcceptanceItemSchema = z.union([
     z.string().min(1),
-    z.object({ oracle: z.literal("command"), command: z.string().min(1) }),
-    z.object({ oracle: z.literal("test"), test: z.string().min(1) }),
+    z.object({ oracle: z.literal("command"), command: z.string().min(1), text: z.string().min(1).optional() }),
+    z.object({ oracle: z.literal("test"), test: z.string().min(1), text: z.string().min(1).optional() }),
     z.object({ oracle: z.literal("judge"), text: z.string().min(1) }),
 ]);
 // Shared text rendering of one acceptance item — every consumer (worker prompt, acceptance gate,
@@ -24,9 +27,9 @@ export function renderAcceptanceItem(item) {
     if (typeof item === "string")
         return item;
     if (item.oracle === "command")
-        return `$ ${item.command}`;
+        return item.text ?? `$ ${item.command}`;
     if (item.oracle === "test")
-        return `test: ${item.test}`;
+        return item.text ?? `test: ${item.test}`;
     return item.text; // judge — bare text, byte-identical to a plain-string judge criterion
 }
 export const TaskSchema = z.object({

package/dist/route/router.d.ts

@@ -19,11 +19,6 @@ export interface Route {
     deviation?: RouteDeviation;
 }
 export interface RoutingPreferContext {
-    autoPrefer?: {
-        derivedAt: string;
-        [shape: string]: string[] | string;
-    };
-    doctorFresh: boolean;
     overlayPreferShapes: ReadonlySet<string>;
 }
 export interface ExploreContext {

package/dist/route/router.js

@@ -28,19 +28,9 @@ const exploreOff = (task, cfg, exploreCtx) => {
         return true;
     return false;
 };
-const autoPreferList = (doc, shape) => {
-    const v = doc?.[shape];
-    return Array.isArray(v) ? v : undefined;
-};
-const preferFromAuto = (shape, preferCtx) => !!preferCtx?.doctorFresh && !!preferCtx.autoPrefer && !preferCtx.overlayPreferShapes.has(shape) &&
-    autoPreferList(preferCtx.autoPrefer, shape) !== undefined;
-const effectivePrefer = (shape, entry, preferCtx) => {
-    if (preferCtx?.overlayPreferShapes.has(shape))
-        return entry?.prefer;
-    if (preferCtx?.doctorFresh && preferCtx.autoPrefer)
-        return autoPreferList(preferCtx.autoPrefer, shape) ?? entry?.prefer;
-    return entry?.prefer;
-};
+// v1.86 T3: autoPrefer is deleted — prefer is operator-declared only. Nothing is ever derived
+// from probe health, tier data, or a machine-built shape table.
+const effectivePrefer = (entry) => entry?.prefer;
 export class RoutingError extends Error {
     constructor(msg) {
         super(msg);
@@ -134,7 +124,7 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
     // ponytail: sla is plan-time advisory only — never thread into learnedScore (would reroute warm rivals).
     const scoreOpts = { availWeight: cfg.routing.learnedTuning?.availWeight };
     const entry = cfg.routing.map[task.shape];
-    const prefer = effectivePrefer(task.shape, entry, preferCtx);
+    const prefer = effectivePrefer(entry);
     const prefActive = !!(cfg.routing.allow || cfg.routing.deny);
     const disallowedPin = (via, model, kind) => {
         const d = disallowedBy({ adapter: via, model }, cfg.routing);
@@ -167,6 +157,14 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
         }
     };
     const taskFloor = task.routingHints?.floor;
+    const mapPinFloor = taskFloor && (!advisoryFloor || TIER_RANK[taskFloor] >= TIER_RANK[advisoryFloor])
+        ? { tier: taskFloor, source: "task" }
+        : advisoryFloor ? { tier: advisoryFloor, source: "config" } : undefined;
+    const lintMapPinFloor = (tier) => {
+        if (mapPinFloor && TIER_RANK[tier] < TIER_RANK[mapPinFloor.tier]) {
+            lints.push(`${task.id} (${task.shape}): map pin routes ${tier}, below ${mapPinFloor.source} floor ${mapPinFloor.tier} — map pins are supreme`);
+        }
+    };
     const source = task.routingHints?.source;
     const src = source ? `, ${source}` : ""; // never interpolate a possibly-undefined source
     // task pin: planner-authored, try-first — degrades on miss or below-floor (D-05, research A3), never throws
@@ -188,12 +186,13 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
     if (entry?.pin) {
         disallowedPin(entry.pin.via, entry.pin.model, "map pin (config routing.map)");
         const c = resolvePin(entry.pin, channels);
-        lintFloor(c.tier, "map pin");
+        lintMapPinFloor(c.tier);
         maybeSlaLint(lints, task, profile, slaMinutes, c);
         return { assignment: toAssignment(c), ladder: ladderFor(task, entry), lints, provenance: `${degraded}pin ${entry.pin.via}:${entry.pin.model} (config routing.map)` };
     }
     const baseTier = floor ?? "cheap";
-    const minTier = taskFloor && TIER_RANK[taskFloor] > TIER_RANK[baseTier] ? taskFloor : baseTier; // task floor is a hard >= constraint in all paths (D-04)
+    // D-04: a task floor is hard only on floor/auto paths; the map-pin branch above stays supreme.
+    const minTier = taskFloor && TIER_RANK[taskFloor] > TIER_RANK[baseTier] ? taskFloor : baseTier;
     if (prefActive)
         for (const p of prefer ?? [])
             preflightPrefer(p);
@@ -293,13 +292,10 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
             "tier cheap (default)";
     // name the key that actually broke the tie: prefer outranks the marginal-cost/tier keys, so if the
     // winner matched a prefer entry, prefer decided it — not "cheapest sufficient tier" (ROUTE-03, WR-01)
-    const preferVia = preferFromAuto(task.shape, preferCtx)
-        ? `via prefer (auto-modernized ${preferCtx.autoPrefer.derivedAt.slice(0, 10)})`
-        : "via prefer";
     // a spread-decided winner is never inside a prefer band (the spread skips those runs), so the
     // three arms below are mutually exclusive by construction
     const chosenBy = learnedChosen || (spreadDecided ? "via frontier spread"
-        : prefer && preferIndex(eligible[0], prefer) < prefer.length ? preferVia : "cheapest sufficient tier");
+        : prefer && preferIndex(eligible[0], prefer) < prefer.length ? "via prefer" : "cheapest sufficient tier");
     maybeSlaLint(lints, task, profile, slaMinutes, eligible[0]);
     return { assignment: toAssignment(eligible[0]), ladder: ladderFor(task, entry), lints, provenance: `${degraded}${bound}, marginal-cost auto (${chosenBy})`, ...(deviation ? { deviation } : {}) };
 }

package/dist/run/consult.d.ts

@@ -2,6 +2,7 @@ import type { WorkerAdapter } from "../adapters/types.js";
 import type { TickmarkrConfig } from "../config/config.js";
 import type { ExecutorDriver, Slot } from "../drivers/types.js";
 import type { GateResult } from "../gates/types.js";
+import { type VerdictUnparseableCause } from "../gates/verdict-cause.js";
 export interface ConsultVerdict {
     action: "retry" | "reroute" | "decompose" | "human";
     notes: string;
@@ -23,6 +24,11 @@ export interface Dossier {
     diff: string;
     gates: GateResult[];
 }
+export interface ConsultParseResult {
+    verdict: ConsultVerdict | null;
+    cause?: VerdictUnparseableCause;
+}
+export declare function parseConsultVerdict(out: string, nonce: string): ConsultParseResult;
 export declare function buildDossierPrompt(d: Dossier, nonce: string): string;
 export declare function consult(d: Dossier, cfg: TickmarkrConfig, adapters: WorkerAdapter[], driver: ExecutorDriver, cwd: string, runDir: string, opts?: {
     keep?: boolean;

package/dist/run/consult.js

@@ -2,7 +2,8 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getAdapter } from "../adapters/registry.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
-import { augmentFakeVerdictOutput, extractVerdictJson, gateExitTrailer, gatePaneName, generateVerdictNonce, verdictNonceLine } from "../gates/llm.js";
+import { extractVerdictJson, gateExitTrailer, gatePaneName, generateVerdictNonce, verdictNonceLine } from "../gates/llm.js";
+import { classifyVerdictCause } from "../gates/verdict-cause.js";
 import { sh } from "./git.js";
 import { redactSecrets } from "./redact.js";
 import { filterLlmTranscript } from "./stall.js";
@@ -57,6 +58,33 @@ export function augmentRetryBrief(feedback, opts) {
     return parts.join("\n\n");
 }
 const ACTIONS = ["retry", "reroute", "decompose", "human"];
+export function parseConsultVerdict(out, nonce) {
+    const v = extractVerdictJson(out, nonce);
+    if (!v)
+        return { verdict: null, cause: classifyVerdictCause(out, nonce, "action") };
+    // A parsed object with an unknown action is a content rejection, not silence. It keeps the existing
+    // null result without manufacturing a classifier cause for a state the classifier never saw.
+    if (!ACTIONS.includes(v.action))
+        return { verdict: null };
+    // fail-closed exclusion: only a non-empty string survives. Malformed values (number/array/object/
+    // empty) are dropped — the verdict stays a normal channel-level reroute/retry/…, never a crash
+    // and never silently forced to human. Unknown adapter ids pass through; the daemon treats a
+    // zero-match expansion as channel-level reroute.
+    const raw = v.excludeAdapter;
+    const excludeAdapter = typeof raw === "string" && raw.length > 0 ? raw : undefined;
+    const reason = typeof v.reason === "string" ? v.reason : undefined;
+    const guidance = typeof v.guidance === "string" ? v.guidance : undefined;
+    const notes = String(v.notes ?? guidance ?? reason ?? "");
+    return {
+        verdict: {
+            action: v.action,
+            notes,
+            ...(reason ? { reason } : {}),
+            ...(guidance ? { guidance } : {}),
+            ...(excludeAdapter ? { excludeAdapter } : {}),
+        },
+    };
+}
 // v1.65 T2: transcript noise (spinner repaints, CR churn, pass-run spam) is squashed at build time —
 // the filtered form is what persists to the consults/ artifact AND what the model reads; fail-open.
 export function buildDossierPrompt(d, nonce) {
@@ -108,7 +136,8 @@ opts = {}) {
     // consult model reads) is masked at this seam; the in-memory Dossier stays untouched.
     writeFileSync(promptFile, redactSecrets(buildDossierPrompt(d, nonce)));
     // One seat = the WHOLE invoke-and-parse unit, both visibility branches (OBS-69 class: a headless-only
-    // failover would leave the production pane path hard-failing on seat one). null = no parseable verdict.
+    // failover would leave the production pane path hard-failing on seat one). A null verdict retains
+    // the classifier's cause when extraction failed; parsed content rejections deliberately have none.
     const invokeSeat = async (seatAdapter, seatModel, seatIdx) => {
         const adapter = getAdapter(seatAdapter, adapters);
         let out;
@@ -143,26 +172,7 @@ opts = {}) {
                     await driver.close(slot);
             }
         }
-        out = augmentFakeVerdictOutput(adapter, out, nonce);
-        const v = extractVerdictJson(out, nonce);
-        if (!v || !ACTIONS.includes(v.action))
-            return null;
-        // fail-closed exclusion: only a non-empty string survives. Malformed values (number/array/object/
-        // empty) are dropped — the verdict stays a normal channel-level reroute/retry/…, never a crash
-        // and never silently forced to human. Unknown adapter ids pass through; the daemon treats a
-        // zero-match expansion as channel-level reroute.
-        const raw = v.excludeAdapter;
-        const excludeAdapter = typeof raw === "string" && raw.length > 0 ? raw : undefined;
-        const reason = typeof v.reason === "string" ? v.reason : undefined;
-        const guidance = typeof v.guidance === "string" ? v.guidance : undefined;
-        const notes = String(v.notes ?? guidance ?? reason ?? "");
-        return {
-            action: v.action,
-            notes,
-            ...(reason ? { reason } : {}),
-            ...(guidance ? { guidance } : {}),
-            ...(excludeAdapter ? { excludeAdapter } : {}),
-        };
+        return parseConsultVerdict(out, nonce);
     };
     // v1.54 T1: ranked seat failover. Walk consult.prefer (adapter:model entries) to the first entry
     // whose adapter is in the live channel set; a failed seat or unparseable verdict falls to the next;
@@ -176,9 +186,9 @@ opts = {}) {
     seats.push({ adapter: cfg.consult.adapter, model: cfg.consult.model });
     for (const [i, seat] of seats.entries()) {
         try {
-            const v = await invokeSeat(seat.adapter, seat.model, i);
-            if (v)
-                return v;
+            const parsed = await invokeSeat(seat.adapter, seat.model, i);
+            if (parsed.verdict)
+                return parsed.verdict;
         }
         catch {
             // failed seat (unknown adapter, dead driver/pane, shell error) — fall to the next entry

package/dist/run/daemon.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
 import { shq } from "../adapters/types.js";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { stringify } from "yaml";
@@ -631,6 +631,71 @@ async function cherryPickCommits(wt, commits) {
     }
     return carried;
 }
+// T7 (v1.86): a first run-end append that fails AFTER partial bytes landed leaves a torn tail at
+// EOF with no newline; a blind retry would glue the run-end line onto those bytes and readJsonl's
+// torn-line tolerance would drop the retry too — no terminal record despite a successful write.
+// Terminating the torn fragment keeps it on disk (dropped as a malformed line, never truncated) so
+// the retried run-end lands on a line of its own.
+const terminateTornJournalTail = (journalPath) => {
+    if (!existsSync(journalPath))
+        return;
+    const size = statSync(journalPath).size;
+    if (size === 0)
+        return;
+    const fd = openSync(journalPath, "r");
+    try {
+        const tail = Buffer.alloc(1);
+        if (readSync(fd, tail, 0, 1, size - 1) === 1 && tail[0] !== 0x0a)
+            appendFileSync(journalPath, "\n");
+    }
+    finally {
+        closeSync(fd);
+    }
+};
+// T7 (v1.86): the fatal handler must never eat the error it reports. Both journal calls are guarded,
+// so a sink failure is reported ALONGSIDE the original error (console.error — the dispatcher's
+// operator-visible line stays the one-line form), never instead of it: a read failure degrades the
+// duplicate-run-end check to "unknown" and fails toward recording; the append is retried ONCE; and
+// a persistently unwritable sink reports a crash naming the journal path and carrying NO terminal
+// record, rather than fabricating an ended run on evidence the harness could not write. (OBS-313:
+// with the sink dead the crash CAUSE is unrecordable — recorded as an observation, not papered over.)
+function recordFatalRunEnd(journal, runId, branch, err) {
+    const original = err instanceof Error ? err.message : String(err);
+    try {
+        if (journal.read().some((e) => e.event === "run-end"))
+            return; // already terminal — nothing to add
+    }
+    catch (readErr) {
+        console.error(`tickmarkr ${runId}: journal read failed while recording the fatal run-end (${readErr instanceof Error ? readErr.message : String(readErr)}) — original error: ${original}`);
+    }
+    const record = {
+        runId,
+        branch,
+        done: [],
+        failed: [],
+        human: [],
+        blocked: [],
+        pending: [],
+        phase: "setup",
+        fatal: true,
+        error: original,
+    };
+    try {
+        journal.append("run-end", undefined, record);
+        return;
+    }
+    catch {
+        // one retry below — the first failure is reported only if the retry also fails
+    }
+    const journalPath = join(journal.dir, "journal.jsonl");
+    try {
+        terminateTornJournalTail(journalPath);
+        journal.append("run-end", undefined, record);
+    }
+    catch (retryErr) {
+        console.error(`tickmarkr ${runId}: run crashed — no terminal record written; journal sink unwritable at ${journalPath} (${retryErr instanceof Error ? retryErr.message : String(retryErr)}) — original error: ${original}`);
+    }
+}
 export async function runDaemon(repoRoot, opts = {}) {
     // v1.51 T2 / OBS-89 (v1.60): retired --quality env seam. Mode resolution owns premium routing;
     // route() no longer reads the retired env at all, so the old entrypoint scrub is gone with it.
@@ -2719,20 +2784,11 @@ export async function runDaemon(repoRoot, opts = {}) {
         return summary;
     }
     catch (err) {
-        if (runStarted && !taskLoopStarted && !journal.read().some((e) => e.event === "run-end")) {
-            journal.append("run-end", undefined, {
-                runId,
-                branch,
-                done: [],
-                failed: [],
-                human: [],
-                blocked: [],
-                pending: [],
-                phase: "setup",
-                fatal: true,
-                error: err instanceof Error ? err.message : String(err),
-            });
-        }
+        // T7 (v1.86): guarded — a journal read/append failure while recording the fatal run-end is
+        // reported alongside err, never instead of it; recordFatalRunEnd never throws, so the original
+        // error (message, stack, cause) always reaches the caller verbatim.
+        if (runStarted && !taskLoopStarted)
+            recordFatalRunEnd(journal, runId, branch, err);
         throw err;
     }
     finally {