tickmarkr 1.85.0 → 1.87.0

package/dist/cli/commands/status.js

@@ -9,6 +9,7 @@ import { foldActivity } from "../../run/activity.js";
 import { Journal, engagementComparable, isQualityFailureParkKind, recordedTaskFailureKind, runHasEnded, } from "../../run/journal.js";
 import { normalizeStallSnapshot } from "../../run/stall.js";
 import { deriveRunCockpitData, } from "../../tui/cockpit/derive.js";
+import { cellWidth, fitCells } from "../../tui/cockpit/width.js";
 // ponytail: fixed 2s refresh; promote to config.visibility.* only when an operator asks.
 const REFRESH_MS = 2000;
 const NOT_COMPARABLE_NOTICE = "graph recompiled since this run — task states not comparable; resume with `--graph-changed` to audit this recompile";
@@ -132,6 +133,20 @@ const optionValue = (argv, name) => {
     const value = index >= 0 ? argv[index + 1] : undefined;
     return value && !value.startsWith("-") ? value : undefined;
 };
+// The one positional this command takes: an explicit run id. Everything else is a flag or a flag's
+// value (`--webhook <url>`), so the first bare token that is not a --webhook value is the run id.
+const positionalRunId = (argv) => {
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "--webhook") {
+            i += 1;
+            continue;
+        }
+        if (!arg.startsWith("-"))
+            return arg;
+    }
+    return undefined;
+};
 const defaultPostWebhook = (url, event) => fetch(url, {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -307,13 +322,18 @@ const failedSuffix = (states) => {
 // cell when present: a post-approval park is not awaiting the designed gate. Plain text for column
 // math; rendered with a dim dot + warn words. TTY-only — the non-TTY surface stays byte-pinned.
 export const humanGateSuffix = (t, st, states) => st === "human" && t.humanGate && failedGates(states).length === 0 ? " · awaiting approval" : "";
+// Task titles are graph-authored data. Remove terminal controls and row-breaking whitespace before
+// either width measurement or rendering so zero-cell ECMA-48 bytes cannot escape the task column.
+const ECMA_48_CONTROL = /(?:\u001B\][\s\S]*?(?:\u0007|\u001B\\)|\u009D[\s\S]*?(?:\u0007|\u009C)|\u001B[P^_X][\s\S]*?\u001B\\|[\u0090\u0098\u009E\u009F][\s\S]*?\u009C|(?:\u001B\[|\u009B)[0-?]*[ -/]*[@-~]|\u001B[@-_])/gu;
+const sanitizeTaskText = (text) => text.replace(ECMA_48_CONTROL, "").replace(/\p{Cc}/gu, " ").replace(/\s+/gu, " ").trim();
 export const shortGoal = (goal, max) => {
-    const clause = goal.split(/[,;.?!]/, 1)[0].trim();
-    if (clause.length <= max)
+    const clause = sanitizeTaskText(goal).split(/[,;.?!]/, 1)[0].trim();
+    const cells = Math.max(0, Math.floor(max));
+    if (cellWidth(clause) <= cells)
         return clause;
-    if (max <= 3)
-        return clause.slice(0, Math.max(0, max));
-    return `${clause.slice(0, max - 3).trimEnd()}...`;
+    if (cells <= 3)
+        return fitCells(clause, cells).trimEnd();
+    return `${fitCells(clause, cells - 3).trimEnd()}...`;
 };
 // VIS-11 (v1.13): a liveness header for renderFrame — last journal event age + whether the recorded
 // daemon pid is still alive. Honest about unknowns: a pre-v1.13 journal with no pid renders "unknown",
@@ -487,9 +507,11 @@ const parseJournalSnapshot = (raw) => raw.split("\n").flatMap((line) => {
         return [];
     }
 });
-const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness = new Map(), journalRowsOnly = false) => {
+const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness = new Map(), journalRowsOnly = false, namedRunId) => {
     const g = loadGraph(cwd);
-    const runId = Journal.latestRunId(cwd, { withJournal: true });
+    // An explicit <runId> is a resolution, not a hint: Journal.open below refuses an id without a
+    // readable journal, so status fails loudly naming that id instead of rendering any other run.
+    const runId = namedRunId ?? Journal.latestRunId(cwd, { withJournal: true });
     const assignments = new Map();
     let replayed = null;
     let cockpit;
@@ -619,7 +641,7 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
             const chain = gateChain(states, false);
             const prefix = livePhase ? `  ${ASCII_SPINNER[animationFrame % ASCII_SPINNER.length]} ${t.id} ` : `  ${surfaceTaskBox(st, merged)} ${t.id} `;
             const suffix = `  ${chain}${priorGraph ? ` ${PRIOR_GRAPH_MARKER}` : ""}  ${livePhase ? "running" : surfaceStatusWord(st)}${label}  ${assignCol}`;
-            return `${prefix}${shortGoal(t.goal, Math.max(0, width - prefix.length - suffix.length))}${suffix}`;
+            return `${prefix}${shortGoal(t.title, Math.max(0, width - prefix.length - suffix.length))}${suffix}`;
         });
         const zone = journalRowsOnly ? `${divider}zone ${localZoneLabel(zoneReference)}` : "";
         const header = runId
@@ -668,9 +690,9 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     const nowLine = activity.now ? [legend(`   now: ${activity.now}`)] : [];
     const gatesLegend = legend(`   gates: ${GATE_NAMES.join(" · ")}`);
     // Two-line card per task (operator request, v1.67): line 1 carries identity + verdict — glyph,
-    // id, goal at full width, and only SHORT status words. Line 2 carries the machinery, dim and
-    // aligned under the goal: gate chain, live activity phrase (or channel), ctx. Long channel names
-    // and activity phrases live on line 2 only, so they can never squeeze the goal or wrap line 1.
+    // id, title at full width, and only SHORT status words. Line 2 carries the machinery, dim and
+    // aligned under the title: gate chain, live activity phrase (or channel), ctx. Long channel names
+    // and activity phrases live on line 2 only, so they can never squeeze the title or wrap line 1.
     const taskVerdict = (c) => c.merged ? "pass" : c.redTier ? "fail" : c.st === "failed" || c.st === "human" ? "warn" : "neutral";
     const statusWord = (c) => c.livePhase ? "running" : c.redTier ? "failed" : c.st === "failed" ? "warn" : surfaceStatusWord(c.st);
     const idW = Math.max(...cells.map((c) => c.t.id.length), 2);
@@ -679,9 +701,9 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
         + humanGateSuffix(c.t, graphTaskStatus(c.st, c.t.status), c.states);
     const stW = Math.max(...cells.map((c) => statusWord(c).length + suffixPlain(c).length));
     const avail = Math.max(8, width - (5 + idW) - 2 - stW);
-    const goals = cells.map((c) => shortGoal(c.t.goal, avail));
-    const goalW = Math.max(8, ...goals.map((s) => s.length));
-    const indent = " ".repeat(idW + 5); // line 2 starts under the goal column
+    const titles = cells.map((c) => shortGoal(c.t.title, avail));
+    const titleW = Math.max(8, ...titles.map(cellWidth));
+    const indent = " ".repeat(idW + 5); // line 2 starts under the title column
     const rows = cells.map((c, i) => {
         const { t, st, merged, failureKind, redTier, states, priorGraph, isStarved, phrase, channel, ctx, livePhase } = c;
         const word = statusWord(c);
@@ -695,7 +717,8 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
             (isStarved ? dot + fail("starved") : "") +
             (f.length ? dot + fail(f.join(", ")) : "") +
             (human ? dot + warn("awaiting approval") : "");
-        const taskLabel = `${t.id.padEnd(idW)} ${goals[i].padEnd(goalW)}  ${statusCell}`;
+        const taskTitle = titles[i];
+        const taskLabel = `${t.id.padEnd(idW)} ${taskTitle}${" ".repeat(titleW - cellWidth(taskTitle))}  ${statusCell}`;
         const line1 = livePhase
             ? `  ${(staleWorker ? warn : dim)(SPINNER[animationFrame % SPINNER.length])} ${taskLabel}`
             : `  ${statusRow(taskVerdict(c), taskLabel)}`;
@@ -718,9 +741,10 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     };
 };
 export async function status(argv, cwd = process.cwd(), opts = {}) {
+    const namedRunId = positionalRunId(argv);
     // cockpit surface: banner + frame on a TTY (doctor's pattern); pipes get the bare frame
     if (!argv.includes("--watch")) {
-        const { content } = renderFrame(cwd, opts.now?.() ?? Date.now());
+        const { content } = renderFrame(cwd, opts.now?.() ?? Date.now(), 0, undefined, false, namedRunId);
         return visual() ? BANNER + content : content;
     }
     const eventStream = argv.some((arg) => arg === "--events" || arg === "--jsonl" || arg === "--decision-events");
@@ -782,7 +806,9 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
     let decisionRunId;
     let journalCursor = 0;
     const consumeDecisionEvents = () => {
-        const runId = Journal.latestRunId(cwd, { withJournal: true });
+        // A named run is followed, never re-resolved: --watch <runId> keeps reporting that run even as
+        // newer runs start. Only the no-argument form tracks latest, as before.
+        const runId = namedRunId ?? Journal.latestRunId(cwd, { withJournal: true });
         if (!runId)
             return [];
         if (decisionRunId !== runId) {
@@ -839,7 +865,7 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
                 }
             }
             else {
-                frame = renderFrame(cwd, nowMs, i, workerLiveness, true);
+                frame = renderFrame(cwd, nowMs, i, workerLiveness, true, namedRunId);
                 if (tty) {
                     updateTitle(frame.hotPhase, nowMs);
                     process.stdout.write(`\x1b[2J\x1b[H${BANNER}${frame.content}\n${legend(` watching · refresh ${REFRESH_MS / 1000}s · ^C to quit`)}`);

package/dist/compile/gsd.d.ts

@@ -1,3 +1,4 @@
-import { type RunGraph } from "../graph/schema.js";
+import { type AcceptanceItem, type RunGraph } from "../graph/schema.js";
 export declare function isGsdPhaseDir(dir: string): boolean;
+export declare function parseTruths(file: string, raw: unknown): AcceptanceItem[] | undefined;
 export declare function compileGsd(src: string, root?: string): RunGraph;

package/dist/compile/gsd.js

@@ -1,7 +1,7 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative } from "node:path";
 import { parse as parseYaml } from "yaml";
-import { TIERS, validateGraph } from "../graph/schema.js";
+import { AcceptanceItemSchema, TIERS, validateGraph } from "../graph/schema.js";
 import { CompileError, assertWriteScope, inferShape, sha256 } from "./common.js";
 // GSD artifact front-end (spec v1.3): one GSD *plan* is one tickmarkr *task* — a plan is
 // worktree-sized; its inner <task> steps stay in the worker prompt via context[0] = the plan file.
@@ -16,6 +16,72 @@ export function isGsdPhaseDir(dir) {
     }
 }
 const strings = (v) => (Array.isArray(v) ? v.map(String) : []);
+// Cycle-safe by construction: a recursive YAML alias (`&a [*a]`) is a legal value the parser hands
+// back as a circular object, and a bare JSON.stringify throws a native TypeError on it — which would
+// REPLACE the indexed CompileError this module owes the author with an unrelated crash. Every value
+// the YAML parser can produce renders here. (A repeated non-recursive alias also renders [circular];
+// this is a diagnostic string, not a round-trippable encoding.)
+const show = (v) => {
+    const seen = new WeakSet();
+    const cycleSafe = (_k, x) => {
+        if (typeof x !== "object" || x === null)
+            return x;
+        if (seen.has(x))
+            return "[circular]";
+        seen.add(x);
+        return x;
+    };
+    return JSON.stringify(v, cycleSafe) ?? String(v);
+};
+// A truth IS an acceptance item, not a string to coerce. strings()' `.map(String)` turned a typed
+// object truth into the literal "[object Object]" — schema-legal in the judge-compat string form, so
+// it passed validateGraph, reached the worker prompt verbatim and became a judge rubric item; a YAML
+// scalar `- 2.0` silently became "2". Nothing downstream catches either. So fail closed (house
+// precedent: the routing block in compileOne) on anything that is not text and not a typed oracle.
+// The CONTAINER is reported, not collapsed: an absent key returns undefined (nothing was declared) and
+// a present-but-empty list returns [] (declared, contributed nothing) — strings() flattened both, plus
+// a non-list, into the same silent []. Only the non-list fails closed; `truths: []` is real producer
+// output whose plan can still be carried by its <done> lines, and compileOne already rejects a task
+// whose acceptance ends up genuinely empty.
+// Parser liberal, template strict: a string truth stays exactly what strings() made of it — the GSD
+// planner template teaches prose-only and lives in another repo, so this parser must never be
+// stricter than the thing that produced its input. A non-string must satisfy AcceptanceItemSchema
+// EXACTLY — accepted with nothing dropped — which is where the dual-key `text:` beside
+// `command:`/`test:` is DECLARED (schema.ts:25-30); being declared is what makes it survive
+// loadGraph's revalidation, so nothing is ever reattached after.
+export function parseTruths(file, raw) {
+    if (raw === undefined)
+        return undefined; // key absent: nothing was declared
+    if (!Array.isArray(raw)) {
+        throw new CompileError(`${file} has a must_haves.truths that is not a list (got ${show(raw)}).\n` +
+            `  remedy: write each truth as a "- " list entry, or drop the key.`);
+    }
+    return raw.map((v, i) => {
+        if (typeof v === "string")
+            return v;
+        const parsed = AcceptanceItemSchema.safeParse(v);
+        if (!parsed.success) {
+            throw new CompileError(`${file} has a must_haves.truths[${i}] that is neither prose nor a typed acceptance oracle: ${show(v)}\n` +
+                `  remedy: write it as plain text, or as {oracle: command, command: <shell>} / {oracle: test, test: <name>} /\n` +
+                `  {oracle: judge, text: <rubric>} — command and test may carry a "text:" beside the oracle.`);
+        }
+        // A SUCCESSFUL parse is lossy too: z.object strips undeclared keys, so {oracle, command, text,
+        // severity} validates and compiles with `severity` gone — the same silent coercion in the other
+        // direction, and invisible because nothing downstream ever saw the key. Accepting less than the
+        // author supplied is not acceptance, so fail closed on whatever validation dropped.
+        // Object.hasOwn, never `k in`: the YAML parser hands back `constructor`, `toString`,
+        // `hasOwnProperty` and `__proto__` as OWN keys, but `in` finds all four on Object.prototype of the
+        // validated output, so each read as "kept" and was stripped in silence — the exact coercion this
+        // check exists to stop.
+        const dropped = Object.keys(v).filter((k) => !Object.hasOwn(parsed.data, k));
+        if (dropped.length) {
+            throw new CompileError(`${file} has a must_haves.truths[${i}] carrying key(s) no acceptance oracle declares: ${dropped.join(", ")}\n` +
+                `  remedy: drop ${dropped.length === 1 ? "that key" : "those keys"}, or fold the intent into "text:" — a\n` +
+                `  compile that kept ${dropped.length === 1 ? "it" : "them"} would discard ${dropped.length === 1 ? "it" : "them"} at the next graph load, unread.`);
+        }
+        return parsed.data;
+    });
+}
 const WRITE_DIRECTIVE = /\b(?:Create|Write|Add|Emit|Generate)\s+`([^`\s]+)`/gi;
 const isPathish = (s) => /^[\w./*-]+$/.test(s) && /\.[a-z]{2,4}$/i.test(s);
 const stripFences = (s) => s.replace(/^```[\s\S]*?^```/gm, "");
@@ -89,7 +155,7 @@ function compileOne(file, storedPath) {
         .trim();
     const title = firstSentence || key;
     const dones = [...body.matchAll(/<done>\s*([\s\S]*?)\s*<\/done>/g)].map((m) => m[1].replace(/\s+/g, " ").trim());
-    const truths = strings(fm.must_haves?.truths);
+    const truths = parseTruths(file, fm.must_haves?.truths) ?? [];
     const acceptance = [...dones, ...truths].filter(Boolean);
     if (!acceptance.length) {
         throw new CompileError(`${file} has no acceptance criteria — every tickmarkr task needs them.\n` +

package/dist/compile/native.d.ts

@@ -1,4 +1,18 @@
 import { type RunGraph } from "../graph/schema.js";
+/**
+ * Classify one `context:` entry against the tree a worker's worktree is built from.
+ *   ok        — reachable
+ *   untracked — in the author's checkout, invisible to every worker. WARNS, permanently: per-file
+ *               force-add is the deliberate opt-in, so this is a standing prompt, not a migration.
+ *   missing   — absent from both. FAILS compile; carries a repair when exactly one tracked file
+ *               shares the basename (ambiguous matches suggest nothing rather than guess).
+ * RULING 2026-08-03 (.overseer/OVERSEER-RULING-20260803-context-visibility.md): OBS-170's
+ * fail-closed-on-untracked is retired — oracle upheld, policy overruled (it blocked 11 of 13).
+ */
+export declare function classifyContextPath(entry: string, tracked: Set<string>, repoDir: string): {
+    kind: "ok" | "untracked" | "missing";
+    suggestion?: string;
+};
 export declare const COLLECTABLE_TESTS = "tests/**/*.test.ts";
 export declare const LEGACY_PREFIX: string;
 export declare const TICKMARKR_NATIVE_MARKER: RegExp;

package/dist/compile/native.js

@@ -1,7 +1,61 @@
+import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
+import { basename, dirname } from "node:path";
 import picomatch from "picomatch";
 import { GATE_NAMES, GRAPH_ROUTING_MODES, ORACLES, SHAPES, TIERS, validateGraph } from "../graph/schema.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
+// OBS-170/OBS-184: `context:` is a promise to the worker, and nothing ever checked it could be kept.
+// Workers run in `git worktree add <baseRef>` (run/git.ts:169-176), which materialises the base
+// TREE and copies nothing in — so the oracle is that tree, and NEVER two things that look like it:
+//   · existsSync reads the AUTHOR's checkout. Measured on v1.85: 10 of 16 unreachable entries are
+//     plainly present there (.overseer/ is 21 tracked files out of 480 on disk).
+//   · `git ls-files` reads the INDEX. `git add -f` writes the index, so a staged-uncommitted file
+//     reports present while still being invisible to every worker — the lint would then certify
+//     exactly the failure it exists to catch (RULING 2026-08-03 rider; the absent-vs-empty shape
+//     again, cf. fileBytes). Hence the opt-in is "add AND commit", and the resolver reads HEAD.
+// `ls-tree -r HEAD` enumerates that tree once; per-path `cat-file -e HEAD:<path>` is the same oracle
+// one path at a time, and one spawn beats N.
+function trackedAtHead(dir) {
+    const git = (...args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const top = git("rev-parse", "--show-toplevel");
+    // --full-tree is load-bearing: without it `ls-tree` scopes to the CWD's subtree and prints paths
+    // relative to it, so a spec in specs/ would see only specs/-relative names and misjudge every
+    // path outside it. Caught only by a fixture whose spec is NOT at the repo root.
+    const r = git("ls-tree", "--full-tree", "-r", "--name-only", "HEAD");
+    // not a repo, or no commits yet — fail open, so non-repo fixtures and fresh inits stay silent
+    if (top.status !== 0 || r.status !== 0 || typeof r.stdout !== "string")
+        return undefined;
+    return { root: top.stdout.trim(), tracked: new Set(r.stdout.split("\n").filter(Boolean)) };
+}
+const GLOB_CHARS = /[*?{[]/;
+/**
+ * Classify one `context:` entry against the tree a worker's worktree is built from.
+ *   ok        — reachable
+ *   untracked — in the author's checkout, invisible to every worker. WARNS, permanently: per-file
+ *               force-add is the deliberate opt-in, so this is a standing prompt, not a migration.
+ *   missing   — absent from both. FAILS compile; carries a repair when exactly one tracked file
+ *               shares the basename (ambiguous matches suggest nothing rather than guess).
+ * RULING 2026-08-03 (.overseer/OVERSEER-RULING-20260803-context-visibility.md): OBS-170's
+ * fail-closed-on-untracked is retired — oracle upheld, policy overruled (it blocked 11 of 13).
+ */
+export function classifyContextPath(entry, tracked, repoDir) {
+    if (GLOB_CHARS.test(entry))
+        return { kind: "ok" }; // a glob is not a promise about one file
+    const q = entry.replace(/\/+$/, "");
+    if (tracked.has(q))
+        return { kind: "ok" };
+    for (const t of tracked)
+        if (t.startsWith(`${q}/`))
+            return { kind: "ok" }; // directory with tracked children
+    if (existsSync(`${repoDir}/${q}`))
+        return { kind: "untracked" };
+    // Measured: 5 of v1.85's 6 absent entries are a tracked file written without its directory
+    // (`V185-SEEDS.md` for `.overseer/V185-SEEDS.md`) — the opt-in had worked, only the check was
+    // missing. Suggest ONLY on an unambiguous basename: two candidates is a guess, not a repair.
+    const base = basename(q);
+    const hits = [...tracked].filter((t) => basename(t) === base);
+    return hits.length === 1 ? { kind: "missing", suggestion: hits[0] } : { kind: "missing" };
+}
 // OBS-97: mirror of the vitest.config.ts suite include — the only path class vitest collects.
 export const COLLECTABLE_TESTS = "tests/**/*.test.ts";
 export const LEGACY_PREFIX = ["dro", "vr"].join("");
@@ -31,7 +85,7 @@ export function compileNative(file) {
     for (const line of content.split("\n")) {
         const heading = line.match(HEAD_RE);
         if (heading) {
-            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptance: [], gates: [], hasGates: false, list: null, goalContinuation: false });
+            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptance: [], gates: [], hasGates: false, list: null, continuationField: null });
             continue;
         }
         const draft = drafts.at(-1);
@@ -59,29 +113,42 @@ export function compileNative(file) {
                 draft.list = name;
                 if (name === "gates")
                     draft.hasGates = true;
-                draft.goalContinuation = false;
+                draft.continuationField = null;
             }
             else {
                 if (name === "goal" && !value)
                     invalid(draft.id, field[1], "must not be empty");
                 draft.fields[name] = value;
-                // OBS-60: carry every indented continuation line after `- goal:` into the compiled goal.
-                draft.goalContinuation = name === "goal";
+                // OBS-60/OBS-308: carry wrapped physical lines for prose and comma-separated fields. A
+                // worker must receive the whole logical field, regardless of the author's editor width.
+                draft.continuationField = name === "goal" || name === "deps" || name === "files" || name === "context"
+                    ? name
+                    : null;
                 draft.list = null;
             }
             continue;
         }
-        // OBS-60: multiline goals — indented prose after `- goal:` is appended until the next field.
-        if (draft.goalContinuation) {
+        // OBS-60/OBS-308: indented physical lines continue the preceding logical field until the next
+        // field/list/heading. List continuations join with a space so the existing comma parser sees the
+        // exact same value it would have received on one line.
+        if (draft.continuationField) {
+            const continuation = draft.continuationField;
             if ((line.startsWith(" ") || line.startsWith("\t")) && !NESTED_RE.test(line)) {
-                draft.fields.goal += `\n${line.trim()}`;
-                continue;
+                const value = line.trim();
+                if (continuation === "goal") {
+                    draft.fields.goal += `\n${value}`;
+                    continue;
+                }
+                if (value) {
+                    draft.fields[continuation] += ` ${value}`;
+                    continue;
+                }
             }
-            if (!line.trim()) {
+            if (continuation === "goal" && !line.trim()) {
                 draft.fields.goal += "\n";
                 continue;
             }
-            draft.goalContinuation = false;
+            draft.continuationField = null;
         }
         const nested = line.match(NESTED_RE);
         if (nested && draft.list) {
@@ -124,12 +191,16 @@ export function compileNative(file) {
     }
     // v1.62 (OBS-97): commas inside {a,b} alternatives are part of one glob entry, not separators —
     // split only at brace depth 0 so a brace glob reaches the lint (and the scope gate) intact.
+    // OBS-170/OBS-184: the same is true of a citation annotation. `.planning/OBSERVATIONS.md (OBS-262,
+    // OBS-263)` split at the inner comma into two bullets, and workers were dispatched a context line
+    // reading `OBS-263)`. Track paren depth alongside brace depth for exactly the OBS-97 reason.
     const splitTop = (value) => {
         const parts = [];
         let depth = 0;
+        let paren = 0;
         let current = "";
         for (const ch of value) {
-            if (ch === "," && depth === 0) {
+            if (ch === "," && depth === 0 && paren === 0) {
                 parts.push(current);
                 current = "";
                 continue;
@@ -138,11 +209,34 @@ export function compileNative(file) {
                 depth++;
             else if (ch === "}" && depth > 0)
                 depth--;
+            else if (ch === "(")
+                paren++;
+            else if (ch === ")" && paren > 0)
+                paren--;
             current += ch;
         }
         return [...parts, current];
     };
-    const csv = (value) => (value && value.toLowerCase() !== "none" ? splitTop(value).map((item) => item.trim()).filter(Boolean) : []);
+    // Keeping the comma is only half of it: the merged entry still carries the annotation, so it
+    // resolves no better than the fragments did (measured: 24 → 19 unresolvable, zero rescued).
+    // Strip one trailing parenthetical so the entry is the path its author meant.
+    const stripAnnotation = (item) => {
+        const trimmed = item.trim();
+        if (!trimmed.endsWith(")"))
+            return trimmed;
+        let paren = 0;
+        for (let i = trimmed.length - 1; i >= 0; i--) {
+            if (trimmed[i] === ")")
+                paren++;
+            else if (trimmed[i] === "(") {
+                paren--;
+                if (paren === 0)
+                    return trimmed.slice(0, i).trim();
+            }
+        }
+        return trimmed;
+    };
+    const csv = (value) => value && value.toLowerCase() !== "none" ? splitTop(value).map((item) => stripAnnotation(item.trim())).filter(Boolean) : [];
     // OBS-97: a typed test: oracle needs a collectable home. vitest only collects COLLECTABLE_TESTS
     // paths, so a task whose non-empty files[] cannot host one makes scope-green and acceptance-green
     // mutually exclusive by construction — run-20260719-210434 burned two dispatch attempts before a
@@ -281,6 +375,31 @@ export function compileNative(file) {
             }
         }
     }
+    // OBS-170/OBS-184: warn per unreachable context: entry, classified by the action its author must
+    // take. Warn-only by operator ruling (2026-08-03) — fail-closed would have refused to compile the
+    // spec that shipped green. Fails open when git cannot answer, so non-repo fixtures stay silent.
+    const repo = trackedAtHead(dirname(file));
+    if (repo) {
+        const unreachable = [];
+        for (const t of tasks) {
+            for (const entry of t.context) {
+                const { kind, suggestion } = classifyContextPath(entry, repo.tracked, repo.root);
+                if (kind === "untracked") {
+                    // Permanent, by ruling: the per-file force-add IS the opt-in, so this stays a standing
+                    // prompt. "and commit" is load-bearing — staging alone leaves it out of the base tree.
+                    console.warn(`tickmarkr: OBS-170: task ${t.id} context ${JSON.stringify(entry)} exists in your checkout but is NOT in a worker's worktree. To make it worker context: git add -f ${entry} && git commit. Staging alone is not enough.`);
+                }
+                else if (kind === "missing") {
+                    unreachable.push(`  ${t.id}: ${JSON.stringify(entry)}${suggestion ? `\n      → did you mean ${suggestion} ?` : "\n      → not found in the repository, and not a path."}`);
+                }
+            }
+        }
+        if (unreachable.length) {
+            throw new CompileError(`context: paths that do not exist in ${file}:\n${unreachable.join("\n")}\n\n` +
+                `A context: entry is a promise the worker can read it. These resolve to nothing in the repository,\n` +
+                `so the worker would be told to read a file that is not there. Fix the paths and recompile.`);
+        }
+    }
     return result;
 }
 // Commented native spec written to tickmarkr.spec.md by `tickmarkr init`. Documented via HTML comments (which the
@@ -319,6 +438,43 @@ acceptance is required on every task (a nested list of observable outcomes).
                  - test: <name>       (oracle: test — named test)
                  - judge: <rubric>    (oracle: judge — LLM-judged, free text)
                  - <plain text>       (compat: compiles as judge oracle, warns)
+
+  HARD BOUNDS — these FAIL the compile, they do not warn:
+    - at most 6 acceptance items per task (no exception path)
+    - at most 8 files[] patterns; a {a,b} brace group counts as ONE pattern
+    - acceptance items x files[] patterns must be <= 24 ("surface")
+    - at most 60 goal words per acceptance criterion ("density")
+    Density is goal words DIVIDED BY items, so REMOVING a criterion RAISES it. Compress the goal in the
+    same edit, or a task that was comfortably inside the bound breaches it while you are tidying up.
+
+  WHAT MAKES A CRITERION REAL:
+    - "test:" must name a real test asserting on recorded state, journal lines, or drawn frames, and its
+      title must match the criterion string verbatim. It also needs a collectable test path in files[].
+    - NO criterion may be satisfiable by an absence, a rename, a source-text grep, or an empty collection.
+      "no file references X" is not a criterion — it passes in a repo where the feature was never built.
+    - "goal:" is NEVER verification. Prose in the goal enforces nothing: every obligation needs an
+      acceptance item, or a NAMED independent gate that actually applies. A gate is not independent of a
+      task that owns both the thing it checks and the fixture it checks against.
+    - A source-only obligation (a comment or doc that a change makes false) has no lawful "test:" — verify
+      it with "judge:", which reads the DIFF and must cite a changed line in a file the task owns.
+    - A criterion that pins the SHAPE of a fix must also pin the CONDITIONS under which it runs, or a
+      correctly-shaped fix that runs SOMETIMES satisfies it. "cleanup is try/finally at all four sites"
+      is satisfied by \`finally { if (cond) cleanup() }\` — the shape is present and the fix is inert in
+      production. Say UNCONDITIONAL, or name the branch that may not exist.
+    - Enumerating one axis exhaustively is what hides the others. A spec that guards PARTIAL coverage
+      site-by-site, member-by-member, can be defeated wholesale by CONDITIONAL coverage, which leaves
+      every enumeration satisfied. After you enumerate, ask what a single flag would do to the whole set.
+
+  ORDERING AND OWNERSHIP:
+    - Every path has exactly ONE owning task. Two tasks writing one file must be ORDERED by deps, or the
+      loser's work is silently dropped when the integration tip advances.
+    - A file one task CREATES cannot be "context:" for another — only deps: carries it, and that extends to
+      the task that PRODUCES a value, not just the file's existence.
+    - Deleting or renaming a symbol is a cross-task contract. Sweep for consumers by symbol AND by what the
+      mechanism DOES for them; the most dangerous consumer is a file no task owns, because nothing fixes it
+      and no edge can order it.
+
+  "timeout:" IS A KILL CEILING, NOT AN ESTIMATE. Never read a sum of timeouts as a predicted duration.
 -->
 
 ## T1: Scaffold the feature

package/dist/config/config.d.ts

@@ -7,6 +7,7 @@ declare const TierEnum: z.ZodEnum<{
 export type Tier = z.infer<typeof TierEnum>;
 export declare const TIER_RANK: Record<Tier, number>;
 export declare const DEFAULT_DIFF_CAP = 60000;
+export declare const MODEL_WINDOW_PLAUSIBILITY_FLOOR = 1024;
 export declare const ROUTING_MODES: readonly ["partner-led", "risk-based", "staff-led"];
 declare const ModeEnum: z.ZodEnum<{
     "partner-led": "partner-led";
@@ -26,7 +27,7 @@ export declare const MapEntrySchema: z.ZodObject<{
 }, z.core.$strip>;
 export type MapEntry = z.infer<typeof MapEntrySchema>;
 export declare const TierEntrySchema: z.ZodObject<{
-    vendor: z.ZodString;
+    vendor: z.ZodNullable<z.ZodString>;
     channel: z.ZodEnum<{
         sub: "sub";
         api: "api";
@@ -36,6 +37,13 @@ export declare const TierEntrySchema: z.ZodObject<{
         mid: "mid";
         frontier: "frontier";
     }>>;
+    modelOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        vendor: z.ZodOptional<z.ZodString>;
+        channel: z.ZodOptional<z.ZodEnum<{
+            sub: "sub";
+            api: "api";
+        }>>;
+    }, z.core.$strip>>>;
     windows: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
 }, z.core.$strip>;
 export type TierEntry = z.infer<typeof TierEntrySchema>;
@@ -173,7 +181,7 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
         }, z.core.$strip>>;
     }, z.core.$strip>;
     tiers: z.ZodRecord<z.ZodString, z.ZodObject<{
-        vendor: z.ZodString;
+        vendor: z.ZodNullable<z.ZodString>;
         channel: z.ZodEnum<{
             sub: "sub";
             api: "api";
@@ -183,6 +191,13 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
             mid: "mid";
             frontier: "frontier";
         }>>;
+        modelOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            vendor: z.ZodOptional<z.ZodString>;
+            channel: z.ZodOptional<z.ZodEnum<{
+                sub: "sub";
+                api: "api";
+            }>>;
+        }, z.core.$strip>>>;
         windows: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
     }, z.core.$strip>>;
     pricing: z.ZodRecord<z.ZodString, z.ZodNumber>;
@@ -301,8 +316,8 @@ export type InitConfigOverlay = {
     };
 };
 export declare function configTemplate(overlay?: InitConfigOverlay): string;
-export { FLEET_OVERLAY_KEYS, fleetEditableEquals, fleetRepoOverlayFromDelta, harvestFleetProvenance, repoOverlayYaml, serializeFleetOverlay, unifiedYamlDiff, } from "./fleet-overlay.js";
-export type { FleetDenyNotes, HarvestedProvenance } from "./fleet-overlay.js";
+export { FLEET_OVERLAY_KEYS, fleetEditableEquals, fleetRepoOverlayFromDelta, renderFleetOverlayWrite, repoOverlayYaml, serializeFleetOverlay, unifiedYamlDiff, } from "./fleet-overlay.js";
+export type { FleetOverlayWrite } from "./fleet-overlay.js";
 export type FleetTierAssignment = {
     tier: Tier;
     provenance?: string;
@@ -316,7 +331,7 @@ export type FleetEditable = {
 };
 export declare function repoOverlayPath(repoRoot: string): string;
 export declare function readOverlayFile(path: string): Record<string, unknown>;
-export declare function fleetEditableFromConfig(cfg: TickmarkrConfig, provenance?: Record<string, Record<string, string>>): FleetEditable;
+export declare function fleetEditableFromConfig(cfg: TickmarkrConfig): FleetEditable;
 /** Resolve which layer last set a dotted fleet path (defaults < global < repo). */
 export declare function fleetKeyLayer(repoRoot: string, dotted: string, opts?: {
     globalDir?: string;