tickmarkr 1.85.0 → 1.87.0

package/dist/config/fleet-overlay.js

@@ -1,6 +1,4 @@
-// Fleet-overlay provenance cluster (v1.61 seed 8): harvesting, serialization, and diff rendering
-// for the `tickmarkr fleet` write path. Pure move out of config.ts — prior import paths preserved
-// via re-exports there.
+// Fleet-overlay mutation, serialization, and diff rendering for the `tickmarkr fleet` write path.
 import { isMap, isScalar, isSeq, parseDocument, stringify } from "yaml";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export const FLEET_OVERLAY_KEYS = ["routing", "tiers"];
@@ -15,49 +13,186 @@ function fleetSubset(obj) {
 function sortedUnique(xs) {
     return [...new Set(xs)].sort();
 }
-/** OBS-88: harvest existing provenance comments from raw repo-overlay bytes at fleet-session
- *  load. yaml.parse discards comments, so before this every fleet write re-serialized the file
- *  knowing only the current session's own notes and silently stripped all prior ones — a typed
- *  benchmark-provenance note survived exactly one write. Fail-open to empty: an unreadable
- *  overlay is the loader's problem to reject, never the harvester's. */
-export function harvestFleetProvenance(overlayText) {
-    const out = { tiers: {}, denyAdapters: {}, denyModels: {} };
-    if (!overlayText.trim())
-        return out;
-    const doc = parseDocument(overlayText);
-    const note = (n) => {
-        const c = isScalar(n) ? n.comment : undefined;
-        return typeof c === "string" && c.trim() ? c.trim() : undefined;
-    };
-    const tiers = doc.getIn(["tiers"]);
-    if (isMap(tiers)) {
-        for (const ap of tiers.items) {
-            if (!isScalar(ap.key))
-                continue;
-            const models = isMap(ap.value) ? ap.value.get("models") : undefined;
-            if (!isMap(models))
-                continue;
-            for (const mp of models.items) {
-                const n = note(mp.value);
-                if (isScalar(mp.key) && n)
-                    (out.tiers[String(ap.key.value)] ??= {})[String(mp.key.value)] = n;
+// fleet.ts deliberately remains the sole overlay builder and writer. Its established classification
+// seam copies only `tier` and `note` into FleetEditable, so first-touch entry metadata rides inside a
+// private provenance envelope until this module writes the YAML. The envelope never reaches disk.
+const FIRST_TOUCH_OPEN = "\uE000tickmarkr-fleet-first-touch:";
+const FIRST_TOUCH_CLOSE = "\uE001";
+export function fleetFirstTouchProvenance(note, firstTouch) {
+    return `${FIRST_TOUCH_OPEN}${encodeURIComponent(firstTouch.vendor)}:${firstTouch.channel}${FIRST_TOUCH_CLOSE}${note}`;
+}
+function unpackFleetProvenance(provenance) {
+    if (!provenance?.startsWith(FIRST_TOUCH_OPEN))
+        return { provenance };
+    const close = provenance.indexOf(FIRST_TOUCH_CLOSE, FIRST_TOUCH_OPEN.length);
+    if (close === -1)
+        return { provenance };
+    const metadata = provenance.slice(FIRST_TOUCH_OPEN.length, close);
+    const colon = metadata.lastIndexOf(":");
+    if (colon === -1)
+        return { provenance };
+    const channel = metadata.slice(colon + 1);
+    if (channel !== "sub" && channel !== "api")
+        return { provenance };
+    try {
+        return {
+            provenance: provenance.slice(close + FIRST_TOUCH_CLOSE.length),
+            firstTouch: { vendor: decodeURIComponent(metadata.slice(0, colon)), channel },
+        };
+    }
+    catch {
+        return { provenance };
+    }
+}
+function setScalarPreservingComment(doc, path, value, authoredComment) {
+    const existing = doc.getIn(path, true);
+    if (isScalar(existing))
+        existing.value = value;
+    else
+        doc.setIn(path, doc.createNode(value));
+    if (authoredComment !== undefined) {
+        const written = doc.getIn(path, true);
+        if (isScalar(written))
+            written.comment = ` ${authoredComment}`;
+    }
+}
+function setStringSequencePreservingComments(doc, path, values) {
+    const existing = doc.getIn(path, true);
+    if (values === null) {
+        const tombstone = doc.createNode(null);
+        if (isScalar(tombstone) && existing && typeof existing === "object") {
+            // A block sequence's key-line note is stored as commentBefore; on a scalar it must be
+            // inline comment content or YAML expands `key: null` into a nested null value.
+            const comments = [];
+            if ("commentBefore" in existing && typeof existing.commentBefore === "string") {
+                comments.push(existing.commentBefore);
+            }
+            if ("comment" in existing && typeof existing.comment === "string") {
+                comments.push(existing.comment);
             }
+            if (comments.length)
+                tombstone.comment = comments.join("\n");
         }
+        doc.setIn(path, tombstone);
+        return;
     }
-    for (const [key, dest] of [["adapters", out.denyAdapters], ["models", out.denyModels]]) {
-        const seq = doc.getIn(["routing", "deny", key]);
-        if (!isSeq(seq))
+    if (!isSeq(existing)) {
+        doc.setIn(path, doc.createNode(values));
+        return;
+    }
+    const available = [...existing.items];
+    existing.items = values.map((value) => {
+        const at = available.findIndex((item) => isScalar(item) && String(item.value) === value);
+        if (at >= 0)
+            return available.splice(at, 1)[0];
+        return doc.createNode(value);
+    });
+}
+function deleteEmptyMap(doc, path) {
+    const node = doc.getIn(path, true);
+    if (isMap(node) && node.items.length === 0)
+        doc.deleteIn(path);
+}
+/** Apply only fields fleet authored to the parsed YAML document. Untouched nodes retain their
+ * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
+export function renderFleetOverlayWrite(priorBytes, write) {
+    const doc = parseDocument(priorBytes);
+    if (doc.errors.length)
+        throw doc.errors[0];
+    const { initial, edited } = write;
+    const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
+        || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
+    if (denyChanged) {
+        setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
+        setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
+    }
+    for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
+        const before = initial.map[shape];
+        const after = edited.map[shape];
+        if (JSON.stringify(before?.pin) !== JSON.stringify(after?.pin)) {
+            if (after?.pin === undefined)
+                doc.deleteIn(["routing", "map", shape, "pin"]);
+            else
+                doc.setIn(["routing", "map", shape, "pin"], doc.createNode(after.pin));
+        }
+        if (JSON.stringify(before?.prefer) !== JSON.stringify(after?.prefer)) {
+            // Clearing a resolved list must mask the lower layer with [], not delete the key and inherit it again.
+            setStringSequencePreservingComments(doc, ["routing", "map", shape, "prefer"], after?.prefer ?? []);
+        }
+        if (before?.escalate !== after?.escalate) {
+            if (after?.escalate === undefined)
+                doc.deleteIn(["routing", "map", shape, "escalate"]);
+            else
+                setScalarPreservingComment(doc, ["routing", "map", shape, "escalate"], after.escalate);
+        }
+    }
+    for (const shape of new Set([...Object.keys(initial.floors), ...Object.keys(edited.floors)])) {
+        if (initial.floors[shape] === edited.floors[shape])
             continue;
-        for (const item of seq.items) {
-            const n = note(item);
-            if (isScalar(item) && n)
-                dest[String(item.value)] = n;
+        const tier = edited.floors[shape];
+        if (tier === undefined)
+            doc.deleteIn(["routing", "floors", shape]);
+        else
+            setScalarPreservingComment(doc, ["routing", "floors", shape], tier);
+    }
+    for (const adapter of new Set([...Object.keys(initial.tiers), ...Object.keys(edited.tiers)])) {
+        const beforeModels = initial.tiers[adapter] ?? {};
+        const afterModels = edited.tiers[adapter] ?? {};
+        let firstTouch;
+        for (const model of new Set([...Object.keys(beforeModels), ...Object.keys(afterModels)])) {
+            const before = beforeModels[model];
+            const after = afterModels[model];
+            if (JSON.stringify(before) === JSON.stringify(after) || after === null || after === undefined)
+                continue;
+            firstTouch ??= unpackFleetProvenance(after.provenance).firstTouch;
+        }
+        const ft = firstTouch;
+        if (ft) {
+            if (doc.getIn(["tiers", adapter, "vendor"]) === undefined) {
+                setScalarPreservingComment(doc, ["tiers", adapter, "vendor"], ft.vendor);
+            }
+            if (doc.getIn(["tiers", adapter, "channel"]) === undefined) {
+                setScalarPreservingComment(doc, ["tiers", adapter, "channel"], ft.channel);
+            }
+        }
+        for (const model of new Set([...Object.keys(beforeModels), ...Object.keys(afterModels)])) {
+            const before = beforeModels[model];
+            const after = afterModels[model];
+            if (JSON.stringify(before) === JSON.stringify(after))
+                continue;
+            const path = ["tiers", adapter, "models", model];
+            if (after === null || after === undefined)
+                setScalarPreservingComment(doc, path, null);
+            else
+                setScalarPreservingComment(doc, path, after.tier, unpackFleetProvenance(after.provenance).provenance);
         }
     }
-    return out;
+    if (write.mode !== undefined) {
+        setScalarPreservingComment(doc, ["routing", "mode"], write.mode);
+    }
+    if (write.steering) {
+        for (const key of ["review", "consult"]) {
+            const before = write.steering.initial[key];
+            const after = write.steering.edited[key];
+            if (JSON.stringify(before) === JSON.stringify(after))
+                continue;
+            if (after === undefined) {
+                doc.deleteIn([key, "prefer"]);
+                deleteEmptyMap(doc, [key]);
+            }
+            else {
+                setStringSequencePreservingComments(doc, [key, "prefer"], after);
+            }
+        }
+    }
+    // Fleet's established note style uses two spaces before `#`; the Document remains the sole
+    // comment writer while preserving that byte-level convention for old and newly-authored notes.
+    return doc.toString({
+        commentString: (comment) => comment.replace(/^(?!$)(?: $)?/gm, " #"),
+    });
 }
 /** Build the repo overlay fragment fleet would write for edits since session start. */
-export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}) {
+export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, firstTouches = {}) {
     if (fleetEditableEquals(initial, edited))
         return {};
     const out = structuredClone(existingRepo);
@@ -74,8 +209,13 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}) {
     }
     const mapDelta = {};
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
-        if (JSON.stringify(initial.map[shape]) !== JSON.stringify(edited.map[shape]))
-            mapDelta[shape] = edited.map[shape];
+        if (JSON.stringify(initial.map[shape]) !== JSON.stringify(edited.map[shape])) {
+            const next = { ...edited.map[shape] };
+            if (initial.map[shape]?.prefer !== undefined && edited.map[shape]?.prefer === undefined) {
+                next.prefer = [];
+            }
+            mapDelta[shape] = next;
+        }
     }
     if (Object.keys(mapDelta).length) {
         routing.map = { ...routing.map, ...mapDelta };
@@ -111,9 +251,17 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}) {
             }
         }
         if (Object.keys(modelDelta).length) {
-            // spread the existing entry so vendor/channel/windows survive the rewrite — dropping them
-            // makes the overlay unloadable for any adapter without a default seed (reload-guard class)
-            tiersOut[adapter] = { ...tiersOut[adapter], models: { ...tiersOut[adapter]?.models, ...modelDelta } };
+            const existingEntry = tiersOut[adapter] ?? {};
+            const firstTouch = firstTouches[adapter];
+            // Spread the whole entry rather than a known-key projection: vendor/channel/windows and sibling
+            // keys introduced by newer schemas all survive. A genuinely new entry receives only facts the
+            // adapter/operator declared; channel is never inferred from the binary.
+            tiersOut[adapter] = {
+                ...existingEntry,
+                ...(existingEntry.vendor === undefined && firstTouch ? { vendor: firstTouch.vendor } : {}),
+                ...(existingEntry.channel === undefined && firstTouch ? { channel: firstTouch.channel } : {}),
+                models: { ...existingEntry.models, ...modelDelta },
+            };
             tiersTouched = true;
         }
     }
@@ -121,11 +269,11 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}) {
         out.tiers = tiersOut;
     return out;
 }
-export function repoOverlayYaml(overlay, provenance = {}, denyNotes = {}) {
+export function repoOverlayYaml(overlay) {
     if (!Object.keys(overlay).length)
         return "";
     const fleet = fleetSubset(overlay);
-    const fleetBody = serializeFleetOverlay(fleet, provenance, denyNotes);
+    const fleetBody = serializeFleetOverlay(fleet);
     const rest = { ...overlay };
     for (const k of FLEET_OVERLAY_KEYS)
         delete rest[k];
@@ -134,7 +282,7 @@ export function repoOverlayYaml(overlay, provenance = {}, denyNotes = {}) {
     const head = stringify(rest).trimEnd();
     return fleetBody ? `${head}\n${fleetBody}` : `${head}\n`;
 }
-export function serializeFleetOverlay(overlay, provenance = {}, denyNotes = {}) {
+export function serializeFleetOverlay(overlay) {
     if (!Object.keys(overlay).length)
         return "";
     const lines = [];
@@ -142,8 +290,6 @@ export function serializeFleetOverlay(overlay, provenance = {}, denyNotes = {})
     // re-indent the whole emitted block, so sequences/nested maps nest correctly and null
     // tombstones/empty collections survive the serialize→parse round-trip.
     const block = (obj, pad) => stringify(obj).trimEnd().split("\n").map((l) => `${pad}${l}`);
-    // deny lists emit item-by-item through the same stringify quoting rules as block(), so a
-    // harvested `# reason` can re-attach to its exact entry (multi-line emissions never take one)
     const denySeq = (key, v) => {
         if (v === undefined)
             return [];
@@ -152,9 +298,6 @@ export function serializeFleetOverlay(overlay, provenance = {}, denyNotes = {})
         const out = [`    ${key}:`];
         for (const item of v) {
             const emitted = stringify([item]).trimEnd().split("\n");
-            const n = denyNotes[key]?.[item];
-            if (n && emitted.length === 1)
-                emitted[0] += `  # ${n}`;
             out.push(...emitted.map((l) => `      ${l}`));
         }
         return out;
@@ -177,32 +320,7 @@ export function serializeFleetOverlay(overlay, provenance = {}, denyNotes = {})
     if (tiers && Object.keys(tiers).length) {
         lines.push("tiers:");
         for (const [adapter, entry] of Object.entries(tiers)) {
-            const body = [];
-            if (entry.vendor)
-                body.push(`    vendor: ${entry.vendor}`);
-            if (entry.channel)
-                body.push(`    channel: ${entry.channel}`);
-            if (entry.windows)
-                body.push(...block({ windows: entry.windows }, "    "));
-            const models = Object.entries(entry.models ?? {});
-            if (models.length) {
-                body.push("    models:");
-                for (const [model, tier] of models) {
-                    // OBS-88: notes serialize verbatim (fresh session notes arrive pre-stamped with their
-                    // "— fleet <date>" suffix), so a harvested note round-trips byte-for-byte every write
-                    const note = provenance[adapter]?.[model];
-                    const suffix = note ? `  # ${note}` : "";
-                    body.push(`      ${model}: ${tier === null ? "null" : tier}${suffix}`);
-                }
-            }
-            else if (entry.models) {
-                body.push("    models: {}"); // present-but-empty: explicit {} — a childless header parses as null and the loader rejects it
-            }
-            // a bare `adapter:` line parses as a null tombstone and would DELETE the adapter's default seeds on merge
-            if (body.length)
-                lines.push(`  ${adapter}:`, ...body);
-            else
-                lines.push(`  ${adapter}: {}`);
+            lines.push(...block({ [adapter]: entry }, "  "));
         }
     }
     return `${lines.join("\n")}\n`;

package/dist/config/fleet-why.d.ts

@@ -0,0 +1,23 @@
+export type FleetWhySource = "repo-overlay" | "global-config" | "seed-default" | "operator-pinned" | "defaulted";
+export type FleetWhyValue<Id extends string = string> = {
+    id: Id;
+    effective: string;
+    /** Dotted config path whose winning declaration produced this value. */
+    declaredAt?: string;
+    /** A live Shapes-screen pin outranks every persisted declaration. */
+    operatorPinned?: boolean;
+    /** Paste-ready only: projection and renderers never execute setup actions. */
+    setupCommand?: string;
+};
+export type FleetWhyRow<Id extends string = string> = FleetWhyValue<Id> & {
+    source: FleetWhySource;
+    label: string;
+};
+export type FleetWhyOptions = {
+    repoRoot: string;
+    globalDir?: string;
+};
+/** The single fleet projection: every consumer receives the same value/source/setup label. */
+export declare function projectFleetWhy<Id extends string>(values: readonly FleetWhyValue<Id>[], options: FleetWhyOptions): FleetWhyRow<Id>[];
+/** Plain line-mode twin of the Shapes rows; labels are projected, never reconstructed here. */
+export declare function renderFleetWhy(rows: readonly FleetWhyRow[]): string;

package/dist/config/fleet-why.js

@@ -0,0 +1,42 @@
+import { DEFAULT_CONFIG, fleetKeyLayer } from "./config.js";
+function valueAt(root, dotted) {
+    let value = root;
+    for (const part of dotted.split(".")) {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            return undefined;
+        value = value[part];
+    }
+    return value;
+}
+function sourceOf(value, options) {
+    if (value.operatorPinned)
+        return "operator-pinned";
+    if (!value.declaredAt)
+        return "defaulted";
+    const layer = fleetKeyLayer(options.repoRoot, value.declaredAt, {
+        globalDir: options.globalDir,
+    });
+    if (layer === "repo")
+        return "repo-overlay";
+    if (layer === "global")
+        return "global-config";
+    return valueAt(DEFAULT_CONFIG, value.declaredAt) === undefined
+        ? "defaulted"
+        : "seed-default";
+}
+/** The single fleet projection: every consumer receives the same value/source/setup label. */
+export function projectFleetWhy(values, options) {
+    return values.map((value) => {
+        const source = sourceOf(value, options);
+        const setup = value.setupCommand ? `\n    setup: ${value.setupCommand}` : "";
+        return {
+            ...value,
+            source,
+            label: `${value.id}  →  ${value.effective}  · source: ${source}${setup}`,
+        };
+    });
+}
+/** Plain line-mode twin of the Shapes rows; labels are projected, never reconstructed here. */
+export function renderFleetWhy(rows) {
+    return ["tickmarkr fleet --why — effective shape routing", ...rows.map((row) => row.label)].join("\n");
+}

package/dist/drivers/herdr.d.ts

@@ -22,6 +22,7 @@ export declare class DeliveryCorruptedError extends Error {
 export type DriverJournal = (event: string, slotName: string, data: Record<string, unknown>) => void;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export declare function workerSplitDirection(paneCols: number | null, safeFloor?: number, margin?: number): "right" | "down";
+export declare function taskGroupOf(name: string): string | undefined;
 export declare class HerdrDriver implements ExecutorDriver {
     private bin;
     private workersPerTab;

package/dist/drivers/herdr.js

@@ -3,7 +3,7 @@ import { readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { declaredInputBoxForWorkerName, matchesEmptyInputBox, matchesInputBox, matchesOccupiedInputBox, missingInputStateDeclarations, shq } from "../adapters/types.js";
-import { PANE_IDENTITY_ENV, paneIdentityLine } from "../brand.js";
+import { consumePaneLaunchIntent, PANE_IDENTITY_ENV, paneIdentityLine } from "../brand.js";
 import { createWorktree, sh } from "../run/git.js";
 import { Journal } from "../run/journal.js";
 import { herdrSealShellPrefix } from "./subprocess.js";
@@ -67,6 +67,27 @@ export function workerSplitDirection(paneCols, safeFloor = TRAILER_SAFE_FLOOR_CO
         return "down";
     return paneCols / 2 >= safeFloor + margin ? "right" : "down";
 }
+/** The tab a slot belongs to: its TASK — worker, judge, review and consult panes for one task share it.
+ *  Returns undefined for everything else, which keeps those on the dedicated-tab path.
+ *
+ *  The ROLE gate is load-bearing and was added after it bit: `canonicalizeLegacyName` returns
+ *  `role:"other", taskId:"<the whole name>"` for any unrecognised string, so keying on taskId alone
+ *  makes EVERY one-off pane its own "task" and gives it a group tab. `watch` is excluded for the same
+ *  reason in the other direction — its taskId is the literal "run", which is a board, not a task. */
+const TASK_TAB_ROLES = new Set(["worker", "judge", "review", "consult"]);
+export function taskGroupOf(name) {
+    const { role, taskId } = canonicalizeLegacyName(name, "");
+    if (!TASK_TAB_ROLES.has(role))
+        return undefined;
+    return taskId && taskId.trim() ? taskId : undefined;
+}
+/** Gate panes ride with the task they belong to and never consume the tab cap; everything else does.
+ *  Scoped to the three GATE roles deliberately — an earlier cut of this said "not a worker", which let
+ *  role:"other" members (any unrecognised name) bypass the cap and silently disabled overflow for
+ *  explicit stage groups. The cap still governs every member it governed before. */
+const GATE_ROLES = new Set(["judge", "review", "consult"]);
+const ridesWithTask = (name) => GATE_ROLES.has(canonicalizeLegacyName(name, "").role);
+const cappedMembers = (g) => g.members.filter((m) => !ridesWithTask(m.name)).length;
 export class HerdrDriver {
     bin;
     workersPerTab;
@@ -250,8 +271,22 @@ export class HerdrDriver {
         // reconcile.ts and this driver's own renameGroupTab/glyphFor decode role/taskId/attempt from
         // those shapes without a call-site migration; T2 retires this branch by always passing `owned`.
         const resolved = opts?.owned ? formatOwnedName(opts.owned) : name;
-        const allocate = opts?.group
-            ? () => this.serial(() => this.groupSlot(cwd, resolved, opts.group))
+        // ONE TAB PER TASK. The group defaults to the task id, derived from the same parser that already
+        // decodes role/taskId for tab labels — so a worker and every gate pane it earns (judge, review,
+        // consult) land in that task's tab instead of scattering. Deriving it HERE rather than at each
+        // call site is the point: the defect this replaces was three call sites of which exactly one
+        // passed a group, so judge/review/consult each opened a tab of their own. A caller may still pass
+        // `group` explicitly to override, and a name with no task id (or an explicit `label`) keeps the
+        // dedicated-tab path unchanged.
+        // PRECEDENCE: a task-bearing name ALWAYS groups by its task; an explicit `group` applies only to
+        // names with no task identity. That direction is deliberate — the invariant is "a task's panes are
+        // never scattered", and a caller passing a stage group (the daemon still passes "workers", which now
+        // serves as the fallback for task-less names) must not be able to override it by omission or habit.
+        // An explicit `label` still wins outright: that is the dedicated-role-tab path, chosen on purpose.
+        const derivedGroup = opts?.label ? undefined : taskGroupOf(resolved);
+        const group = derivedGroup ?? opts?.group;
+        const allocate = group
+            ? () => this.serial(() => this.groupSlot(cwd, resolved, group))
             : () => this.tabSlot(cwd, resolved, opts?.label);
         // Production dispatch names are canonical even when the gate call site supplies the already-
         // formatted name rather than SlotOpts.owned. Hold one lease across slot() → run(); legacy/manual
@@ -358,7 +393,10 @@ export class HerdrDriver {
             return this.tabSlot(cwd, name); // D-09: degrade, NOT a shared-tab member
         if (state) {
             const latest = state.generations[state.generations.length - 1];
-            if (latest && latest.members.length < this.workersPerTab) {
+            // A task tab's judge/review/consult panes belong with their worker and must never overflow into a
+            // `cleanup` tab — that would re-scatter exactly what the per-task grouping exists to gather. They
+            // therefore join freely and do not consume `workersPerTab`; every other member still does.
+            if (latest && (ridesWithTask(name) || cappedMembers(latest) < this.workersPerTab)) {
                 const joined = await this.joinGroup(cwd, name, group, latest);
                 if (joined)
                     return joined;
@@ -393,7 +431,11 @@ export class HerdrDriver {
         const newest = [...entry.members].reverse().find((m) => canonicalizeLegacyName(m.name, "").role === "worker");
         const token = newest ? canonicalizeLegacyName(newest.name, "").taskId : undefined;
         const glyph = newest ? await this.glyphFor(newest) : "";
-        const label = token ? `${entry.label} · ${token}${glyph}` : entry.label;
+        // A per-task tab is already labelled with its task id; appending the same token again reads as a
+        // duplicate rather than as state, so the glyph rides the existing label instead.
+        const label = !token ? entry.label
+            : entry.label === token ? `${token}${glyph}`
+                : `${entry.label} · ${token}${glyph}`;
         const cmd = `tab rename ${shq(entry.tabId)} ${shq(label)}`;
         const ok = async () => (await this.herdr(cmd)).code === 0;
         if (await ok() || await ok())
@@ -468,12 +510,16 @@ export class HerdrDriver {
     // command — earns the typed pincer. One dispatch corruption is then retried in-process against a
     // FRESH pane before anything is reported as a failure.
     async run(slot, cmd) {
+        // paneLaunchCommand is a linear same-call handoff: consume before the first await so concurrent
+        // task dispatches cannot exchange intent. The command remains an ordinary string for every
+        // ExecutorDriver implementation; classification never reads its bytes when the builder spoke.
+        const recordedLaunch = consumePaneLaunchIntent();
         const lease = this.dispatchLeases.get(slot);
         if (lease) {
             this.dispatchLeases.delete(slot);
             try {
                 const paneId = await this.verifyPaneIdentityBinding(slot);
-                await this.dispatchWithRetry(slot, cmd, paneId);
+                await this.dispatchWithRetry(slot, cmd, paneId, recordedLaunch);
             }
             finally {
                 lease.release();
@@ -481,16 +527,16 @@ export class HerdrDriver {
             return;
         }
         return this.deliveryQueue(async () => {
-            await this.dispatchWithRetry(slot, cmd, await this.paneId(slot));
+            await this.dispatchWithRetry(slot, cmd, await this.paneId(slot), recordedLaunch);
         });
     }
     // OBS-253: dispatch corruption is self-clearing — all ten recorded occurrences cleared on a fresh
     // pane and a fresh submit, and every one of them cost an operator `resume --retry-failed`. Retry
     // ONCE here against a pane that has never seen this delivery; the wedged pane is closed, never
     // re-pressed. A second consecutive corruption propagates, and the daemon parks the task on it.
-    async dispatchWithRetry(slot, cmd, pane) {
+    async dispatchWithRetry(slot, cmd, pane, recordedLaunch = false) {
         try {
-            await this.dispatch(slot, cmd, pane);
+            await this.dispatch(slot, cmd, pane, recordedLaunch);
             this.deliveredPanes.set(slot, pane);
             return;
         }
@@ -502,7 +548,7 @@ export class HerdrDriver {
             // this slot already delivered. Retyping a turn into a bare shell would guarantee the second
             // failure rather than recover from the first, so without a replayable bootstrap the
             // corruption propagates untouched.
-            const typedTurn = this.isTuiTurn(slot, cmd);
+            const typedTurn = this.isTuiTurn(slot, cmd, recordedLaunch);
             const relaunch = typedTurn ? this.bootstraps.get(slot) : undefined;
             if (typedTurn && relaunch === undefined)
                 throw error;
@@ -516,27 +562,32 @@ export class HerdrDriver {
                 throw error;
             if (relaunch !== undefined)
                 await this.deliverAtomic(slot, relaunch, fresh);
-            await this.dispatch(slot, cmd, fresh);
+            await this.dispatch(slot, cmd, fresh, recordedLaunch);
             this.deliveredPanes.set(slot, fresh);
         }
     }
     // Is this delivery a turn TYPED into a running interface, rather than a line a shell runs? The
-    // adapter's declaration decides it wherever there is one: `launchCommand` names the bootstrap,
-    // everything else is a turn. With NO declaration the only evidence is the slot's own history — a
+    // The builder's recorded fact decides first, regardless of command bytes. For direct driver users,
+    // an adapter may declare the fresh-slot lifecycle rather than a prefix list. Legacy declarations
+    // still decide where neither stronger fact exists. With NO declaration the only evidence is history — a
     // pane that already accepted a delivery is running whatever that delivery started, so a second
     // delivery is a turn into it. Answering "shell" there is what would run an adapter's seed prompt
     // as a shell command; answering "turn" routes it to deliverTyped, which refuses it by name
     // because the adapter declared no input box (fail closed, never a guess).
-    isTuiTurn(slot, cmd) {
+    isTuiTurn(slot, cmd, recordedLaunch = false) {
+        if (recordedLaunch)
+            return false;
         const inputBox = this.inputBoxes.get(slot);
+        if (inputBox?.firstDeliveryIsLaunch && !this.deliveredPanes.has(slot))
+            return false;
         return inputBox ? inputBox.launchCommand?.(cmd) !== true : this.deliveredPanes.has(slot);
     }
-    dispatch(slot, cmd, pane) {
-        if (this.isTuiTurn(slot, cmd))
+    dispatch(slot, cmd, pane, recordedLaunch = false) {
+        if (this.isTuiTurn(slot, cmd, recordedLaunch))
             return this.deliverTyped(slot, cmd, pane);
-        // An adapter-declared bootstrap is the one command that can restore this slot's interface on a
-        // fresh pane, so remember it for the recovery above.
-        if (this.inputBoxes.get(slot)?.launchCommand?.(cmd) === true)
+        // A classified bootstrap is the one command that can restore this slot's interface on a fresh
+        // pane, so remember the fact's command without asking its bytes to prove the classification again.
+        if (this.inputBoxes.has(slot))
             this.bootstraps.set(slot, cmd);
         return this.deliverAtomic(slot, cmd, pane);
     }

package/dist/gates/acceptance.js

@@ -5,6 +5,7 @@ import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
 import { checkDiffCap, fetchTaskDiff, isProtectedEvidence, setAsideReceiptPath } from "./review.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { classifyVerdictCause } from "./verdict-cause.js";
 // Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
 const JUDGE_TIMEOUT_MS = 900_000;
 const CitationSchema = z.object({ path: z.string(), line: z.number().int() });
@@ -328,12 +329,16 @@ The top-level comments array is optional. Use it only for actionable line-anchor
     const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
     const extracted = extractVerdictJson(raw, nonce);
     if (!extracted) {
+        const cause = classifyVerdictCause(raw, nonce, "pass");
         // GATE-09: structured meta names the flaked judge channel (mirrors review.ts:99 meta precedent) so
         // run-gates can retry the judge on a failover channel without string-matching details (D-03).
         // The parsed-verdict paths below are untouched — the flake signal is exactly extractJson→null here.
+        const failure = cause === "malformed-verdict"
+            ? "judge output unparseable — failing closed"
+            : "judge dispatch failed — no structurally valid nonce-bound response; output unparseable — failing closed";
         return { gate: "acceptance", pass: false,
-            details: warn + detBlock + "judge output unparseable — failing closed",
-            meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
+            details: warn + detBlock + failure,
+            meta: { unparseable: true, cause, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
     }
     const { verdict: v, inconsistencies } = checkJudgeVerdict(extracted, expectedIds);
     // v1.70 / OBS-129: each citation must fall inside a changed hunk of `diff` (the exact string embedded in

package/dist/gates/llm.d.ts

@@ -15,7 +15,6 @@ export declare function appendAnchoredReview(prose: string, verdict: unknown): s
 export declare function verdictNonceLine(nonce: string): string;
 export declare function extractPromptNonce(prompt: string): string | null;
 export declare function gateExitTrailer(nonce: string): string;
-export declare function augmentFakeVerdictOutput(adapter: WorkerAdapter, out: string, nonce: string, prompt?: string): string;
 export type GatePaneRole = "judge" | "review" | "consult";
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export declare function gatePaneName(role: GatePaneRole, taskId: string, suffix?: string): string;