tickmarkr 1.93.0 → 1.96.0

package/dist/adapters/model-lints.d.ts

@@ -57,7 +57,7 @@ export declare function catalogModelAdvisory(cfg: TickmarkrConfig, catalog: Cata
  */
 export declare function hasWindowsConfig(cfg: TickmarkrConfig): boolean;
 export declare function declaredModelWindow(cfg: TickmarkrConfig, adapter: string, model: string): number | undefined;
-/** A numeric estimate exists only when every payload path is measurable from the worker-visible tree. */
+/** A numeric estimate exists only when every context ref is measurable from the worker-visible tree. */
 export declare function estimateTaskPayloadTokens(task: Task, repoRoot: string, feedback?: string): number | undefined;
 export type RoutedAssignment = {
     taskId: string;

package/dist/adapters/model-lints.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { DEFAULT_CONFIG, TIER_RANK } from "../config/config.js";
+import { filesGlob } from "../graph/files-glob.js";
 import { buildTaskPrompt } from "./prompt.js";
 import { channelKey, MODEL_ID_RE } from "./types.js";
 import { resolveCatalogModel } from "./catalog-remote.js";
@@ -194,80 +195,136 @@ export function hasWindowsConfig(cfg) {
 export function declaredModelWindow(cfg, adapter, model) {
     return cfg.tiers[adapter]?.windows?.[model];
 }
+/** Named paths per lint line: an uncapped enumeration reached 4,924 columns on the P99 graph. */
+const MAX_NAMED_PATHS = 3;
 const GLOB_CHARS = /[*?{[]/;
 // T13's visibility oracle is the committed base tree: workers are created from HEAD, not from the
 // author's checkout or index. Keep --full-tree load-bearing for callers below the repository root.
+// `-l` prices every blob in the SAME call (a per-path `cat-file -s` spawn cannot price a pattern),
+// and `-z` is load-bearing correctness, not economy: without it git quotes any non-ASCII path, so
+// every Arabic/UTF-8 tracked file read as absent.
 function baseTreeAtHead(dir) {
     const git = (...args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
     const top = git("rev-parse", "--show-toplevel");
-    const tree = git("ls-tree", "--full-tree", "-r", "--name-only", "HEAD");
+    const tree = git("ls-tree", "--full-tree", "-r", "-l", "-z", "HEAD");
     if (top.status !== 0 || tree.status !== 0 || typeof top.stdout !== "string" || typeof tree.stdout !== "string")
         return undefined;
-    return { root: top.stdout.trim(), tracked: new Set(tree.stdout.split("\n").filter(Boolean)) };
+    const sizes = new Map();
+    for (const record of tree.stdout.split("\0")) {
+        const tab = record.indexOf("\t");
+        if (tab < 0)
+            continue;
+        // `<mode> <type> <object> <size>\t<path>`; a submodule entry carries `-` as its size and no bytes.
+        const bytes = Number.parseInt(record.slice(0, tab).split(/\s+/)[3] ?? "", 10);
+        sizes.set(record.slice(tab + 1), Number.isSafeInteger(bytes) && bytes >= 0 ? bytes : 0);
+    }
+    return { root: top.stdout.trim(), sizes };
 }
-function fileBytes(repoRoot, rel, tree = baseTreeAtHead(repoRoot)) {
-    if (GLOB_CHARS.test(rel))
-        return { status: "unreadable", reason: "glob" };
-    if (!tree)
-        return { status: "unreadable", reason: "base-tree-unavailable" };
+/**
+ * Bytes a worker can read at that path in the base tree, or undefined when the tree carries nothing
+ * there. A files[]-shaped pattern and a directory both price as everything they cover — matching
+ * through src/graph/files-glob.ts so the estimate reads patterns exactly as the scope gate does.
+ */
+function measureBytes(tree, rel) {
     const path = rel.replace(/\/+$/, "");
-    if (!tree.tracked.has(path)) {
-        if ([...tree.tracked].some((tracked) => tracked.startsWith(`${path}/`))) {
-            return { status: "unreadable", reason: "directory" };
-        }
-        return { status: "unreadable", reason: existsSync(join(tree.root, path)) ? "untracked" : "absent" };
+    const exact = tree.sizes.get(path);
+    if (exact !== undefined)
+        return exact;
+    const match = GLOB_CHARS.test(path) ? filesGlob(path) : undefined;
+    let total = 0;
+    let covered = false;
+    for (const [tracked, bytes] of tree.sizes) {
+        if (!(match ? match(tracked) : tracked.startsWith(`${path}/`)))
+            continue;
+        total += bytes;
+        covered = true;
     }
-    // Read the blob size from HEAD too: an unstaged/staged checkout edit is not what the worker receives.
-    const size = spawnSync("git", ["-C", tree.root, "cat-file", "-s", `HEAD:${path}`], { encoding: "utf8" });
-    const bytes = Number.parseInt(typeof size.stdout === "string" ? size.stdout.trim() : "", 10);
-    return size.status === 0 && Number.isSafeInteger(bytes) && bytes >= 0
-        ? { status: "measured", bytes }
-        : { status: "unreadable", reason: "base-tree-read-failed" };
+    return covered ? total : undefined;
 }
-function taskPayloadResolution(task, repoRoot, feedback) {
-    let bytes = buildTaskPrompt(task, feedback).length;
-    const unreadable = [];
-    const tree = baseTreeAtHead(repoRoot);
-    const add = (field, path) => {
-        const measured = fileBytes(repoRoot, path, tree);
-        if (measured.status === "measured")
-            bytes += measured.bytes;
-        else
-            unreadable.push({ field, path, reason: measured.reason });
+function absentContextReason(root, path) {
+    if (spawnSync("git", ["-C", root, "check-ignore", "-q", "--", path]).status === 0)
+        return "gitignored";
+    return existsSync(join(root, path)) ? "untracked" : "absent";
+}
+function upstreamProducer(tasks) {
+    const byId = new Map(tasks.map((t) => [t.id, t]));
+    const cache = new Map();
+    const upstream = (taskId) => {
+        let entry = cache.get(taskId);
+        if (!entry) {
+            const seen = new Set();
+            const walk = (from) => {
+                for (const dep of byId.get(from)?.deps ?? [])
+                    if (!seen.has(dep)) {
+                        seen.add(dep);
+                        walk(dep);
+                    }
+            };
+            walk(taskId);
+            entry = [...seen].map((id) => {
+                const files = byId.get(id)?.files ?? [];
+                return { id, covers: files.length ? filesGlob(files) : () => false };
+            });
+            cache.set(taskId, entry);
+        }
+        return entry;
     };
-    for (const path of task.context)
-        add("context", path);
+    return (taskId, path) => upstream(taskId).find((dep) => dep.covers(path))?.id;
+}
+function taskPayloadResolution(task, repoRoot, feedback, tree = baseTreeAtHead(repoRoot), producerOf = () => undefined) {
+    let bytes = buildTaskPrompt(task, feedback).length;
+    if (!tree) {
+        return { tokens: Math.ceil(bytes / CHARS_PER_TOKEN), unmeasurable: [{ path: ".", reason: "base-tree-unavailable" }] };
+    }
+    // files[] is WRITE SCOPE, not payload: a task's own output (`99-04-SUMMARY.md`) is absent from the
+    // base tree BY CONSTRUCTION and a scope entry is a set, not a document. Price what the worker can
+    // already read there and charge nothing for the rest. Billing an output path as a measurement
+    // failure is what made the window comparison unreachable on every real graph — 41 of 41 tasks on
+    // the P99 graph reported "payload unreadable" and none was ever compared to its model's window.
     for (const path of task.files)
-        add("files", path);
-    return { tokens: Math.ceil(bytes / CHARS_PER_TOKEN), unreadable };
+        bytes += measureBytes(tree, path) ?? 0;
+    const unmeasurable = [];
+    for (const path of task.context) {
+        const measured = measureBytes(tree, path);
+        if (measured !== undefined) {
+            bytes += measured;
+            continue;
+        }
+        const producer = producerOf(task.id, path);
+        unmeasurable.push(producer
+            ? { path, reason: "produced-upstream", producer }
+            : { path, reason: absentContextReason(tree.root, path) });
+    }
+    return { tokens: Math.ceil(bytes / CHARS_PER_TOKEN), unmeasurable };
 }
-/** A numeric estimate exists only when every payload path is measurable from the worker-visible tree. */
+/** A numeric estimate exists only when every context ref is measurable from the worker-visible tree. */
 export function estimateTaskPayloadTokens(task, repoRoot, feedback = "") {
     const estimate = taskPayloadResolution(task, repoRoot, feedback);
-    return estimate.unreadable.length === 0 ? estimate.tokens : undefined;
+    return estimate.unmeasurable.length === 0 ? estimate.tokens : undefined;
 }
-function unreadablePayloadLint(taskId, unreadable) {
-    const describe = ({ field, path, reason }) => {
-        const prefix = `${field} ${JSON.stringify(path)}`;
-        if (reason === "untracked")
-            return `${prefix} is present in the checkout but not in the base tree`;
-        if (reason === "absent")
-            return `${prefix} is absent from the base tree and checkout`;
-        if (reason === "glob")
-            return `${prefix} is a glob and cannot be measured`;
-        if (reason === "directory")
-            return `${prefix} is a directory and cannot be measured as one file`;
+function unreachableContextLint(taskId, dangling) {
+    const describe = ({ path, reason }) => {
         if (reason === "base-tree-unavailable")
-            return `${prefix} cannot be checked because the base tree is unavailable`;
-        return `${prefix} could not be read from the base tree`;
+            return "the base tree is unavailable, so no context ref can be checked";
+        const named = JSON.stringify(path);
+        if (reason === "gitignored")
+            return `${named} is gitignored — no commit can carry it into a worktree`;
+        if (reason === "untracked")
+            return `${named} is present in the checkout but not in the base tree`;
+        return `${named} is absent from the base tree and no task in this graph produces it`;
     };
-    return `${taskId}: payload unreadable — ${unreadable.map(describe).join(", ")}; context-window comparison skipped`;
+    const rest = dangling.length - MAX_NAMED_PATHS;
+    return `${taskId}: context unreachable — ${dangling.slice(0, MAX_NAMED_PATHS).map(describe).join(", ")}`
+        + `${rest > 0 ? `, +${rest} more` : ""}; the worker's "read these first" list dangles`
+        + " and the context-window comparison is skipped";
 }
 /** Advisory only — absent windows config or undeclared model window ⇒ no lint. */
 export function contextWindowLints(tasks, assignments, cfg, repoRoot) {
     if (!hasAnyWindows(cfg))
         return [];
     const byId = new Map(assignments.map((a) => [a.taskId, a]));
+    const tree = baseTreeAtHead(repoRoot);
+    const producerOf = upstreamProducer(tasks);
     const lints = [];
     for (const t of tasks) {
         const a = byId.get(t.id);
@@ -276,13 +333,20 @@ export function contextWindowLints(tasks, assignments, cfg, repoRoot) {
         const window = declaredModelWindow(cfg, a.adapter, a.model);
         if (window === undefined)
             continue;
-        const estimate = taskPayloadResolution(t, repoRoot, "");
-        if (estimate.unreadable.length > 0) {
-            lints.push(unreadablePayloadLint(t.id, estimate.unreadable));
+        const estimate = taskPayloadResolution(t, repoRoot, "", tree, producerOf);
+        const dangling = estimate.unmeasurable.filter((u) => u.reason !== "produced-upstream");
+        if (dangling.length > 0) {
+            lints.push(unreachableContextLint(t.id, dangling));
             continue;
         }
+        // An upstream-produced ref is unmeasurable but REACHABLE — the run writes it before this task
+        // branches — so it earns no lint of its own: silence on the benign class is what leaves a real
+        // dangling ref visible. The estimate is then a lower bound, and a lower bound over the window is
+        // still an overflow, so it is reported with what it excludes named.
         if (estimate.tokens > window) {
-            lints.push(`${t.id}: payload ~${estimate.tokens} tokens exceeds ${a.adapter}:${a.model} window ${window}`);
+            const pending = estimate.unmeasurable.length;
+            lints.push(`${t.id}: payload ~${estimate.tokens} tokens exceeds ${a.adapter}:${a.model} window ${window}`
+                + (pending > 0 ? ` (lower bound — ${pending} context ref(s) are produced upstream and not yet measurable)` : ""));
         }
     }
     return lints;

package/dist/cli/commands/beat.d.ts

@@ -0,0 +1 @@
+export declare function beat(argv: string[], cwd?: string): Promise<string>;

package/dist/cli/commands/beat.js

@@ -0,0 +1,50 @@
+import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { tickmarkrDir } from "../../graph/graph.js";
+import { SUPERVISION_BEAT_MS, SUPERVISION_STALE_MS, SUPERVISION_TIERS, beatSupervision, supervisionStandDownPath, } from "../../run/supervision.js";
+// SUP-04: the writer side of supervision, as a VERB. `beatSupervision` and `SUPERVISION_BEAT_MS` shipped
+// with exactly one in-repo caller — the daemon, on one tier — so `status` printed
+// `orchestrator ARMED / overseer ABSENT / watch ABSENT` while a real overseer worked the run: two thirds
+// of a supervision claim were constants dressed as measurements. A seat that supervises from a shell
+// (the overseer skill's watcher loop) has no way into a node module; a command does.
+//
+// ONE-SHOT AND ERROR-PROPAGATING, deliberately not `armSupervision`. That helper is the right shape for
+// a long-lived node process and the wrong shape here twice over. Its recurring interval would outlive
+// the invocation — in a long-lived dispatcher a later `--stand-down` would disarm only its own timer
+// while an earlier one kept writing, flipping DISARMED back to ARMED ten seconds later: the exact
+// fail-open this instrument exists to catch. And it swallows write failures by design (an unwritten
+// beat ages out, which is the truth for a watcher that must not be crashed by its own instrument) —
+// but a CLI that swallows them PRINTS a state nothing recorded, so `beat` says ARMED while `status`
+// reads UNREADABLE. Here the writes are unguarded: a failure leaves the process with a non-zero exit
+// and a message instead of a claim. The LOOP belongs to the caller, which is what makes the beat
+// evidence: stop calling it and the tier ages into STALE on its own.
+export async function beat(argv, cwd = process.cwd()) {
+    const standDown = argv.includes("--stand-down");
+    const named = argv.find((a) => !a.startsWith("--"));
+    if (!isTier(named)) {
+        throw new Error(`usage: tickmarkr beat <${SUPERVISION_TIERS.join("|")}> [--stand-down] — got ${named ? `\`${named}\`` : "no tier"}`);
+    }
+    if (standDown)
+        return standDownTier(cwd, named);
+    // Clear a stand-down marker left by an earlier session BEFORE beating: a valid marker outranks every
+    // beat that does not strictly follow it, and two writes landing in the same millisecond do not. An
+    // uncleared marker would render DISARMED while this verb claimed ARMED, so the removal is unguarded
+    // too — `force` makes the ordinary "no marker" case a no-op, and anything else is a real failure.
+    rmSync(supervisionStandDownPath(cwd, named), { force: true, recursive: true });
+    beatSupervision(cwd, named);
+    return `${named} ARMED — beat again every ${SUPERVISION_BEAT_MS / 1_000}s; the tier reads STALE ${SUPERVISION_STALE_MS / 1_000}s after the last beat`;
+}
+// Stand-down is a RECORDED act, not a silence: the marker tells a reader this watcher left on purpose,
+// so the tier reads DISARMED rather than ageing out as a death. Published atomically — written aside,
+// renamed over — because a torn marker is rejected by the reader, and a rejected stand-down reports a
+// deliberate hand-off as a death.
+function standDownTier(repoRoot, tier) {
+    tickmarkrDir(repoRoot); // the write path DOES create — markers land inside the gitignored state dir
+    const p = supervisionStandDownPath(repoRoot, tier);
+    const tmp = `${p}.${process.pid}.tmp`;
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(tmp, JSON.stringify({ tier, pid: process.pid, disarmedAt: new Date().toISOString() }) + "\n");
+    renameSync(tmp, p);
+    return `${tier} DISARMED — hand-off recorded; status reads it stood down, not dead`;
+}
+const isTier = (v) => SUPERVISION_TIERS.includes(v ?? "");

package/dist/cli/commands/status.js

@@ -8,6 +8,7 @@ import { blockedTasks, graphDefinitionHash, loadGraph, stateDirName } from "../.
 import { GATE_NAMES } from "../../graph/schema.js";
 import { foldActivity } from "../../run/activity.js";
 import { Journal, engagementComparable, isQualityFailureParkKind, recordedTaskFailureKind, runHasEnded, } from "../../run/journal.js";
+import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
 import { normalizeStallSnapshot } from "../../run/stall.js";
 import { readSupervision, supervisionText } from "../../run/supervision.js";
@@ -216,6 +217,18 @@ const livePhases = (events) => {
         const active = live.get(event.taskId);
         if (!active)
             continue;
+        // The daemon proves a silent worker alive by hashing its worktree and journals that proof as
+        // `worker-contact`. It is evidence ABOUT the live phase, never its outcome, so it decorates the
+        // entry and is deliberately absent from the `matched` set below.
+        if (event.event === "worker-contact" && active.phase === "worker") {
+            const at = Date.parse(event.ts);
+            if (Number.isFinite(at)) {
+                active.lastContactAt = at;
+                if (typeof event.data.evidence === "string")
+                    active.contactEvidence = event.data.evidence;
+            }
+            continue;
+        }
         const gate = active.gate ?? phaseGate(active.phase);
         const matched = (active.phase === "worker" && event.event === "worker-result")
             || (active.phase === "gates" && event.event === "gate-result")
@@ -249,16 +262,44 @@ const fmtElapsed = (ms) => {
     const hours = Math.floor(minutes / 60);
     return `${hours}h${minutes % 60}m${seconds % 60}s`;
 };
-const workerOutputAge = (phase, now, worker) => now - (worker?.phaseStartedAt === phase.startedAt && worker.hasOutput ? worker.lastOutputAt : phase.startedAt);
+/**
+ * The freshest evidence that this worker is alive, and what produced it. ONE derivation, because the
+ * two readers of worker silence drifted apart the first time this was fixed: OBS-538 taught the detail
+ * phrase to read the daemon's journaled `worker-contact` and left the stall ALARM (`staleWorker`)
+ * clocking pane bytes alone. For the exact population OBS-538 is about — a headless channel (codex
+ * `sub`, an API worker) that prints nothing to its pane all run, so `hasOutput` never becomes true —
+ * the alarm then warn-painted every live row from 60s onward while line 2 of the same card read
+ * "last contact 10s ago (worktree)". A card cannot contradict itself if both halves ask this.
+ */
+const workerActivity = (phase, worker) => {
+    const outputAt = worker?.phaseStartedAt === phase.startedAt && worker.hasOutput ? worker.lastOutputAt : undefined;
+    const contactAt = phase.lastContactAt;
+    if (outputAt !== undefined && (contactAt === undefined || outputAt >= contactAt))
+        return { at: outputAt, source: "output" };
+    if (contactAt !== undefined)
+        return { at: contactAt, source: "contact" };
+    // Nothing has been observed since the phase began: silence is the whole phase, which is what both
+    // the phrase ("no output 14m51s") and the alarm's 60s threshold must measure.
+    return { at: phase.startedAt, source: "none" };
+};
+/** How long this worker has been silent by the freshest evidence available — the alarm's clock. */
+const workerSilenceMs = (phase, now, worker) => now - workerActivity(phase, worker).at;
+/**
+ * What a live worker row says about silence. Pane bytes are not more truthful than a worktree delta,
+ * only different, so the row names whichever evidence is fresher AND names its source.
+ */
 const phaseDetail = (phase, now, worker) => {
     const elapsed = fmtElapsed(now - phase.startedAt);
     if (phase.phase !== "worker")
         return `${phaseLabel(phase)} · ${elapsed} elapsed`;
-    const age = fmtElapsed(workerOutputAge(phase, now, worker));
-    const output = worker?.phaseStartedAt === phase.startedAt && worker.hasOutput
-        ? `last output ${age} ago`
-        : `no output ${age}`;
-    return `${phaseLabel(phase.phase)} · ${elapsed} elapsed · ${output}`;
+    const head = `${phaseLabel(phase.phase)} · ${elapsed} elapsed`;
+    const activity = workerActivity(phase, worker);
+    const age = fmtElapsed(now - activity.at);
+    if (activity.source === "output")
+        return `${head} · last output ${age} ago`;
+    if (activity.source === "contact")
+        return `${head} · last contact ${age} ago (${phase.contactEvidence ?? "worktree"})`;
+    return `${head} · no output ${age}`;
 };
 const attemptStartIdx = (events, taskId) => {
     let idx = -1;
@@ -358,6 +399,8 @@ export const shortGoal = (goal, max) => {
         return fitCells(clause, cells).trimEnd();
     return `${fitCells(clause, cells - 3).trimEnd()}...`;
 };
+/** Columns the machine row always spends on the task title, however long its machinery segment runs. */
+const MACHINE_TITLE_FLOOR = 24;
 const detailText = (segments, budget) => {
     const shedOrder = LAYOUT_PRIORITY.slice(LAYOUT_PRIORITY.indexOf("journal") + 1).reverse();
     const shed = new Set();
@@ -378,6 +421,95 @@ const detailText = (segments, budget) => {
  * stay blank — `wrapCells` always answers at least one row.
  */
 const boardRows = (lines, columns) => lines.flatMap((line) => wrapCells(line, columns, { continuationPrefix: "  " }));
+/**
+ * A funded review round is a review that actually returned a verdict. `passed` and `failed` are the
+ * only two arms of the gate vocabulary that carry one (outcome.ts:23) — every other arm states why
+ * nothing ran, so counting it would bill the task for a reviewer it never spent.
+ */
+const REVIEW_VERDICTS = new Set(["passed", "failed"]);
+/**
+ * Fold the panel from parsed JournalEvent rows only. In particular, a review round is every
+ * gate-result whose typed gate field is `review` and whose outcome is a verdict, passed or failed.
+ * `review-raw-*` artifacts are unparseable-verdict captures, not round markers, and neither raw
+ * journal strings nor run-directory filenames participate in this count.
+ *
+ * A decline is not a round, and it is NOT readable off `data.skipped`: that field is one of four
+ * encodings the shipped record already writes, and the two it misses are both live on disk — a
+ * pre-R3 review decline states itself only as `{ pass: true, details: "skipped — …" }`, and a
+ * canonical row states it as `outcome.kind: "declined"`. Reading the flag alone bills both as funded
+ * rounds and can reorder the top four. `normalizeGateOutcome` is the ONE reader of all four
+ * encodings (outcome.ts:125), so the panel asks it rather than re-deriving a fifth answer; a row it
+ * cannot read stays `unavailable` and therefore uncounted, fail-closed. `replayMeasurement` is
+ * orthogonal to the outcome — a resume re-observing an interrupted round reports a real verdict —
+ * so it stays an explicit exclusion, the same clause journal.ts:110 uses.
+ */
+const foldTaskEffort = (tasks, events) => {
+    const order = new Map(tasks.map((task, index) => [task.id, index]));
+    const effort = new Map(tasks.map((task) => [task.id, {
+            taskId: task.id,
+            dispatches: 0,
+            reviews: 0,
+            parks: 0,
+            total: 0,
+        }]));
+    for (const event of events) {
+        if (!event.taskId)
+            continue;
+        const task = effort.get(event.taskId);
+        if (!task)
+            continue;
+        if (event.event === "task-dispatch")
+            task.dispatches += 1;
+        else if (event.event === "gate-result" && event.data.gate === "review"
+            && event.data.replayMeasurement !== true
+            && REVIEW_VERDICTS.has(normalizeGateOutcome(event.data.outcome ?? event.data).kind))
+            task.reviews += 1;
+        else if (event.event === "task-human")
+            task.parks += 1;
+        task.total = task.dispatches + task.reviews + task.parks;
+    }
+    return [...effort.values()].sort((left, right) => right.total - left.total
+        || order.get(left.taskId) - order.get(right.taskId));
+};
+/**
+ * Prototype panel, fitted by the cockpit's display-cell authority before board-wide wrapping.
+ *
+ * `undefined` events mean this run's journal describes a DIFFERENT graph, so it funds no claim here.
+ * Folding it — or folding an empty array in its place — would state zero dispatches, reviews and
+ * parks for a run that recorded all three, which is unavailable evidence dressed as an answer. Same
+ * clause the verify claim uses (`verify unavailable`): no claim beats a false zero.
+ */
+const effortPanel = (tasks, events, columns) => {
+    if (!events) {
+        return [
+            ` ${title("WHERE THE EFFORT WENT")}`,
+            legend(`   dispatch · review · park counts unavailable — ${NOT_COMPARABLE_CLAIM}`),
+        ];
+    }
+    const top = foldTaskEffort(tasks, events).slice(0, 4);
+    const maxTotal = Math.max(1, ...top.map((task) => task.total));
+    const idColumns = Math.max(2, Math.min(16, Math.max(...top.map((task) => cellWidth(task.taskId)))));
+    const rows = top.map((task) => {
+        const counts = `${task.dispatches} dispatch · ${task.reviews} review · ${task.parks} park`;
+        const prefix = `    ${fitCells(task.taskId, idColumns)} `;
+        const barColumns = Math.min(46, Math.max(3, columns - cellWidth(prefix) - 2 - cellWidth(counts)));
+        const dispatchEnd = Math.round((task.dispatches / maxTotal) * barColumns);
+        const reviewEnd = Math.round(((task.dispatches + task.reviews) / maxTotal) * barColumns);
+        const parkEnd = Math.round((task.total / maxTotal) * barColumns);
+        const stack = ok("█".repeat(dispatchEnd))
+            + warn("█".repeat(Math.max(0, reviewEnd - dispatchEnd)))
+            + fail("█".repeat(Math.max(0, parkEnd - reviewEnd)));
+        return `${prefix}${fitCells(stack, barColumns)}  ${counts}`;
+    });
+    return [
+        ` ${title("WHERE THE EFFORT WENT")}`,
+        legend(`   dispatches · review rounds · human parks · top ${top.length} of ${tasks.length} tasks`),
+        "",
+        ...rows,
+        "",
+        `   ${ok("█")} ${dim("dispatch")}  ${warn("█")} ${dim("review round")}  ${fail("█")} ${dim("human park")}`,
+    ];
+};
 // VIS-11 (v1.13): a liveness header for renderFrame — last journal event age + whether the recorded
 // daemon pid is still alive. Honest about unknowns: a pre-v1.13 journal with no pid renders "unknown",
 // never fabricated (garbage pid data fails toward unknown too). kill(pid,0) is a signal probe, not a
@@ -724,6 +856,17 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     // (a recompiled graph's journal must not animate the wrong tasks); with no or stale journal the
     // dep-waiting cells still derive from the effective graph statuses.
     const activity = foldActivity(comparable ? events : [], effective.tasks);
+    // RULING-v189-scope §14c: a card answers BOTH supervisor questions. `foldActivity` names what a
+    // task waits FOR; this names what waits ON it. Read from `effective.tasks` — whose statuses are
+    // the journal's replay, never the compiled graph's — so a dependent the record says is done stops
+    // being named, and a task all of whose dependents are done acquires no entry at all.
+    const dependents = new Map();
+    for (const task of effective.tasks) {
+        if (task.status === "done")
+            continue;
+        for (const dep of task.deps)
+            dependents.set(dep, [...(dependents.get(dep) ?? []), task.id]);
+    }
     const unicode = visual();
     const divider = unicode ? " · " : " / ";
     // SUP-01: derived by stat() alone, from THIS frame's clock. status stays a reader — nothing here
@@ -783,7 +926,12 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
             const chain = gateChain(states, false);
             const prefix = livePhase ? `  ${ASCII_SPINNER[animationFrame % ASCII_SPINNER.length]} ${t.id} ` : `  ${surfaceTaskBox(st, merged)} ${t.id} `;
             const suffix = `  ${chain}${priorGraph ? ` ${PRIOR_GRAPH_MARKER}` : ""}  ${livePhase ? "running" : surfaceStatusWord(st)}${label}  ${assignCol}${pane ? `  pane ${pane}` : ""}`;
-            return `${prefix}${shortGoal(t.title, Math.max(0, width - prefix.length - suffix.length))}${suffix}`;
+            // The machine row carries the cockpit's own law (see LAYOUT_PRIORITY and the two-line card):
+            // identity is never what a crowded row sheds. `dep-waiting on …` grows with fan-in and alone
+            // can exceed the terminal width, and the pre-floor math paid for it out of the TITLE — 20 of
+            // 41 rows in a live 41-task run named no task at all. These rows already overflow `width`
+            // (a pane name is 60 columns on its own), so the floor costs wrapping, never the graph.
+            return `${prefix}${shortGoal(t.title, Math.max(MACHINE_TITLE_FLOOR, width - prefix.length - suffix.length))}${suffix}`;
         });
         const zone = journalRowsOnly ? `${divider}zone ${localZoneLabel(zoneReference)}` : "";
         const header = runId
@@ -866,8 +1014,10 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     const rows = cells.map((c, i) => {
         const { t, st, merged, failureKind, redTier, states, priorGraph, isStarved, phrase, channel, ctx, livePhase, pane } = c;
         const word = statusWord(c);
+        // The alarm reads the SAME evidence the detail phrase names — a worktree delta the daemon proved
+        // counts, or the card would flag a worker it just called alive one line below (OBS-538 review).
         const staleWorker = livePhase?.phase === "worker"
-            && workerOutputAge(livePhase, now, workerLiveness.get(t.id)) >= 60_000;
+            && workerSilenceMs(livePhase, now, workerLiveness.get(t.id)) >= 60_000;
         const stWord = staleWorker ? warn(word) : merged ? ok(word) : redTier ? fail(word) : st === "failed" || st === "human" ? warn(word) : word;
         // a fail names its gate in words right here — the one moment gate identity is needed on a row
         const f = failedGates(states);
@@ -883,6 +1033,8 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
             : `  ${statusRow(taskVerdict(c), taskLabel)}`;
         // activity already names its channel for in-flight attempts — never repeat it
         const chain = gateChain(states, true);
+        // A finished task blocks nobody — the same journal-folded done-ness the map was built on.
+        const blocking = graphTaskStatus(st, t.status) === "done" ? [] : dependents.get(t.id) ?? [];
         const segments = [
             ...(priorGraph ? [{ element: "progressCaption", text: PRIOR_GRAPH_MARKER }] : []),
             ...(phrase
@@ -893,6 +1045,10 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
                         : [{ element: "secondaryHeader", text: channel }]),
                 ]
                 : [{ element: "secondaryHeader", text: channel }]),
+            // The waiting phrase's reverse direction, and structure for the same reason: a supervisor
+            // deciding what to unblock needs the names, so it wraps beside the blockers rather than being
+            // shed or folded into a count. A finished task blocks nobody.
+            ...(blocking.length ? [{ element: "journal", text: `blocks ${blocking.join(", ")}` }] : []),
             ...(failureKind && !phrase?.includes(failureKind)
                 ? [{ element: "progressCaption", text: failureKind }]
                 : []),
@@ -909,8 +1065,9 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     }).flat();
     if (!nowLine.length)
         rows.pop(); // cards end blank-separated; drop the dangling one
+    const effort = effortPanel(g.tasks, record && !comparable ? undefined : events, boardColumns);
     return {
-        content: boardRows([header, hr, gatesLegend, supervisionLegend, "", ...rows, ...nowLine], boardColumns).join("\n"),
+        content: boardRows([header, hr, gatesLegend, supervisionLegend, "", ...rows, ...nowLine, "", hr, "", ...effort], boardColumns).join("\n"),
         ...(hotPhase ? { hotPhase } : {}),
         ...(runId ? { runId } : {}),
         workerPhases: [...phases.values()].filter((phase) => phase.phase === "worker"),

package/dist/cli/commands/verify.js

@@ -42,6 +42,13 @@ export function parseCriteria(text) {
 // verify models the author as a "human" vendor channel — resolvable, excludes nothing real.
 export const HUMAN_CHANNEL = { adapter: "human", vendor: "human", model: "human", channel: "sub", tier: "frontier" };
 export const HUMAN_AUTHOR = { adapter: "human", model: "human", channel: "sub", tier: "frontier" };
+// The battery's own dirty-worktree refusal, mirrored from run-gates.ts:220-232 — that check lives in
+// a closure this command cannot reach, and verify may not reshape it. run-gates stays the authority:
+// it re-checks at round entry and after every gate command, so a copy that ever drifted could only
+// refuse EARLY with a stale sentence — never let a dirty tree through.
+const DIRTY_WHY = `refusing to gate a dirty worktree: the shell gates run against the working tree while `
+    + `evidence, scope and the merge read commits, so these uncommitted changes would be gated `
+    + `and never merged (and the committed diff would never be run)`;
 // GATE-FIX-4 defect 1 (false-RED on macOS): os.tmpdir() returns /var/folders/…, a symlink into
 // /private/var — so a baseline captured under the repo path and a head battery run under the tmp
 // path disagree on every path-bearing fingerprint, and verify reds a green diff. graph.ts's
@@ -105,6 +112,51 @@ export async function verify(argv, cwd = process.cwd()) {
         evidence: { commits: [], artifacts: [], gateResults: [] },
     };
     const commands = detectGateCommands(cwd, cfg);
+    // PRECONDITIONS (OBS-541) — every check that can refuse this candidate, evaluated together and
+    // BEFORE the baseline capture below. Both read cheap local state (one `git status`, the doctor
+    // cache), and both used to be read AFTER the capture: the dirty tree by runGates' own round-entry
+    // refusal, the review seat by the resolution that sat under it. That cost one full capture per
+    // refusal — measured at 602s and 590s on two refusals of the same candidate — to learn something
+    // knowable in 50ms. Messages, exit taxonomy and fail-closed semantics are unchanged; only the
+    // order is. Anything else that can refuse before a gate runs belongs in this phase, above capture.
+    // `--untracked-files=all` is load-bearing twice over: it overrides a repo/user
+    // `status.showUntrackedFiles=no` (under which untracked work is INVISIBLE and a dirty tree would
+    // capture and gate GREEN), and it enumerates nested files individually instead of collapsing them
+    // to a bare `?? dir/`, so the refusal names every offending path. The `.tickmarkr-*` exemption is
+    // unaffected — the harness's droppings are root-level files, never directories.
+    const status = await shGit("GIT_OPTIONAL_LOCKS=0 git status --porcelain --untracked-files=all", cwd);
+    const dirt = status.code !== 0
+        ? `git status failed (exit ${status.code}) — the worktree cannot be proven clean`
+        : status.stdout.split("\n").map((l) => l.trimEnd())
+            .filter((l) => l.trim() && !/^.. \.tickmarkr-[^/]*$/.test(l)).join("\n");
+    if (dirt)
+        throw new Error(`${DIRTY_WHY}:\n${dirt}`);
+    // LLM seats only when a semantic gate will run.
+    let channels = [];
+    let judgeChannels;
+    let author = HUMAN_AUTHOR;
+    const adapters = allAdapters();
+    if (wantAcceptance || wantReview) {
+        const health = readDoctor(cwd) ?? (await probeAll(adapters));
+        const pools = rolePools(cfg, adapters, health);
+        judgeChannels = pools.judge;
+        channels = pools.review;
+        if (values.author && values.author !== "human") {
+            const [adapter, ...rest] = values.author.split(":");
+            const model = rest.join(":");
+            const c = channels.find((ch) => ch.adapter === adapter && ch.model === model);
+            if (!c) {
+                throw new Error(`--author ${values.author} does not name a discoverable review channel — one of: ${channels.map(channelKey).join(", ") || "(none)"}`);
+            }
+            author = { adapter: c.adapter, model: c.model, channel: c.channel, tier: c.tier };
+        }
+        else {
+            channels = [...channels, HUMAN_CHANNEL];
+        }
+        if (wantReview && !channels.some((c) => c.vendor !== "human")) {
+            throw new Error("review gate needs at least one authed LLM channel (run `tickmarkr doctor`) — or pass --no-review");
+        }
+    }
     // Baseline: --baseline file > cached capture for this merge-base > fresh capture on a detached
     // temp worktree of the merge-base (so pre-existing failures on base are forgiven, exactly as a run).
     // ALL verify state (cache, base worktree, artifacts) lives OUTSIDE the repo: verify gates the repo
@@ -135,32 +187,6 @@ export async function verify(argv, cwd = process.cwd()) {
             await removeWorktree(cwd, baseDir);
         }
     }
-    // LLM seats only when a semantic gate will run.
-    let channels = [];
-    let judgeChannels;
-    let author = HUMAN_AUTHOR;
-    const adapters = allAdapters();
-    if (wantAcceptance || wantReview) {
-        const health = readDoctor(cwd) ?? (await probeAll(adapters));
-        const pools = rolePools(cfg, adapters, health);
-        judgeChannels = pools.judge;
-        channels = pools.review;
-        if (values.author && values.author !== "human") {
-            const [adapter, ...rest] = values.author.split(":");
-            const model = rest.join(":");
-            const c = channels.find((ch) => ch.adapter === adapter && ch.model === model);
-            if (!c) {
-                throw new Error(`--author ${values.author} does not name a discoverable review channel — one of: ${channels.map(channelKey).join(", ") || "(none)"}`);
-            }
-            author = { adapter: c.adapter, model: c.model, channel: c.channel, tier: c.tier };
-        }
-        else {
-            channels = [...channels, HUMAN_CHANNEL];
-        }
-        if (wantReview && !channels.some((c) => c.vendor !== "human")) {
-            throw new Error("review gate needs at least one authed LLM channel (run `tickmarkr doctor`) — or pass --no-review");
-        }
-    }
     const artifactDir = join(stateDir, new Date().toISOString().replace(/[:.]/g, "-"));
     mkdirSync(artifactDir, { recursive: true });
     const { results } = await runGates(task, {