tickmarkr 1.97.0 → 2.1.0

package/dist/cli/commands/status.js

@@ -1,6 +1,6 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-import { brandChip, dim, fail, GLYPHS, legend, ok, rule, title, warn } from "../../brand.js";
+import { GLYPHS, LIVE } from "../../brand.js";
 import { DEFAULT_CONFIG, loadConfig } from "../../config/config.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
 import { formatOwnedName, parseOwnedName, } from "../../drivers/types.js";
@@ -15,8 +15,42 @@ import { readSupervision, supervisionText } from "../../run/supervision.js";
 import { deriveRunCockpitData, } from "../../tui/cockpit/derive.js";
 import { COCKPIT_COLUMN_FLOOR } from "../../tui/cockpit/layout.js";
 import { cellWidth, fitCells, wrapCells } from "../../tui/cockpit/width.js";
-// ponytail: fixed 2s refresh; promote to config.visibility.* only when an operator asks.
-const REFRESH_MS = 2000;
+import { version } from "./version.js";
+// The board is a LIVE surface, so it draws through brand.ts's operator role map and never the vivid
+// one-shot tokens. Semantic aliases can share a colour, but every board cell, gate mark, effort bar,
+// header and footer styles through one of the five exported authorities.
+const ok = LIVE.pass;
+const running = LIVE.running;
+const information = LIVE.information;
+const fail = LIVE.failure;
+const warn = LIVE.attention;
+const dim = LIVE.secondaryText;
+const title = LIVE.primaryText;
+const legend = LIVE.secondaryText;
+const rule = (columns) => LIVE.chrome("─".repeat(columns));
+// Two clocks, deliberately unequal. The journal frame is cheap — a single file read and a fold — so
+// it redraws on a 500ms cadence and the board feels live. Scraping a worker's pane is neither cheap
+// nor bounded: it crosses the herdr socket and can hang on a wedged pane, so it keeps its own 2s
+// budget and runs OFF the redraw path (see scheduleWorkerScrape). A slow scrape updates liveness
+// one frame late; it never delays a frame, and it never overlaps itself.
+// ponytail: fixed cadences; promote to config.visibility.* only when an operator asks.
+const FRAME_MS = 500;
+const SCRAPE_MS = 2000;
+// The binary's own version, read ONCE when status starts (see `status`), then carried into every
+// frame: a board redrawing twice a second must not pay a manifest read per frame, and the version
+// it names must not change under the operator mid-run. It reads through the SAME manifest reader
+// `tickmarkr version` prints from — one version answer for the whole CLI — and a manifest that
+// cannot be read, cannot be parsed, or names no version PROPAGATES rather than resolving to a
+// placeholder: a board that cannot name its own binary is a broken installation, and the board's
+// whole job is to state what is true. A rendered `vunknown` would be a claim about the binary
+// nobody could check.
+const readBinaryVersion = async () => {
+    const semver = await version();
+    if (typeof semver !== "string" || semver === "") {
+        throw new Error("package.json names no version — reinstall tickmarkr");
+    }
+    return semver;
+};
 // The claim leads, the guidance follows: an incomparable journal is named in three words a wrapped
 // board keeps on one row, and the remedy trails it. Both surfaces state the claim; nothing derived
 // from such a journal — task states, gate outcomes, tip verification — may be presented as this
@@ -368,7 +402,7 @@ const gateSnapshot = (task, events, rehashAt) => {
     };
 };
 export const gateStates = (task, events) => gateSnapshot(task, events).states;
-// verdict semantics only: pass brand green, fail red, skip/open dim chrome — everything else stays quiet
+// Verdict semantics only: pass uses brand teal, failure uses amethyst, and skip/open use chrome.
 const GATE_STATE_TOKEN = { pass: ok, fail, skip: dim, open: dim };
 // TTY cells are bare glyphs in fixed GATE_NAMES order — gate identity lives once in the frame
 // legend, and in words on a failing row; non-TTY keeps the letter+box chips (byte-pinned surface)
@@ -493,6 +527,10 @@ const foldTaskEffort = (tasks, events) => {
     return [...effort.values()].sort((left, right) => right.total - left.total
         || order.get(left.taskId) - order.get(right.taskId));
 };
+// Attention (review) and failure (park) wear the ONE amethyst, so the bar segments and their legend
+// markers carry the distinction in SHAPE: a full block for dispatch, light shade for a review round,
+// dark shade for a human park. Same display width, so the fitted bar keeps its measured columns.
+const EFFORT_GLYPH = { dispatch: "\u2588", review: "\u2592", park: "\u2593" };
 /**
  * Prototype panel, fitted by the cockpit's display-cell authority before board-wide wrapping.
  *
@@ -518,9 +556,9 @@ const effortPanel = (tasks, events, columns) => {
         const dispatchEnd = Math.round((task.dispatches / maxTotal) * barColumns);
         const reviewEnd = Math.round(((task.dispatches + task.reviews) / maxTotal) * barColumns);
         const parkEnd = Math.round((task.total / maxTotal) * barColumns);
-        const stack = ok("█".repeat(dispatchEnd))
-            + warn("█".repeat(Math.max(0, reviewEnd - dispatchEnd)))
-            + fail("█".repeat(Math.max(0, parkEnd - reviewEnd)));
+        const stack = ok(EFFORT_GLYPH.dispatch.repeat(dispatchEnd))
+            + warn(EFFORT_GLYPH.review.repeat(Math.max(0, reviewEnd - dispatchEnd)))
+            + fail(EFFORT_GLYPH.park.repeat(Math.max(0, parkEnd - reviewEnd)));
         return `${prefix}${fitCells(stack, barColumns)}  ${counts}`;
     });
     return [
@@ -529,7 +567,7 @@ const effortPanel = (tasks, events, columns) => {
         "",
         ...rows,
         "",
-        `   ${ok("█")} ${dim("dispatch")}  ${warn("█")} ${dim("review round")}  ${fail("█")} ${dim("human park")}`,
+        `   ${ok(EFFORT_GLYPH.dispatch)} ${dim("dispatch")}  ${warn(EFFORT_GLYPH.review)} ${dim("review round")}  ${fail(EFFORT_GLYPH.park)} ${dim("human park")}`,
     ];
 };
 // VIS-11 (v1.13): a liveness header for renderFrame — last journal event age + whether the recorded
@@ -829,7 +867,10 @@ const recordedTasks = (graph, rows) => graph.tasks.filter((task) => {
         || row.parkKind !== undefined);
 });
 const recordedDone = (tasks, rows) => tasks.filter((task) => graphTaskStatus(rows.get(task.id)?.state, task.status) === "done").length;
-const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness = new Map(), journalRowsOnly = false, namedRunId) => {
+const renderFrame = (cwd, 
+// No default: the version is the binary's, resolved once by its caller, and a frame that had to
+// invent one would be naming a version nobody can check.
+binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(), journalRowsOnly = false, namedRunId) => {
     const g = loadGraph(cwd);
     const record = readRunRecord(cwd, g, namedRunId);
     const runId = record?.runId;
@@ -975,16 +1016,18 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     const tipFailed = tipPhase?.state === "failed";
     const anyFailed = cells.some((cell) => cell.redTier);
     const progressTone = anyFailed || tipFailed ? fail : tipPhase ? warn : ok;
+    // Attention and failure wear the ONE amethyst here too, so the header leads with its own glyph:
+    // ✗ once a verdict is in, ! while the tip is still unverified. Colour cannot carry this.
+    const progressGlyph = anyFailed || tipFailed ? GLYPHS.fail : GLYPHS.attention;
     const tally = tipPhase
-        ? `${progressTone(`${done}/${total} tasks done`)}${dot}${progressTone("run not verified")}`
-        : done === total && total > 0 ? ok(`${done}/${total} done`) : `${done}/${total} done`;
+        ? `${progressTone(`${progressGlyph} ${done}/${total} tasks done`)}${dot}${progressTone("run not verified")}`
+        : done === total && total > 0 ? ok(`${done}/${total} done`) : information(`${done}/${total} done`);
     const live = liveness(events, now)
         .replace(/\bdead\b/u, fail("dead"))
         .replace(/\bfinished\b/u, dim("finished"))
-        .replace(/\balive\b/u, ok("alive"))
+        .replace(/\balive\b/u, running("alive"))
         .replaceAll(" · ", dot);
-    const header = [
-        brandChip(" tickmarkr "),
+    const facts = [
         title(runId ?? "no runs yet"),
         tally,
         ...(events.length ? [`${events.filter((event) => event.event === "run-resume").length} restarts`] : []),
@@ -993,10 +1036,34 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
         ...(runId && !comparable ? [warn(NOT_COMPARABLE_NOTICE)] : []),
         ...(verify === undefined
             ? []
-            : [verify === "verify passed" ? ok(verify) : tipFailed ? fail(verify) : warn(verify)]),
+            : [verify === "verify passed"
+                    ? ok(verify)
+                    : tipFailed ? fail(`${GLYPHS.fail} ${verify}`) : warn(`${GLYPHS.attention} ${verify}`)]),
         ...(runId ? [live] : []),
         ...(journalRowsOnly ? [`zone ${localZoneLabel(zoneReference)}`] : []),
     ].join(separator);
+    // The brand lockup is two rows and stays two rows at every width: the muted chip, and the running
+    // binary's version directly beneath it. The run's own facts continue to the right of both rows and
+    // wrap under themselves — the version can never be pushed off its row by a fact that grew, which
+    // is the whole point of wrapping the facts against their own column rather than the board's.
+    const chipText = " tickmarkr ";
+    const versionText = ` v${binaryVersion}`;
+    const chipCells = cellWidth(chipText);
+    const versionCells = cellWidth(versionText);
+    const lockupCells = Math.max(chipCells, versionCells);
+    const lockupGap = "  ";
+    const lockupGapCells = cellWidth(lockupGap);
+    const factColumns = Math.max(1, boardColumns - lockupCells - lockupGapCells);
+    // No continuation prefix: the lockup gutter below already indents every fact row, so the fact
+    // column starts at the same cell on all of them.
+    const factLines = wrapCells(facts, factColumns);
+    const besideLockup = (lead, factLine) => factLine === undefined ? lead : `${lead}${lockupGap}${factLine}`;
+    const fillLockup = (lead, cells) => `${lead}${" ".repeat(lockupCells - cells)}`;
+    const headerRows = [
+        besideLockup(fillLockup(LIVE.chip(chipText), chipCells), factLines[0]),
+        besideLockup(fillLockup(dim(versionText), versionCells), factLines[1]),
+        ...factLines.slice(2).map((line) => `${" ".repeat(lockupCells + lockupGapCells)}${line}`),
+    ];
     const nowLine = activity.now ? [legend(`   now: ${activity.now}`)] : [];
     const supervisionLegend = legend(`   ${supervisionText(supervision)}`);
     const taskSectionSummary = `${done} of ${total} merged · rows in graph order · gates left→right in pipeline order`;
@@ -1018,7 +1085,15 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
         return [
             livePhase ? `${SPINNER[animationFrame % SPINNER.length]} ${phrase ?? "running"}` : "",
             !livePhase && isStarved ? "starved" : "",
-            !livePhase && !isStarved && !merged ? redTier ? "failed" : phrase ?? (st === "failed" ? "warn" : surfaceStatusWord(st)) : "",
+            // Attention and failure wear the ONE amethyst, so the tier word leads with its own glyph —
+            // ! for warn, ✗ for failed. That is the distinction that survives NO_COLOR and a pipe.
+            !livePhase && !isStarved && !merged
+                ? redTier
+                    ? `${GLYPHS.fail} failed`
+                    : st === "failed" || st === "human"
+                        ? `${GLYPHS.attention} ${phrase ?? (st === "failed" ? "warn" : surfaceStatusWord(st))}`
+                        : phrase ?? surfaceStatusWord(st)
+                : "",
             redTier && phrase ? phrase : "",
             priorGraph ? PRIOR_GRAPH_MARKER : "",
             failed.length ? `failed · ${failed.join(", ")}` : "",
@@ -1048,7 +1123,15 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
             return cells.flatMap((cell) => {
                 const effort = effortByTask.get(cell.t.id);
                 const deps = cell.t.deps.length ? cell.t.deps.join(", ") : "—";
-                const tone = cell.redTier ? fail : cell.merged ? ok : staleWorker(cell) || cell.st === "failed" || cell.st === "human" ? warn : dim;
+                const tone = cell.redTier
+                    ? fail
+                    : cell.merged
+                        ? ok
+                        : staleWorker(cell) || cell.st === "failed" || cell.st === "human"
+                            ? warn
+                            : cell.livePhase || cell.st === "running"
+                                ? running
+                                : dim;
                 const machinery = [
                     `deps ${deps}`,
                     gateMatrix(cell.states),
@@ -1078,7 +1161,15 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
                 wrapCells(noteFor(cell), noteWidth),
             ];
             const height = Math.max(...columns.map((column) => column.length));
-            const idTone = cell.redTier ? fail : cell.merged ? ok : staleWorker(cell) || cell.st === "failed" || cell.st === "human" ? warn : dim;
+            const idTone = cell.redTier
+                ? fail
+                : cell.merged
+                    ? ok
+                    : staleWorker(cell) || cell.st === "failed" || cell.st === "human"
+                        ? warn
+                        : cell.livePhase || cell.st === "running"
+                            ? running
+                            : dim;
             const titleTone = cell.redTier || cell.livePhase || (effort?.parks ?? 0) >= 3 ? title : dim;
             return Array.from({ length: height }, (_, index) => `    ${idTone(fitColumn(columns[0][index] ?? "", idWidth, 1))}`
                 + dim(fitColumn(columns[1][index] ?? "", areaWidth))
@@ -1096,7 +1187,7 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     const effort = effortPanel(g.tasks, record && !comparable ? undefined : events, boardColumns);
     return {
         content: boardRows([
-            header,
+            ...headerRows,
             ...nowLine,
             supervisionLegend,
             "",
@@ -1142,10 +1233,12 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
     const namedRunId = positionalRunId(argv);
     if (argv.includes("--oneline"))
         return oneLine(cwd, namedRunId);
-    // The task-table frame owns its compact one-line brand chip; the four-row global banner would
+    // ONE manifest read per invocation, here — every frame below names this same version.
+    const binaryVersion = await readBinaryVersion();
+    // The task-table frame owns its own two-row brand lockup; the four-row global banner would
     // create the second header the approved replacement removes.
     if (!argv.includes("--watch")) {
-        return renderFrame(cwd, opts.now?.() ?? Date.now(), 0, undefined, false, namedRunId).content;
+        return renderFrame(cwd, binaryVersion, opts.now?.() ?? Date.now(), 0, undefined, false, namedRunId).content;
     }
     const eventStream = argv.some((arg) => arg === "--events" || arg === "--jsonl" || arg === "--decision-events");
     const webhookUrl = opts.webhookUrl
@@ -1173,14 +1266,21 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
             }
         }
         : undefined);
-    const observeWorkerOutput = async (active, runId, observedAt) => {
+    // Retiring a task that is no longer running is bookkeeping over data already in hand, so it stays
+    // on the frame path where the board can rely on it every redraw.
+    const retireInactiveWorkers = (active) => {
         const activeIds = new Set(active.map((phase) => phase.taskId));
         for (const taskId of workerLiveness.keys())
             if (!activeIds.has(taskId))
                 workerLiveness.delete(taskId);
+    };
+    const scrapeWorkerOutput = async (active, runId, observedAt) => {
         if (!readWorkerOutput || !runId)
             return;
-        await Promise.all(active.map(async (phase) => {
+        // allSettled, never all: Promise.all resolves the moment ONE pane read rejects, which would
+        // clear the single-flight guard while a sibling read is still hung on its socket and let the
+        // next budget start a second, overlapping scrape. Every read must settle before the guard drops.
+        await Promise.allSettled(active.map(async (phase) => {
             const output = await readWorkerOutput(phase.taskId, phase.attempt, runId);
             if (output === undefined)
                 return;
@@ -1203,6 +1303,21 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
             prior.snapshot = snapshot;
         }));
     };
+    // The scrape's own clock, and the reason a hung pane cannot freeze the board: it is STARTED here
+    // and never awaited, so the frame loop walks straight past it. `scrapeInFlight` is what keeps a
+    // scrape that outlives its budget from being joined by a second one — a wedged pane read would
+    // otherwise accumulate one outstanding socket read per elapsed budget for as long as it hangs.
+    let scrapeInFlight = false;
+    let lastScrapeAt = Number.NEGATIVE_INFINITY;
+    const scheduleWorkerScrape = (frame, observedAt) => {
+        if (scrapeInFlight || observedAt - lastScrapeAt < SCRAPE_MS)
+            return;
+        scrapeInFlight = true;
+        lastScrapeAt = observedAt;
+        void scrapeWorkerOutput(frame.workerPhases, frame.runId, observedAt)
+            .catch(() => undefined)
+            .finally(() => { scrapeInFlight = false; });
+    };
     let decisionRunId;
     let journalCursor = 0;
     const consumeDecisionEvents = () => {
@@ -1265,10 +1380,10 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
                 }
             }
             else {
-                frame = renderFrame(cwd, nowMs, i, workerLiveness, true, namedRunId);
+                frame = renderFrame(cwd, binaryVersion, nowMs, i, workerLiveness, true, namedRunId);
                 if (tty) {
                     updateTitle(frame.hotPhase, nowMs);
-                    process.stdout.write(`\x1b[2J\x1b[H${frame.content}\n${legend(` watching · refresh ${REFRESH_MS / 1000}s · ^C to quit`)}`);
+                    process.stdout.write(`\x1b[2J\x1b[H${frame.content}\n${legend(` watching · refresh ${FRAME_MS / 1000}s · ^C to quit`)}`);
                 }
                 else {
                     process.stdout.write(frame.content + sep);
@@ -1277,9 +1392,11 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
                     frames.push(frame.content);
             }
             if (i + 1 < iterations) {
-                if (frame)
-                    await observeWorkerOutput(frame.workerPhases, frame.runId, nowMs);
-                await sleep(REFRESH_MS);
+                if (frame) {
+                    retireInactiveWorkers(frame.workerPhases);
+                    scheduleWorkerScrape(frame, nowMs);
+                }
+                await sleep(FRAME_MS);
             }
         }
     }

package/dist/cli/index.d.ts

@@ -5,7 +5,7 @@ export type CommandResult = string | {
 };
 export type CommandMap = Record<string, (argv: string[]) => Promise<CommandResult>>;
 export declare const COMMANDS: CommandMap;
-export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> draft a compiled native spec beside an answered intent (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          run checked-in fixtures against every channel in isolated temp repos\n  run           execute the graph (--concurrency N --driver herdr|subprocess --route-strict)\n  status        live run state\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 no daemon, one verdict (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md for committable execution record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open the Fleet Studio TUI (full-screen tabbed cockpit)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   record one supervision beat for orchestrator|overseer|watch (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume";
+export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> draft a compiled native spec beside an answered intent (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          run checked-in fixtures against every channel in isolated temp repos\n  run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)\n  status        live run state\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 no daemon, one verdict (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md for committable execution record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open the Fleet Studio TUI (full-screen tabbed cockpit)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   record one supervision beat for orchestrator|overseer|watch (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume";
 export declare function dispatch(cmd: string | undefined, argv: string[], commands?: CommandMap): Promise<{
     out: string;
     code: number;

package/dist/cli/index.js

@@ -35,7 +35,7 @@ usage: tickmarkr <command>
   scope <intent> draft a compiled native spec beside an answered intent (--force to overwrite)
   plan          dry-run routing table + cost estimate + floor lints
   eval          run checked-in fixtures against every channel in isolated temp repos
-  run           execute the graph (--concurrency N --driver herdr|subprocess --route-strict)
+  run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)
   status        live run state
   verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD — no daemon, one verdict (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])
   resume <id>   continue a run from its journal

package/dist/compile/collateral.d.ts

@@ -1,5 +1,30 @@
 import { type TickmarkrConfig } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
+/**
+ * OBS-547: the FULL per-task collateral prediction, uncapped. ONE map is computed per run (daemon.ts,
+ * at run start) and handed whole to the scope gate, so a hit the plan display hides is still there
+ * when the gate asks about it. The lint lines below are a capped VIEW of this same map — never a
+ * second scan. Tasks with no hits are absent.
+ */
+export declare function collateralHits(tasks: ReadonlyArray<Pick<Task, "id" | "files">>, repoRoot: string): Map<string, string[]>;
+/** The verbatim repair an authoring defect owes: the files[] lines the spec is missing. */
+export declare function filesRepair(taskId: string, paths: ReadonlyArray<string>): string;
+export interface ScopeCollateralVerdict {
+    /** every hard offender was predicted ⇒ authoring defect, repair pre-written, no attempt charged */
+    authoring: boolean;
+    /** the offenders the map had already named */
+    predicted: string[];
+    /** the offenders it had not — the lint's blind spots, recorded as evidence rather than folklore */
+    missed: string[];
+    repair: string;
+}
+/**
+ * OBS-547: cross-reference at the RED. The gate supplies specificity (the paths actually touched),
+ * the prediction supplies classification — so there are no false positives to fear and no refusal to
+ * author. Feed this the FULL map for the task: a classifier bounded by the display cap calls a
+ * predicted 21st hit a quality failure.
+ */
+export declare function classifyScopeOffenders(taskId: string, hard: ReadonlyArray<string>, predicted: ReadonlyArray<string>): ScopeCollateralVerdict;
 /**
  * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
  * Each line names the task id and at least one missing collateral test path.

package/dist/compile/collateral.js

@@ -3,8 +3,12 @@ import { extname, join, relative } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import { criticalPathHits, DEFAULT_CONFIG, DEFAULT_REVIEW_CRITICAL_PATHS, effectiveReviewPolicy, loadConfig, } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
-// Advisory plan-time scan only (OBS-12/13/14/21, OBS-76). NEVER expands files[], fails compile,
-// or feeds the scope gate — a warning the author acts on. Plain-text (no AST), capped + sorted.
+// Advisory scan (OBS-12/13/14/21, OBS-76). NEVER expands files[] or fails compile — a warning the
+// author acts on. Plain-text (no AST), capped + sorted for DISPLAY only.
+// OBS-547: the collateral prediction is no longer plan-time-only. The daemon computes one full
+// (uncapped) map per run and hands each task's slice to its scope gate, which classifies a red
+// against it — the prediction never causes a refusal, it only says whether a red the gate already
+// found was foreseeable (authoring defect) or not (chargeable quality failure).
 /** Max files walked per root (sorted walk; rest ignored). */
 const MAX_WALK_FILES = 400;
 /** Max collateral test paths listed per task. */
@@ -95,15 +99,17 @@ function makeReader(repoRoot) {
     };
 }
 /**
- * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
- * Each line names the task id and at least one missing collateral test path.
+ * OBS-547: the FULL per-task collateral prediction, uncapped. ONE map is computed per run (daemon.ts,
+ * at run start) and handed whole to the scope gate, so a hit the plan display hides is still there
+ * when the gate asks about it. The lint lines below are a capped VIEW of this same map — never a
+ * second scan. Tasks with no hits are absent.
  */
-export function collateralLints(tasks, repoRoot) {
+export function collateralHits(tasks, repoRoot) {
+    const map = new Map();
     const testFiles = walkCode(repoRoot, "tests");
     if (!testFiles.length)
-        return [];
+        return map;
     const read = makeReader(repoRoot);
-    const lines = [];
     for (const t of tasks) {
         // OBS-22: scopeGate accepts picomatch globs; advisory collateral warnings must agree.
         const scoped = filesGlob(t.files.map((f) => f.replace(/^\.\//, "")));
@@ -122,14 +128,43 @@ export function collateralLints(tasks, repoRoot) {
             if (mentions(text, needles))
                 hits.push(tf);
         }
-        if (!hits.length)
-            continue;
         // deterministic: walk already sorted; stable list
+        if (hits.length)
+            map.set(t.id, hits);
+    }
+    return map;
+}
+/** The verbatim repair an authoring defect owes: the files[] lines the spec is missing. */
+export function filesRepair(taskId, paths) {
+    return paths.map((p) => `add ${p} to ${taskId}.files[]`).join("\n");
+}
+/**
+ * OBS-547: cross-reference at the RED. The gate supplies specificity (the paths actually touched),
+ * the prediction supplies classification — so there are no false positives to fear and no refusal to
+ * author. Feed this the FULL map for the task: a classifier bounded by the display cap calls a
+ * predicted 21st hit a quality failure.
+ */
+export function classifyScopeOffenders(taskId, hard, predicted) {
+    const named = new Set(predicted);
+    const hit = hard.filter((f) => named.has(f));
+    const missed = hard.filter((f) => !named.has(f));
+    return { authoring: hard.length > 0 && missed.length === 0, predicted: hit, missed, repair: filesRepair(taskId, hit) };
+}
+/**
+ * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
+ * Each line names the task id and at least one missing collateral test path.
+ */
+export function collateralLints(tasks, repoRoot) {
+    const lines = [];
+    for (const [id, hits] of collateralHits(tasks, repoRoot)) {
         const listed = hits.slice(0, MAX_HITS_PER_TASK).join(", ");
+        // OBS-547: the cap hides names, never predictions. Say so, and say where the hidden ones surface —
+        // a count with no route is exactly what left one run's victim unreadable.
         const tail = hits.length > MAX_HITS_PER_TASK
-            ? ` (${hits.length} total; capped at ${MAX_HITS_PER_TASK} shown)`
+            ? ` (${hits.length} total; ${MAX_HITS_PER_TASK} shown, ${hits.length - MAX_HITS_PER_TASK} capped out of view`
+                + ` but RETAINED for the scope gate — a matching scope red prints the hidden path with its files[] repair)`
             : "";
-        lines.push(`${t.id}: likely collateral tests not in files[]: ${listed}${tail}`);
+        lines.push(`${id}: likely collateral tests not in files[]: ${listed}${tail}`);
     }
     return lines;
 }

package/dist/compile/native.js

@@ -728,6 +728,16 @@ acceptance is required on every task (a nested list of observable outcomes).
     - Enumerating one axis exhaustively is what hides the others. A spec that guards PARTIAL coverage
       site-by-site, member-by-member, can be defeated wholesale by CONDITIONAL coverage, which leaves
       every enumeration satisfied. After you enumerate, ask what a single flag would do to the whole set.
+    - EVERY CRITERION NAMES THE PAIR IT DISCRIMINATES: the correct case that MUST PASS, and the
+      neighbouring plausible-wrong or false-clean case that MUST FAIL. Two easy examples that both pass are
+      not discrimination — they are two ways of being green, and the wrong half is the whole point: it is
+      what a reader would mistake for the mechanism, its VOCABULARY without its behaviour. Measured three
+      times in three days, each a criterion that pinned vocabulary instead of the discriminating case: a
+      suite that pinned an alarm's text while the alarm itself went unpinned; an export asserted SOMEWHERE,
+      which says nothing about the environment a process actually receives; and a gate green on "infra is
+      what execution says" while a signalled oracle still charged an attempt. Each was satisfied exactly as
+      written and each shipped the defect. If you cannot name the case that must FAIL, you have named a
+      topic, not a criterion — and the "so X fails" clause that ends a good criterion is where it goes.
     - A criterion that names a behaviour must name the VALUE AT WHICH IT WOULD BREAK. Every criterion is a
       claim about a variable — a status, a width, a count, an arrival time — and if it does not say which
       value of that variable is the hard one, THE TEST WILL CHOOSE THE EASY ONE AND BE GREEN. Measured: a

package/dist/config/config.d.ts

@@ -138,6 +138,7 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
         auto: "auto";
         herdr: "herdr";
         subprocess: "subprocess";
+        orca: "orca";
     }>;
     integrationBranchPrefix: z.ZodString;
     taskTimeoutMinutes: z.ZodNumber;

package/dist/config/config.js

@@ -266,7 +266,7 @@ const ShapeGateParticipationSchema = z
 });
 export const TickmarkrConfigSchema = z.object({
     concurrency: z.number().int().positive(),
-    driver: z.enum(["auto", "herdr", "subprocess"]),
+    driver: z.enum(["auto", "herdr", "subprocess", "orca"]),
     integrationBranchPrefix: z
         .string()
         .regex(/^[A-Za-z0-9][A-Za-z0-9._/-]*$/, "must be branch-safe (letters/digits/._/-, no spaces or shell metacharacters)")
@@ -713,7 +713,7 @@ export function overlayBytesLoadError(repoRoot, bytes, opts = {}) {
 export function configTemplate(overlay) {
     const base = `# tickmarkr config overlay — merges over built-in defaults (repo beats global beats defaults)
 # concurrency: 3
-# driver: auto            # auto | herdr | subprocess
+# driver: auto            # auto | herdr | subprocess | orca
 # taskTimeoutMinutes: 30
 # contextWarnTokens: 170000   # v1.23: journal+notify once per attempt when live worker context crosses this (status shows the sample)
 # setup: npm ci --prefer-offline   # run in each fresh task worktree before dispatch

package/dist/drivers/herdr.d.ts

@@ -1,3 +1,4 @@
+import { type JournalEvent } from "../run/journal.js";
 import { type ExecutorDriver, type NotifyOpts, type Slot, type SlotOpts } from "./types.js";
 export declare const TRAILER_SAFE_FLOOR_COLS = 108;
 export declare const TRAILER_WIDTH_MARGIN = 2;
@@ -22,20 +23,20 @@ export declare class DeliveryCorruptedError extends Error {
 export type DriverJournal = (event: string, slotName: string, data: Record<string, unknown>) => void;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export declare function workerSplitDirection(paneCols: number | null, safeFloor?: number, margin?: number): "right" | "down";
-export declare const BOARD_TARGET_COLS = 110;
-export declare const BOARD_SEAT_FLOOR_COLS = 40;
-export interface BoardSplitPlan {
-    direction: "right" | "down";
-    /** herdr's split ratio is the FIRST child's share and a right split's first child is the caller,
-     *  so this is what the SEAT keeps. Absent on `down` — the board then takes the full width. */
-    ratio?: number;
-    /** Columns the board gets under this plan; null when it takes the caller's whole width. */
-    boardCols: number | null;
+export declare const BOARD_HEIGHT_SHARE = 0.72;
+export interface BoardPlacement {
+    /** Always down: the split is vertical, so the board can own the caller's FULL width. */
+    direction: "down";
+    /** herdr's split ratio is the FIRST child's share, and a down split's first child is the TOP
+     *  region — the region the board occupies once it is swapped above the caller. */
+    ratio: number;
+    /** The new pane is swapped ABOVE the caller; the split alone would leave the board underneath. */
+    swap: "above";
 }
-/** Board-first placement beside the supervising seat: right only while the caller can fund the board
- *  its target AND leave the seat its floor; otherwise down at full width, never a squeezed board.
- *  An unmeasurable caller falls back to down like every other placement here (fail closed). */
-export declare function boardSplitPlan(callerCols: number | null, boardCols?: number, seatFloor?: number): BoardSplitPlan;
+/** The single approved vertical-stack record. The caller's columns are accepted and deliberately
+ *  ignored: this signature is where width used to decide the arrangement, and the parameter stays
+ *  so that "the plan does not depend on it" is a property a caller (and a test) can exercise. */
+export declare function boardSplitPlan(_callerCols?: number | null): BoardPlacement;
 export declare function taskGroupOf(name: string): string | undefined;
 /** The operator-facing TITLE for a tab this driver creates when no stage label is supplied: a task
  *  token for a worker (`T5`, `T5↻2` on a retry) and ROLE + task for a gate pane (`REVIEW T5`) — the
@@ -63,11 +64,14 @@ export declare class HerdrDriver implements ExecutorDriver {
     private inputBoxes;
     private bootstraps;
     private journalRoots;
+    private narrate?;
     private ws;
     private callerPane;
     private watches;
     constructor(bin?: string, workersPerTab?: number, time?: HerdrTimeSource, journal?: DriverJournal | undefined);
     private appendDispatchRetry;
+    /** v1.99 T2: bind this driver's own journal writes to the run's live narration sink. */
+    narrateWith(narrate: (event: JournalEvent) => void): void;
     private serial;
     private deliveryQueue;
     private reserveDispatch;
@@ -77,6 +81,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     static available(): boolean;
     private herdr;
     private namedPaneId;
+    private paneStillOpen;
     private paneId;
     private paneWidth;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
@@ -116,6 +121,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     private closeGrouped;
     private ownedWatchPanes;
     private watchSlot;
+    private discardSplit;
     narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
     reconcile(desired: Set<string>, runId: string, opts?: {
         spareLiveLlm?: boolean;