tickmarkr 2.1.5 → 2.1.7

package/dist/compile/ownership.js

@@ -0,0 +1,142 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { basename, extname, join } from "node:path";
+import { filesGlob } from "../graph/files-glob.js";
+import { collateralHits } from "./collateral.js";
+const normalize = (path) => path.replace(/^\.\//, "").split("\\").join("/");
+function testSources(repoRoot) {
+    const root = join(repoRoot, "tests");
+    try {
+        return readdirSync(root, { recursive: true, encoding: "utf8" })
+            .filter((path) => path.endsWith(".test.ts"))
+            .sort()
+            .flatMap((path) => {
+            try {
+                return [{ path: `tests/${normalize(path)}`, text: readFileSync(join(root, path), "utf8") }];
+            }
+            catch {
+                return [];
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+// Conventional, not universal: status-watch-alive.test.ts is dedicated to status.ts even though it
+// reaches that command through the CLI entry point. Keep this heuristic advisory until authored-graph
+// measurements establish its false-positive rate.
+function namedSourceTasks(test, tasks) {
+    const stem = basename(test).replace(/\.test\.ts$/, "");
+    const ids = new Set();
+    for (const task of tasks) {
+        for (const entry of task.files.map(normalize).filter((path) => path.startsWith("src/") && !/[*?{[]/.test(path))) {
+            const source = basename(entry, extname(entry));
+            if (stem === source || stem.startsWith(`${source}-`))
+                ids.add(task.id);
+        }
+    }
+    return [...ids];
+}
+function repositoryPaths(text) {
+    const paths = new Set();
+    for (const match of text.matchAll(/["'`]((?:src|tests|fixtures|scripts|skills|docs|\.claude)\/[^"'`\s]+)["'`]/g)) {
+        paths.add(normalize(match[1]));
+    }
+    return [...paths].sort();
+}
+function dependencyOrdered(a, b, byId) {
+    const reaches = (from, target) => {
+        const seen = new Set();
+        const pending = [...from.deps];
+        while (pending.length > 0) {
+            const id = pending.pop();
+            if (id === target)
+                return true;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            pending.push(...(byId.get(id)?.deps ?? []));
+        }
+        return false;
+    };
+    return reaches(a, b.id) || reaches(b, a.id);
+}
+/**
+ * Advisory cross-task ownership check. Findings are data: callers may report them, but this checker
+ * never throws and never changes the graph.
+ */
+export function ownershipFindings(tasks, repoRoot) {
+    const sources = testSources(repoRoot);
+    const byId = new Map(tasks.map((task) => [task.id, task]));
+    const indexed = tasks.map((task) => {
+        const files = task.files.map(normalize);
+        const context = task.context.map(normalize);
+        return {
+            task,
+            owns: files.length === 0 ? () => false : filesGlob(files),
+            allows: files.length === 0 ? () => true : filesGlob([...files, ...context]),
+        };
+    });
+    const owners = (path) => indexed.filter(({ owns }) => owns(path));
+    const predictedBy = new Map();
+    for (const [taskId, hits] of collateralHits(tasks, repoRoot)) {
+        for (const hit of hits) {
+            const ids = predictedBy.get(hit) ?? new Set();
+            ids.add(taskId);
+            predictedBy.set(hit, ids);
+        }
+    }
+    for (const source of sources) {
+        const ids = predictedBy.get(source.path) ?? new Set();
+        for (const taskId of namedSourceTasks(source.path, tasks))
+            ids.add(taskId);
+        if (ids.size > 0)
+            predictedBy.set(source.path, ids);
+    }
+    const findings = [];
+    for (const [test, taskIds] of predictedBy) {
+        if (owners(test).length === 0) {
+            const ids = [...taskIds].sort();
+            findings.push({
+                code: "unowned-test",
+                test,
+                taskIds: ids,
+                detail: `${test} is a dedicated test of source owned by ${ids.join(", ")} but no task owns the test`,
+            });
+        }
+    }
+    for (const source of sources) {
+        for (const owner of owners(source.path)) {
+            for (const path of repositoryPaths(source.text)) {
+                if (!owner.allows(path)) {
+                    findings.push({
+                        code: "test-path-outside-allowlist",
+                        taskId: owner.task.id,
+                        test: source.path,
+                        path,
+                        detail: `${source.path} owned by ${owner.task.id} references ${path} outside that task's files[] and context[]`,
+                    });
+                }
+            }
+        }
+    }
+    for (const reader of indexed) {
+        for (const entry of reader.task.context.map(normalize)) {
+            for (const owner of owners(entry)) {
+                if (owner.task.id === reader.task.id || dependencyOrdered(reader.task, owner.task, byId))
+                    continue;
+                findings.push({
+                    code: "unordered-context-write",
+                    taskId: reader.task.id,
+                    ownerTaskId: owner.task.id,
+                    path: entry,
+                    detail: `${reader.task.id} names ${entry} as context while ${owner.task.id} owns it for writing, with no dependency order between them`,
+                });
+            }
+        }
+    }
+    return findings.sort((a, b) => `${a.code}:${"test" in a ? a.test : a.path}:${"taskId" in a ? a.taskId : ""}`.localeCompare(`${b.code}:${"test" in b ? b.test : b.path}:${"taskId" in b ? b.taskId : ""}`));
+}
+export function renderOwnershipFinding(finding) {
+    return `tickmarkr: ownership-lint[${finding.code}]: ${finding.detail}`;
+}

package/dist/drivers/herdr.d.ts

@@ -125,6 +125,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
     reconcile(desired: Set<string>, runId: string, opts?: {
         spareLiveLlm?: boolean;
+        endedRunIds?: Set<string>;
     }): Promise<void>;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;
 }

package/dist/drivers/herdr.js

@@ -1188,12 +1188,13 @@ export class HerdrDriver {
             return s;
         });
     }
-    // OBS-17 T2 / v1.22b T1: close every tickmarkr-owned pane that should not exist (superseded attempts,
-    // killed-daemon orphans, leftovers from OLDER runs) — in this run's workspace OR misplaced in any
-    // other one — then reap the tabs those closes emptied. Ownership is decided ONLY by parseOwnedName
-    // (drivers/types.ts panesToClose) — foreign names never become candidates, in any workspace; a pane
-    // this same run legitimately holds elsewhere is left alone (only run age marks a misplaced pane
-    // garbage). spareLiveLlm: same-run judge/review/consult panes have no journal row while live (their
+    // OBS-17 T2 / v1.22b T1: close THIS RUN'S OWN tickmarkr-owned panes that should not exist
+    // (superseded attempts, killed-daemon orphans of this run), in this run's workspace, then reap the
+    // tabs those closes emptied. Ownership is decided ONLY by parseOwnedName (drivers/types.ts
+    // panesToClose) — foreign names never become candidates. OBS-769/OBS-772/OBS-777: the sweep does
+    // NOT reach other workspaces and reaches another runId only when the daemon's repository-scoped
+    // snapshot proves that run ended. Run age is not consulted and never was. spareLiveLlm: same-run
+    // judge/review/consult panes have no journal row while live (their
     // events land after the verdict is read), so mid-run sweeps spare them; boundary sweeps (start/
     // resume/end) run with nothing in flight and take them too. Cosmetic by contract: every failure —
     // herdr gone, pane vanished mid-sweep, unparseable listing — is swallowed; this method never throws.

package/dist/drivers/types.d.ts

@@ -56,6 +56,7 @@ export interface FleetAgent {
 }
 export declare function panesToClose(agents: FleetAgent[], desired: Set<string>, ws: string, runId: string, opts?: {
     spareLiveLlm?: boolean;
+    endedRunIds?: Set<string>;
 }): {
     paneId: string;
     tabId?: string;
@@ -81,5 +82,6 @@ export interface ExecutorDriver {
     narrator?: (cwd: string, command: string, runId?: string) => Promise<Slot>;
     reconcile?: (desired: Set<string>, runId: string, opts?: {
         spareLiveLlm?: boolean;
+        endedRunIds?: Set<string>;
     }) => Promise<void>;
 }

package/dist/drivers/types.js

@@ -21,12 +21,53 @@ export function isForeignName(name) {
     return parseOwnedName(name) === null;
 }
 // v1.22b T1: workspace-aware fold over a fleet snapshot — decides which owned task panes are garbage
-// right now. In-workspace: the existing desired-set/spareLiveLlm sweep (OBS-17 T2). Out-of-workspace:
-// an owned pane from a DIFFERENT run is a misplaced leftover (bug, foreign actor, pre-VIS-10 relic)
-// and closes regardless of `desired`; an owned pane from THIS run elsewhere is left alone — a live
-// run can legitimately hold panes across workspaces, so only run age marks a misplaced pane garbage.
+// right now: the desired-set/spareLiveLlm sweep (OBS-17 T2), scoped to THIS RUN'S OWN panes (by runId,
+// OBS-772) in THIS RUN'S OWN WORKSPACE (OBS-769). Both conditions, and neither alone is the rule.
 // Watch panes are operator-owned after run end and are reclaimed by the next run; foreign names
-// (parseOwnedName fails) are never candidates, in any workspace.
+// (parseOwnedName fails) are never candidates.
+//
+// OBS-769 — WHY THE SWEEP STOPS AT THE WORKSPACE BOUNDARY. It used to close an owned pane carrying
+// any OTHER runId in any other workspace, unconditionally, as a "misplaced leftover". Two tickmarkr
+// runs in two repositories are lawful (the lock forbids two runs in ONE repository, not on one
+// machine) and herdr gives each its own workspace — so that branch made every pair of concurrent
+// runs kill each other's LIVE workers. Measured 2026-08-28: the run in w0 closed run ...2958's
+// panes at 23:42:40.351/.392, and 53s later ...2958's own task-human sweep closed w0's live codex
+// worker at 23:43:34.096. ...2958 ended 0/8. The death detector cannot see it: closing the pane
+// makes paneAbsent, processTree, confirmedProcessTree and worktreeDelta true by ONE cause, and a
+// closed pane can never accrue the CPU that the `cpu-accruing` hold reads.
+// The comment this replaces claimed "only run age marks a misplaced pane garbage" — there was no age
+// check in the code, and age is the wrong predicate anyway: w0's run STARTED EARLIER than ...2958,
+// so an age rule would have licensed exactly the kill that landed. Run age says nothing about
+// liveness, and a sweeping daemon cannot read another repository's run state. The workspace is the
+// only ownership boundary available without cross-repo I/O, so it is the one enforced.
+// Cost, named: an orphan pane from a dead run stranded in a workspace no later run opens is now left
+// for the operator. That is cosmetic (`reconcile` is cosmetic by contract — "visibility is never a
+// gate"), and a cosmetic cleanup must never be able to kill a live worker.
+// OBS-772 — WHY THE runId LINE EXISTS, AND WHY THE WORKSPACE LINE ALONE WAS NOT THE FIX. The first
+// repair was workspace-scoped only, and its own comment dismissed the residue — "two runs sharing one
+// workspace would still sweep each other" — as unreachable, on the reasoning that one workspace per run
+// is herdr's placement. That reasoned from ONE driver to the whole product. OrcaDriver has no workspace
+// dimension at all: orca.ts passes a single ORCA_SPACE as the workspaceId for EVERY checkout and as
+// `ws`, so `workspaceId !== ws` is never true there and every foreign pane fell straight through. Orca
+// users had zero protection while the defect read as fixed. The runId line is the real rule and it is
+// driver-agnostic: reconcile exists to clean up THIS RUN's panes, and a leftover from a dead run is
+// exactly what cannot be told from a live run's pane without liveness data this process does not have.
+// Both lines are kept — the workspace line preserves the pre-existing sparing of this run's own panes
+// in another workspace, which the runId line alone would not.
+// ⚠ WHAT THE runId LINE COST BEFORE OBS-777 — SUSPENDED, NOT NARROWED, and the price was larger than
+// it read. Sparing every other runId suspended OBS-17's FOUNDING use case: "a killed daemon can't
+// close its slots". This sweep was built to reclaim exactly those orphans, but could not reclaim ANY
+// previous run's panes. Three separate pins asserted the old behaviour (reconcile.test.ts,
+// orca-placement.test.ts,
+// reconcile-live.test.ts); all three were changed deliberately, and the third is why this paragraph
+// exists rather than a shorter one — two flipped pins is a trade, three is a pattern.
+// OBS-777 RESTORES that reclamation: the CALLER passes `opts.endedRunIds`, a Set the daemon computes
+// ONCE at run start from this repository's own `run-end` journals and dead lock holders. This fold
+// stays pure — it gains one optional field, not a repo root — a foreign repository's runId is never
+// resolvable and so stays spared by construction, and no driver learns about workspaces.
+// ponytail: two conditions, no geometry reasoning, nothing driver-specific. `reconcile` is cosmetic by
+// contract, and a cosmetic cleanup must never be able to kill a live worker — which is why the
+// ended-run authority is the only safe way to restore the sweep without reviving the cross-run kill.
 export function panesToClose(agents, desired, ws, runId, opts) {
     const out = [];
     for (const a of agents) {
@@ -35,15 +76,14 @@ export function panesToClose(agents, desired, ws, runId, opts) {
         const owned = parseOwnedName(a.name);
         if (!owned || owned.role === "watch")
             continue;
-        if (a.workspaceId === ws) {
-            if (desired.has(a.name))
-                continue;
-            if (opts?.spareLiveLlm && owned.runId === runId && (owned.role === "judge" || owned.role === "review" || owned.role === "consult"))
-                continue;
-        }
-        else if (owned.runId === runId) {
-            continue; // this run's own pane in another workspace — never touched
-        }
+        if (owned.runId !== runId && !opts?.endedRunIds?.has(owned.runId))
+            continue;
+        if (a.workspaceId !== ws)
+            continue; // OBS-769: another workspace is another run's business
+        if (desired.has(a.name))
+            continue;
+        if (opts?.spareLiveLlm && owned.runId === runId && (owned.role === "judge" || owned.role === "review" || owned.role === "consult"))
+            continue;
         out.push({ paneId: a.paneId, tabId: a.tabId });
     }
     return out;

package/dist/gates/baseline.js

@@ -117,7 +117,18 @@ const VOCAB_RE = /\b(?:error|fail(?:ed|ure|ing)?)\b/i;
 // shapes are emitted by the process that was asked to run the oracle; they are deliberately kept in
 // this runner-output classifier rather than applied to any judge-authored reason text. A real test
 // failure still dominates below because one regression-shaped line makes the whole output regression.
-const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable|Token not found in system keyring|Process from config\.webServer was not able to start/i;
+// OBS-791: `[vitest-worker]: Timeout calling "<method>"` is the SAME birpc mechanism one layer up.
+// Vitest's bundled birpc has a fixed 60s DEFAULT_TIMEOUT with no override (fixed upstream only in
+// vitest 4.x), so a suite whose tests all pass can still die at teardown when the worker->host RPC
+// window closes. `.github/workflows/release.yml` has forgiven this exact fingerprint since 2026-08-11
+// while this classifier called it a regression — the product charged a worker for the failure the
+// release gate was written to forgive. The METHOD NAME IS DELIBERATELY NOT PINNED: the timeout is a
+// property of the RPC window, not of `onTaskUpdate`, and pinning one method would forgive a run and
+// charge its sibling for the same infrastructure event. This stays a CLOSED signature — the
+// `[vitest-worker]: ` prefix is vitest's own RPC layer and never user assertion text — and the
+// per-line vetoes below are untouched, so one real failure anywhere still makes the whole output a
+// regression.
+const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable|Token not found in system keyring|Process from config\.webServer was not able to start|\[birpc\] rpc is closed, cannot call\b|\[vitest-worker\]: Timeout calling\b/i;
 // Capture invalidation is deliberately narrower than the gate's infrastructure vocabulary above:
 // keyring/config-webServer startup failures remain gate concerns, while this policy is specifically
 // for evidence that the capture ran while the machine was resource-starved.
@@ -127,6 +138,12 @@ const CAPTURE_EXHAUSTION_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript
 const ERROR_CLASS_RE = /\b[A-Za-z][A-Za-z0-9]*Error\b/;
 const isInfraLine = (l) => INFRA_RE.test(l) && !ERROR_CLASS_RE.test(l) && !namesFailure(l) && !SUMMARY_FAIL_RE.test(l);
 const namesRegression = (l) => (isFailureShaped(l) || ERROR_CLASS_RE.test(l)) && !isInfraLine(l);
+// Infrastructure signatures must enter the fingerprint diff too. Otherwise a signature such as
+// birpc's assertion-free RPC death is classified correctly in the raw output but collapses to the
+// content-free UNRECOGNIZED_FAILURE marker before the fresh-failure path can ask the same classifier.
+// This does not make the vocabulary open-ended: INFRA_RE is still the one closed list, and
+// classifyFailureOutput's ERROR_CLASS_RE/namesFailure vetoes still decide mixed lines.
+const isFingerprintShaped = (l) => isFailureShaped(l) || INFRA_RE.test(l);
 /**
  * What a nonzero runner exit is evidence OF. `undefined` when the output names neither — the
  * unreadable-runner case the existing fail-closed path already owns.
@@ -196,10 +213,10 @@ export function fingerprint(output) {
     // prefixed form keeps fingerprinting too (baseline-recorded package-level reds stay forgivable).
     const shaped = [];
     for (const l of lines) {
-        if (isFailureShaped(l))
+        if (isFingerprintShaped(l))
             shaped.push(l);
         const stripped = stripTurboPrefix(l);
-        if (stripped !== undefined && !PASS_LINE_RE.test(stripped) && isFailureShaped(stripped))
+        if (stripped !== undefined && !PASS_LINE_RE.test(stripped) && isFingerprintShaped(stripped))
             shaped.push(stripped);
     }
     if (!shaped.length)
@@ -544,21 +561,6 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
             continue;
         }
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
-        // T9: classify BEFORE the baseline diff, and record it on every nonzero result. An infra-only
-        // exit means the runner never completed a suite, so there is nothing to forgive and nothing
-        // verified — it fails, and `meta.infra` marks it so the merge predicate cannot read it as a
-        // satisfied gate even if some future producer reports it as a pass. Baseline forgiveness stays
-        // exactly where it belongs: on failures the runner actually reported and the baseline already had.
-        const classification = classifyFailureOutput(raw);
-        if (classification === "infra") {
-            record({
-                gate: name,
-                pass: false,
-                details: `exit ${r.code} on infrastructure alone — the runner never completed a suite, so this gate verified nothing:\n${unrecognizedEvidence(raw) || raw.trim().split("\n").slice(0, 10).join("\n")}`,
-                meta: { classification, infra: true },
-            });
-            continue;
-        }
         // OBS-278: only a failure SHAPE is a verdict — everything fingerprint() keeps is one, except the
         // unrecognized-output marker, which is evidence for the operator and never grounds to reject.
         // ponytail: ceiling — a runner whose failure output holds no shape above and whose baseline is
@@ -567,6 +569,25 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // that runner's position rule (leading verdict + identifier, or identifier + separator + trailing
         // verdict); loosening back to vocabulary re-opens OBS-278.
         const { failing, unreadable } = freshFailures(entry, raw);
+        // T9: classify the FRESH diff before charging it. The complete runner output can legitimately
+        // contain a baseline-recorded assertion beside a newly introduced infrastructure death; letting
+        // that known assertion outvote the fresh birpc line turns machine failure into a worker defect.
+        // `classifyFailureOutput` remains the single discriminator. When there is no fresh fingerprint,
+        // retain the whole-output read so a repeated infra abort can never be baseline-forgiven as green.
+        const freshClassification = failing.length ? classifyFailureOutput(failing.join("\n")) : undefined;
+        const classification = freshClassification ?? (!failing.length ? classifyFailureOutput(raw) : undefined);
+        if (classification === "infra") {
+            const evidence = failing.length
+                ? failing.slice(0, 10).join("\n")
+                : unrecognizedEvidence(raw) || raw.trim().split("\n").slice(0, 10).join("\n");
+            record({
+                gate: name,
+                pass: false,
+                details: `exit ${r.code}; the fresh failures carry infrastructure evidence alone — the runner never completed a suite, so this gate verified nothing:\n${evidence}`,
+                meta: { classification, infra: true },
+            });
+            continue;
+        }
         // OBS-534 (T2): only a recorded VERDICT can be forgiven. A green baseline has no red to forgive,
         // and neither has a capture that was killed at its ceiling — it recorded a cause instead, so it
         // fails closed on the same branch rather than reading as "only pre-existing failures". Legacy