tickmarkr 2.1.8 → 2.2.0

package/dist/drivers/herdr.js

@@ -6,6 +6,7 @@ import { declaredInputBoxForWorkerName, matchesEmptyInputBox, matchesInputBox, m
 import { consumePaneLaunchIntent, PANE_IDENTITY_ENV, paneIdentityLine } from "../brand.js";
 import { createWorktree, sh } from "../run/git.js";
 import { Journal } from "../run/journal.js";
+import { readSupervision } from "../run/supervision.js";
 import { herdrSealShellPrefix } from "./subprocess.js";
 import { canonicalizeLegacyName, formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 // VIS-09 P43-03: adopted safety floor from 43-MEASUREMENT.md (narrowest safe 53 → floor 108).
@@ -194,6 +195,64 @@ export class HerdrDriver {
         // recovery to the file and the pipe while the operator's rail stays silent about it.
         Journal.open(repoRoot, owned.runId, this.narrate).append("dispatch-retry", owned.taskId, data);
     }
+    openRunJournal(runId) {
+        const roots = new Set(this.journalRoots.values());
+        roots.add(process.cwd());
+        for (const repoRoot of roots) {
+            try {
+                return { repoRoot, journal: Journal.open(repoRoot, runId, this.narrate) };
+            }
+            catch {
+                /* try the next known root */
+            }
+        }
+        return undefined;
+    }
+    liveSupervisionSeats(repoRoot) {
+        const seats = new Set();
+        for (const tier of readSupervision(repoRoot)) {
+            if (tier.state === "ARMED" && tier.seat)
+                seats.add(tier.seat);
+        }
+        return seats;
+    }
+    journalReconcile(handle, event, taskId, data) {
+        try {
+            handle?.journal.append(event, taskId, data);
+        }
+        catch {
+            /* reconcile remains cosmetic even when its audit row cannot be written */
+        }
+    }
+    paneReconcileData(pane, label, ownedName, sweeperRunId) {
+        return {
+            paneId: pane.paneId,
+            ...(pane.tabId !== undefined ? { tabId: pane.tabId } : {}),
+            label,
+            ownedName,
+            ownedRunId: ownedName.runId,
+            runId: sweeperRunId,
+            sweeperRunId,
+        };
+    }
+    parsePaneList(handle, runId, stdout, stage) {
+        try {
+            const panes = JSON.parse(stdout).result?.panes;
+            if (!Array.isArray(panes))
+                throw new Error("pane list returned no panes array");
+            return panes;
+        }
+        catch (error) {
+            this.journalReconcile(handle, "pane-reconcile-list-failed", undefined, {
+                runId,
+                sweeperRunId: runId,
+                stage,
+                error: error instanceof Error ? error.message : String(error),
+                stdout,
+            });
+            return null;
+        }
+    }
     /** v1.99 T2: bind this driver's own journal writes to the run's live narration sink. */
     narrateWith(narrate) {
         this.narrate = narrate;
@@ -1199,6 +1258,7 @@ export class HerdrDriver {
     // resume/end) run with nothing in flight and take them too. Cosmetic by contract: every failure —
     // herdr gone, pane vanished mid-sweep, unparseable listing — is swallowed; this method never throws.
     async reconcile(desired, runId, opts) {
+        const journalHandle = this.openRunJournal(runId);
         try {
             if (!this.ws)
                 return;
@@ -1206,25 +1266,96 @@ export class HerdrDriver {
             // panesToClose skips any pane whose label doesn't parse as tickmarkr-owned (orchestrator/operator
             // shells, undetected agents), so a fuller pane listing never widens the blast radius.
             const list = await this.herdr("pane list");
-            const panes = JSON.parse(list.stdout).result?.panes ?? [];
-            const toClose = panesToClose(panes.map((p) => ({ name: p.label, paneId: p.pane_id, tabId: p.tab_id, workspaceId: p.workspace_id })), desired, this.ws, runId, opts);
+            if (list.code !== 0) {
+                this.journalReconcile(journalHandle, "pane-reconcile-list-failed", undefined, {
+                    runId,
+                    sweeperRunId: runId,
+                    stage: "pre-close",
+                    exitCode: list.code,
+                    error: list.stderr || list.stdout || `exit ${list.code}`,
+                });
+                return;
+            }
+            const panes = this.parsePaneList(journalHandle, runId, list.stdout, "pre-close");
+            if (panes === null)
+                return;
+            const liveSeats = journalHandle ? this.liveSupervisionSeats(journalHandle.repoRoot) : new Set();
+            for (const seat of opts?.liveSeats ?? [])
+                liveSeats.add(seat);
+            const toClose = panesToClose(panes.map((p) => ({ name: p.label, paneId: p.pane_id, tabId: p.tab_id, workspaceId: p.workspace_id })), desired, this.ws, runId, { ...opts, liveSeats });
+            const paneById = new Map(panes
+                .filter((p) => typeof p.pane_id === "string")
+                .map((p) => [p.pane_id, p]));
             const touched = new Set();
             for (const c of toClose) {
-                if (typeof c.tabId === "string")
-                    touched.add(c.tabId);
-                await this.herdr(`pane close ${shq(c.paneId)}`); // best-effort — a vanished pane is already reconciled
+                const listed = paneById.get(c.paneId);
+                const label = typeof listed?.label === "string" ? listed.label : "";
+                const ownedName = parseOwnedName(label);
+                if (!ownedName) {
+                    this.journalReconcile(journalHandle, "pane-reconcile-close-failed", undefined, {
+                        paneId: c.paneId,
+                        ...(c.tabId !== undefined ? { tabId: c.tabId } : {}),
+                        label,
+                        runId,
+                        sweeperRunId: runId,
+                        error: "pane selected for reconcile no longer has a parseable owned label",
+                    });
+                    continue;
+                }
+                const data = this.paneReconcileData(c, label, ownedName, runId);
+                const closed = await this.herdr(`pane close ${shq(c.paneId)}`);
+                if (closed.code === 0) {
+                    if (typeof c.tabId === "string")
+                        touched.add(c.tabId);
+                    this.journalReconcile(journalHandle, "pane-reconcile-close", ownedName.taskId, data);
+                }
+                else {
+                    this.journalReconcile(journalHandle, "pane-reconcile-close-failed", ownedName.taskId, {
+                        ...data,
+                        exitCode: closed.code,
+                        error: closed.stderr || closed.stdout || `exit ${closed.code}`,
+                    });
+                }
             }
             if (touched.size === 0)
                 return;
             // a tab our closes emptied was ours by construction (a tab with operator panes still has panes)
             const pl = await this.herdr("pane list");
-            const alive = new Set((JSON.parse(pl.stdout).result?.panes ?? []).map((p) => p.tab_id));
-            for (const tab of touched)
-                if (!alive.has(tab))
-                    await this.herdr(`tab close ${shq(tab)}`);
+            if (pl.code !== 0) {
+                this.journalReconcile(journalHandle, "pane-reconcile-list-failed", undefined, {
+                    runId,
+                    sweeperRunId: runId,
+                    stage: "post-close",
+                    exitCode: pl.code,
+                    error: pl.stderr || pl.stdout || `exit ${pl.code}`,
+                });
+                return;
+            }
+            const alivePanes = this.parsePaneList(journalHandle, runId, pl.stdout, "post-close");
+            if (alivePanes === null)
+                return;
+            const alive = new Set(alivePanes.map((p) => p.tab_id));
+            for (const tab of touched) {
+                if (alive.has(tab))
+                    continue;
+                const closed = await this.herdr(`tab close ${shq(tab)}`);
+                if (closed.code !== 0) {
+                    this.journalReconcile(journalHandle, "tab-reconcile-close-failed", undefined, {
+                        tabId: tab,
+                        runId,
+                        sweeperRunId: runId,
+                        exitCode: closed.code,
+                        error: closed.stderr || closed.stdout || `exit ${closed.code}`,
+                    });
+                }
+            }
         }
-        catch {
-            /* cosmetic — visibility hygiene never fails the run */
+        catch (error) {
+            this.journalReconcile(journalHandle, "pane-reconcile-failed", undefined, {
+                runId,
+                sweeperRunId: runId,
+                error: error instanceof Error ? error.message : String(error),
+            });
         }
     }
     async worktree(repo, branch, baseRef) {

package/dist/drivers/types.d.ts

@@ -54,10 +54,12 @@ export interface FleetAgent {
     tabId?: string;
     workspaceId?: string;
 }
-export declare function panesToClose(agents: FleetAgent[], desired: Set<string>, ws: string, runId: string, opts?: {
+export interface PanesToCloseOpts {
     spareLiveLlm?: boolean;
     endedRunIds?: Set<string>;
-}): {
+    liveSeats?: Set<string>;
+}
+export declare function panesToClose(agents: FleetAgent[], desired: Set<string>, ws: string, runId: string, opts?: PanesToCloseOpts): {
     paneId: string;
     tabId?: string;
 }[];
@@ -80,8 +82,5 @@ export interface ExecutorDriver {
     narrateWith?(narrate: (event: JournalEvent) => void): void;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;
     narrator?: (cwd: string, command: string, runId?: string) => Promise<Slot>;
-    reconcile?: (desired: Set<string>, runId: string, opts?: {
-        spareLiveLlm?: boolean;
-        endedRunIds?: Set<string>;
-    }) => Promise<void>;
+    reconcile?: (desired: Set<string>, runId: string, opts?: PanesToCloseOpts) => Promise<void>;
 }

package/dist/drivers/types.js

@@ -20,54 +20,6 @@ export function parseOwnedName(name) {
 export function isForeignName(name) {
     return parseOwnedName(name) === null;
 }
-// v1.22b T1: workspace-aware fold over a fleet snapshot — decides which owned task panes are garbage
-// right now: the desired-set/spareLiveLlm sweep (OBS-17 T2), scoped to THIS RUN'S OWN panes (by runId,
-// OBS-772) in THIS RUN'S OWN WORKSPACE (OBS-769). Both conditions, and neither alone is the rule.
-// Watch panes are operator-owned after run end and are reclaimed by the next run; foreign names
-// (parseOwnedName fails) are never candidates.
-//
-// OBS-769 — WHY THE SWEEP STOPS AT THE WORKSPACE BOUNDARY. It used to close an owned pane carrying
-// any OTHER runId in any other workspace, unconditionally, as a "misplaced leftover". Two tickmarkr
-// runs in two repositories are lawful (the lock forbids two runs in ONE repository, not on one
-// machine) and herdr gives each its own workspace — so that branch made every pair of concurrent
-// runs kill each other's LIVE workers. Measured 2026-08-28: the run in w0 closed run ...2958's
-// panes at 23:42:40.351/.392, and 53s later ...2958's own task-human sweep closed w0's live codex
-// worker at 23:43:34.096. ...2958 ended 0/8. The death detector cannot see it: closing the pane
-// makes paneAbsent, processTree, confirmedProcessTree and worktreeDelta true by ONE cause, and a
-// closed pane can never accrue the CPU that the `cpu-accruing` hold reads.
-// The comment this replaces claimed "only run age marks a misplaced pane garbage" — there was no age
-// check in the code, and age is the wrong predicate anyway: w0's run STARTED EARLIER than ...2958,
-// so an age rule would have licensed exactly the kill that landed. Run age says nothing about
-// liveness, and a sweeping daemon cannot read another repository's run state. The workspace is the
-// only ownership boundary available without cross-repo I/O, so it is the one enforced.
-// Cost, named: an orphan pane from a dead run stranded in a workspace no later run opens is now left
-// for the operator. That is cosmetic (`reconcile` is cosmetic by contract — "visibility is never a
-// gate"), and a cosmetic cleanup must never be able to kill a live worker.
-// OBS-772 — WHY THE runId LINE EXISTS, AND WHY THE WORKSPACE LINE ALONE WAS NOT THE FIX. The first
-// repair was workspace-scoped only, and its own comment dismissed the residue — "two runs sharing one
-// workspace would still sweep each other" — as unreachable, on the reasoning that one workspace per run
-// is herdr's placement. That reasoned from ONE driver to the whole product. OrcaDriver has no workspace
-// dimension at all: orca.ts passes a single ORCA_SPACE as the workspaceId for EVERY checkout and as
-// `ws`, so `workspaceId !== ws` is never true there and every foreign pane fell straight through. Orca
-// users had zero protection while the defect read as fixed. The runId line is the real rule and it is
-// driver-agnostic: reconcile exists to clean up THIS RUN's panes, and a leftover from a dead run is
-// exactly what cannot be told from a live run's pane without liveness data this process does not have.
-// Both lines are kept — the workspace line preserves the pre-existing sparing of this run's own panes
-// in another workspace, which the runId line alone would not.
-// ⚠ WHAT THE runId LINE COST BEFORE OBS-777 — SUSPENDED, NOT NARROWED, and the price was larger than
-// it read. Sparing every other runId suspended OBS-17's FOUNDING use case: "a killed daemon can't
-// close its slots". This sweep was built to reclaim exactly those orphans, but could not reclaim ANY
-// previous run's panes. Three separate pins asserted the old behaviour (reconcile.test.ts,
-// orca-placement.test.ts,
-// reconcile-live.test.ts); all three were changed deliberately, and the third is why this paragraph
-// exists rather than a shorter one — two flipped pins is a trade, three is a pattern.
-// OBS-777 RESTORES that reclamation: the CALLER passes `opts.endedRunIds`, a Set the daemon computes
-// ONCE at run start from this repository's own `run-end` journals and dead lock holders. This fold
-// stays pure — it gains one optional field, not a repo root — a foreign repository's runId is never
-// resolvable and so stays spared by construction, and no driver learns about workspaces.
-// ponytail: two conditions, no geometry reasoning, nothing driver-specific. `reconcile` is cosmetic by
-// contract, and a cosmetic cleanup must never be able to kill a live worker — which is why the
-// ended-run authority is the only safe way to restore the sweep without reviving the cross-run kill.
 export function panesToClose(agents, desired, ws, runId, opts) {
     const out = [];
     for (const a of agents) {
@@ -76,6 +28,8 @@ export function panesToClose(agents, desired, ws, runId, opts) {
         const owned = parseOwnedName(a.name);
         if (!owned || owned.role === "watch")
             continue;
+        if (opts?.liveSeats?.has(a.name))
+            continue;
         if (owned.runId !== runId && !opts?.endedRunIds?.has(owned.runId))
             continue;
         if (a.workspaceId !== ws)

package/dist/run/daemon.d.ts

@@ -49,12 +49,16 @@ export interface RunSummary {
     outstandingApprovals?: string[];
 }
 /**
- * T14: approvals the run accepted and never acted on. `approved` above is built ONCE at startup —
- * deliberately, replay determinism depends on it — so an approval written while the daemon is live is
- * inert for that run. Without this the run-end record stated only buckets and tipVerify, both
- * accurate, over a milestone that was silently incomplete: run …230 ended tipVerify "passed" with two
- * upheld approvals and zero subsequent dispatches. Scored per task on its NEWEST approval: a later
- * approval is the live decision, and the events that answer it are the ones after it.
+ * T14, amended by v2.2 T3: approvals the run accepted and never acted on. `approved` above is still
+ * built ONCE at startup — replay determinism depends on it — but a live approval is no longer inert:
+ * the boundary sweep in the task loop releases what lands while the daemon runs, so an approval
+ * written mid-run is normally enacted by this run. ONE window survives, and it is the reason this
+ * fold still exists: an approval accepted after the task loop exits — during tip verify, before the
+ * run-end sample below — meets no further boundary, so nothing can release it before this run ends.
+ * Without this the run-end record stated only buckets and tipVerify, both accurate, over a milestone
+ * that was silently incomplete: run …230 ended tipVerify "passed" with two upheld approvals and zero
+ * subsequent dispatches. Scored per task on its NEWEST approval: a later approval is the live
+ * decision, and the events that answer it are the ones after it.
  */
 export declare function outstandingApprovals(events: JournalEvent[]): string[];
 export declare function formatSummary(s: RunSummary): string;