tickmarkr 2.1.9 → 2.2.1

package/dist/adapters/model-lints.js

@@ -3,6 +3,7 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { DEFAULT_CONFIG, TIER_RANK } from "../config/config.js";
 import { filesGlob } from "../graph/files-glob.js";
+import { piModelVendor } from "./pi.js";
 import { buildTaskPrompt } from "./prompt.js";
 import { channelKey, MODEL_ID_RE } from "./types.js";
 import { resolveCatalogModel } from "./catalog-remote.js";
@@ -446,6 +447,14 @@ export function modelLints(cfg, health, adapters, opts) {
     const lints = [];
     for (const adapter of adapters) {
         const id = adapter.id;
+        if (id === "pi" && adapter.channels) {
+            for (const channel of adapter.channels(cfg)) {
+                const expected = cfg.tiers.pi?.modelOverrides?.[channel.model]?.vendor ?? piModelVendor(channel.model);
+                if (expected && channel.vendor !== expected) {
+                    lints.push(`pi: ${channel.model} channel vendor ${channel.vendor} disagrees with provider vendor ${expected} — set tiers.pi.modelOverrides.${channel.model}.vendor to ${expected}`);
+                }
+            }
+        }
         if (!adapter.listModels) {
             // v1.90 / OBS-504: the seeds-stamped wording presumes a seeded tier table. agy ships routable
             // but UNCLASSIFIED (no listModels, no seed models) — for that shape the honest sentence names

package/dist/adapters/pi.d.ts

@@ -6,4 +6,5 @@ export interface ServedModelDrift {
 }
 export declare function readPiServedModels(): ServedModelDrift[];
 export declare function servedModelNote(drifts?: ServedModelDrift[]): string;
+export declare function piModelVendor(model: string): string | undefined;
 export declare const pi: WorkerAdapter;

package/dist/adapters/pi.js

@@ -118,6 +118,17 @@ export function servedModelNote(drifts = readPiServedModels()) {
         return "";
     return `served-model drift: ${drifts.map((d) => `pinned ${d.pinned} served ${d.served}`).join(", ")}`;
 }
+const PI_PROVIDER_VENDORS = {
+    anthropic: "anthropic",
+    google: "google",
+    openai: "openai",
+    "openai-codex": "openai",
+    xai: "xai",
+    zai: "zhipu",
+};
+export function piModelVendor(model) {
+    return PI_PROVIDER_VENDORS[model.split("/", 1)[0]];
+}
 export const pi = {
     id: "pi",
     // FLEET-04: cross-vendor review honesty — GLM's provider (pi's own label is "zai"; either is
@@ -140,7 +151,10 @@ export const pi = {
         const note = `auth verified via pi --list-models (free; auth-filtered by pi)${drift ? `; ${drift}` : ""}`;
         return { ...h, servable: parsePiModels(r.stdout || ""), note };
     },
-    channels: (cfg) => channelsFromConfig("pi", cfg),
+    channels: (cfg) => channelsFromConfig("pi", cfg).map((channel) => ({
+        ...channel,
+        vendor: cfg.tiers.pi?.modelOverrides?.[channel.model]?.vendor ?? piModelVendor(channel.model) ?? channel.vendor,
+    })),
     // v1.65 T3: every flag the command builders below hardcode — verified in `pi --help` 2026-07-22.
     hardcodedFlags: { binary: "pi", flags: ["-p", "--approve", "--model"] },
     // --approve: pi's per-directory trust prompt would stall fresh worktrees (herdr scrapes the dialog

package/dist/adapters/prompt.js

@@ -1,4 +1,4 @@
-import { mkdirSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { classifyVerdictCause } from "../gates/verdict-cause.js";
@@ -30,8 +30,16 @@ TICKMARKR_RESULT_${nonce} {"ok":true|false,"summary":"<one sentence>","deviation
 `;
 }
 export function writePrompt(dir, task, attempt, feedback = "", nonce = "") {
-    const p = join(dir, "prompts", `${task.id}-a${attempt}.md`);
-    mkdirSync(join(dir, "prompts"), { recursive: true });
+    const prompts = join(dir, "prompts");
+    const p = join(prompts, `${task.id}-a${attempt}.md`);
+    mkdirSync(prompts, { recursive: true });
+    if (existsSync(p)) {
+        let engagement = 0;
+        let archive = join(prompts, `${task.id}-a${attempt}-engagement-${engagement}.md`);
+        while (existsSync(archive))
+            archive = join(prompts, `${task.id}-a${attempt}-engagement-${++engagement}.md`);
+        copyFileSync(p, archive);
+    }
     writeFileSync(p, buildTaskPrompt(task, feedback, nonce));
     return p;
 }

package/dist/adapters/registry.js

@@ -11,7 +11,7 @@ import { FakeAdapter } from "./fake.js";
 import { parseWorkerResult } from "./prompt.js";
 import { sealHerdrEnv } from "../drivers/subprocess.js";
 import { catalogEntries, isNativeCliDrive, projectCliEntries, SHIPPED_CLI_CATALOG, } from "./catalog.js";
-import { channelKey, channelsFromConfig, modelAuthed, MODEL_ID_RE, QUOTA_RE, shq, } from "./types.js";
+import { channelKey, channelsFromConfig, modelAuthed, MODEL_ID_RE, MODEL_PROBE_ERRORS, QUOTA_RE, shq, } from "./types.js";
 // Compatibility projection for callers/tests that only need shipped advisory names. The literal
 // list is gone: both advisory and routable catalog views derive from SHIPPED_CLI_CATALOG. Native
 // definitions (claudeCode, codex, cursorAgent, opencode, pi, grok, kimi) are owned by catalog.ts;
@@ -410,6 +410,12 @@ function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TI
         ? reasonTail(output) || `probe exited ${code}`
         : undefined;
 }
+const PROBE_ERROR_RE = new RegExp(`\\b(${MODEL_PROBE_ERRORS.join("|")})\\b`);
+function probeError(code, stdout, stderr, timedOut) {
+    if (timedOut || code === 0)
+        return undefined;
+    return PROBE_ERROR_RE.exec(`${stderr}\n${stdout}`)?.[1];
+}
 const probeModelStatus = (v) => v.authed ? "ok" : v.reason?.includes("timed out") ? "timeout" : "failed";
 // v1.21: one bounded, headless call per configured model; detected-but-unclassified models never enter this loop.
 export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
@@ -436,7 +442,7 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
             const attempt = async (model, retry) => {
                 const t0 = Date.now();
                 const probedAt = new Date().toISOString();
-                const v = (authed, reason) => ({ authed, ...(reason !== undefined ? { reason } : {}), probedAt, durationMs: Date.now() - t0 });
+                const v = (authed, reason, error) => ({ authed, ...(reason !== undefined ? { reason } : {}), ...(error ? { probeError: error } : {}), probedAt, durationMs: Date.now() - t0 });
                 try {
                     if (typeof a.headlessCommand !== "function")
                         return { verdict: v(false, "headless probe unavailable"), timedOut: false };
@@ -455,8 +461,11 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
                             return { verdict: v(true), timedOut: false };
                         if (!retry)
                             return { verdict: null, timedOut: r.timedOut === true };
+                        const error = probeError(r.code, r.stdout, r.stderr, r.timedOut);
                         return {
-                            verdict: r.timedOut && retry.firstTimedOut ? v(false, `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`) : v(false, reason),
+                            verdict: error
+                                ? v(priorModelAuth?.[model]?.authed === true, undefined, error)
+                                : r.timedOut && retry.firstTimedOut ? v(false, `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`) : v(false, reason),
                             timedOut: r.timedOut === true,
                         };
                     }
@@ -605,7 +614,7 @@ export function modelAuthExclusions(cfg, adapters, health) {
             if (modelAuthed(h, c.model, cfg.routing.allowUnverifiedModels))
                 continue;
             if (v?.authed === false)
-                out.push({ key: channelKey(c), adapter: a.id, reason: v.reason ?? "probe failed", probedAt: v.probedAt });
+                out.push({ key: channelKey(c), adapter: a.id, reason: v.probeError ? `probe-error (${v.probeError})` : v.reason ?? "probe failed", probedAt: v.probedAt });
             else
                 out.push({ key: channelKey(c), adapter: a.id, reason: "no model auth verdict — run tickmarkr doctor", probedAt: "not recorded" });
         }

package/dist/adapters/types.d.ts

@@ -23,9 +23,12 @@ export interface BillingChannel {
     channel: "sub" | "api";
     tier: Tier;
 }
+export declare const MODEL_PROBE_ERRORS: readonly ["EMFILE", "EAGAIN", "ENFILE", "ENOMEM", "ENOSPC"];
+export type ModelProbeError = typeof MODEL_PROBE_ERRORS[number];
 export interface ModelAuth {
     authed: boolean;
     reason?: string;
+    probeError?: ModelProbeError;
     probedAt: string;
 }
 export interface AuthHealth {

package/dist/adapters/types.js

@@ -23,6 +23,7 @@ export function addUsage(a, b) {
         reasoning: add(a.reasoning, b.reasoning),
     };
 }
+export const MODEL_PROBE_ERRORS = ["EMFILE", "EAGAIN", "ENFILE", "ENOMEM", "ENOSPC"];
 export function modelAuthed(health, model, allowUnverifiedModels = false) {
     const authed = health?.modelAuth?.[model]?.authed;
     return authed === true || (authed === undefined && allowUnverifiedModels);

package/dist/cli/commands/approve.d.ts

@@ -1,3 +1,23 @@
+export declare const APPROVAL_DISPOSITIONS: readonly ["dispatch", "waive-gate", "re-dispatch", "fund-fixed-attempt", "fresh-budget"];
+export type ApprovalDisposition = (typeof APPROVAL_DISPOSITIONS)[number];
+/**
+ * What each disposition's release actually buys — the clause every operator-facing sentence about
+ * this approval ends on. One table, because two surfaces say it: this command's own message, and the
+ * setup cockpit's pre-write confirm inset, which predicts the effect BEFORE the write. A prediction
+ * that can drift from the write is worth less than none, so neither surface writes the phrase itself.
+ */
+export declare const APPROVAL_ENACTS: Record<ApprovalDisposition, string>;
+export declare function approvalDispositionForRelease(release: unknown): ApprovalDisposition;
 export type ApprovalStatus = "deferred-live" | "recorded-no-owner";
+/** The requested run plus the different live run currently blocking its repository, when present. */
+export interface ApprovalRunOwner {
+    runId: string;
+    live: boolean;
+    blockingRunId?: string;
+}
+/** The same read `approve` performs, for surfaces that must predict an enactment before writing. */
+export declare function approvalRunOwner(cwd: string, runId: string): ApprovalRunOwner;
+/** The one sentence that says who enacts this release and what it buys. */
+export declare function approvalEnactment(token: ApprovalDisposition, run: ApprovalRunOwner): string;
 /** The production command registered in COMMANDS; its returned bytes are what the CLI prints. */
 export declare function approve(argv: string[], cwd?: string): Promise<string>;

package/dist/cli/commands/approve.js

@@ -1,12 +1,65 @@
 import { userInfo } from "node:os";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
+export const APPROVAL_DISPOSITIONS = ["dispatch", "waive-gate", "re-dispatch", "fund-fixed-attempt", "fresh-budget"];
+/**
+ * What each disposition's release actually buys — the clause every operator-facing sentence about
+ * this approval ends on. One table, because two surfaces say it: this command's own message, and the
+ * setup cockpit's pre-write confirm inset, which predicts the effect BEFORE the write. A prediction
+ * that can drift from the write is worth less than none, so neither surface writes the phrase itself.
+ */
+export const APPROVAL_ENACTS = {
+    dispatch: "dispatch it",
+    "waive-gate": "continue past the approved gate",
+    "re-dispatch": "re-dispatch against the full gate suite",
+    "fund-fixed-attempt": "dispatch a fixed attempt carrying the findings",
+    "fresh-budget": "dispatch it on a fresh attempt budget",
+};
+export function approvalDispositionForRelease(release) {
+    if (release === GATE_SATISFIED_RELEASE)
+        return "waive-gate";
+    if (release === RECHECK_RELEASE)
+        return "re-dispatch";
+    if (release === REVIEW_UPHELD_RELEASE)
+        return "fund-fixed-attempt";
+    if (release === ATTEMPT_CAP_RELEASE)
+        return "fresh-budget";
+    return "dispatch";
+}
 import { acquireApprovalSerialization, runLockOwner } from "../../run/lock.js";
+// THE liveness rule, written once. The lock is REPOSITORY-wide, so a live owner of some OTHER run is
+// not an owner of this one and sweeps none of its approvals — claiming otherwise is the same
+// falsehood in a new shape. Liveness itself comes from lock.ts's runLockOwner (the same inspect() the
+// acquire/unlock decision table uses), never a second `process.kill(pid, 0)`, and never the lock
+// FILE's presence: a stale lock whose recorded pid is dead is not a live run.
+const ownedByLiveDaemon = (owner, runId) => {
+    const run = { runId, live: owner?.live === true && owner.runId === runId };
+    if (owner?.live === true && owner.runId !== undefined && owner.runId !== runId) {
+        // Preserve the shipped enumerable { runId, live } shape while carrying the third state.
+        Object.defineProperty(run, "blockingRunId", { value: owner.runId });
+    }
+    return run;
+};
+/** The same read `approve` performs, for surfaces that must predict an enactment before writing. */
+export function approvalRunOwner(cwd, runId) {
+    return ownedByLiveDaemon(runLockOwner(cwd), runId);
+}
+/** The one sentence that says who enacts this release and what it buys. */
+export function approvalEnactment(token, run) {
+    if (run.live) {
+        return `the live daemon enacts this at its next task boundary — it will ${APPROVAL_ENACTS[token]}`;
+    }
+    if (run.blockingRunId) {
+        return `release recorded; live run \`${run.blockingRunId}\` holds the repository lock, so resume \`${run.runId}\` after it ends to ${APPROVAL_ENACTS[token]}`;
+    }
+    return `run \`tickmarkr resume ${run.runId}\` to ${APPROVAL_ENACTS[token]}`;
+}
 /** The production command registered in COMMANDS; its returned bytes are what the CLI prints. */
 export async function approve(argv, cwd = process.cwd()) {
-    const { runId, taskId, by, reason, uphold, recheck, reviewRoundCeiling } = parseArgs(argv);
-    if (uphold && recheck)
-        throw new Error("--uphold and --recheck are different decisions — pass one");
+    const { runId, taskId, by, reason, waive, uphold, recheck, reviewRoundCeiling } = parseArgs(argv);
+    const decisions = [waive, uphold, recheck].filter(Boolean).length;
+    if (decisions > 1)
+        throw new Error("--waive, --uphold and --recheck are different decisions — pass one");
     const serialization = await acquireApprovalSerialization(cwd, runId);
     try {
         // Journal.open throws `no journal for <runId> at <dir>` on an unknown run — that IS the refusal.
@@ -30,13 +83,15 @@ export async function approve(argv, cwd = process.cwd()) {
             }
         }
         const lastHuman = events[lastHumanIndex];
+        const capPark = lastHuman?.data.kind === ATTEMPT_CAP_RELEASE;
+        const gateFailPark = lastHuman?.data.kind === "gate-fail";
+        const failedGate = gateFailPark ? failedGateForNewestPark(events, taskId, lastHumanIndex) : undefined;
+        if (gateFailPark && !failedGate) {
+            throw new Error(`task ${taskId} is parked on gate-fail but has no failed gate result on the newest park — refusing to infer one`);
+        }
         if (uphold) {
-            // Fail-closed on the DATA: uphold applies only when the newest failed gate is the review gate —
-            // any other gate has no reviewer to uphold. Never inferred from the park's prose.
-            const lastFailed = events.slice(0, lastHumanIndex).reverse().find((e) => e.event === "gate-result" && e.taskId === taskId && e.data.pass === false
-                && typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate))?.data.gate;
-            if (lastFailed !== "review") {
-                throw new Error(`--uphold applies to a review rejection; ${taskId}'s last failed gate is ${lastFailed ?? "none"} — refusing`);
+            if (!gateFailPark || failedGate !== "review") {
+                throw new Error(`--uphold applies to a review gate-fail park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
             journal.append("task-approved", taskId, {
                 by,
@@ -46,15 +101,11 @@ export async function approve(argv, cwd = process.cwd()) {
                 gate: "review",
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
-            return disposition(cwd, runId, `upheld the reviewer for ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to dispatch a fixed attempt carrying the findings`, serialization.contended);
+            return disposition(cwd, runId, "fund-fixed-attempt", `upheld the reviewer for ${taskId} in ${runId} — by ${by}`, serialization.contended);
         }
-        const capPark = lastHuman?.data.kind === ATTEMPT_CAP_RELEASE;
-        const gateFailPark = lastHuman?.data.kind === "gate-fail";
         if (recheck) {
-            // OBS-203: fail-closed on the PARK KIND — only a gate-fail park has a gate to re-run. Refusing
-            // elsewhere keeps --recheck from becoming a silent budget reset on a pre-dispatch human gate.
-            if (!gateFailPark) {
-                throw new Error(`--recheck applies to a gate-fail park; ${taskId}'s park kind is ${lastHuman?.data.kind ?? "none"} — refusing`);
+            if (!gateFailPark || !failedGate) {
+                throw new Error(`--recheck applies to a gate-fail park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
             journal.append("task-approved", taskId, {
                 by,
@@ -63,14 +114,27 @@ export async function approve(argv, cwd = process.cwd()) {
                 release: RECHECK_RELEASE,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
-            return disposition(cwd, runId, `re-checking ${taskId} in ${runId} — by ${by}; no gate marked satisfied, run \`tickmarkr resume ${runId}\` to re-dispatch against the full gate suite`, serialization.contended);
+            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; failed gate ${failedGate}; no gate marked satisfied`, serialization.contended);
         }
-        const failedGate = gateFailPark
-            ? events.slice(0, lastHumanIndex).reverse().find((e) => e.event === "gate-result" && e.taskId === taskId && e.data.pass === false
-                && typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate))?.data.gate
-            : undefined;
-        if (gateFailPark && !failedGate) {
-            throw new Error(`task ${taskId} is parked on gate-fail but has no failed gate result — refusing to infer one`);
+        if (waive) {
+            if (!gateFailPark || !failedGate) {
+                throw new Error(`--waive applies to a gate-fail park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
+            }
+            journal.append("task-approved", taskId, {
+                by,
+                ...(reason ? { reason } : {}),
+                via: "cli",
+                release: GATE_SATISFIED_RELEASE,
+                gate: failedGate,
+                ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
+            });
+            return disposition(cwd, runId, "waive-gate", `waived failed gate ${failedGate} for ${taskId} in ${runId} — by ${by}`, serialization.contended);
+        }
+        if (gateFailPark) {
+            const choices = [`--waive (disposition waive-gate)`, `--recheck (disposition re-dispatch)`];
+            if (failedGate === "review")
+                choices.push(`--uphold (disposition fund-fixed-attempt)`);
+            throw new Error(`task ${taskId} is parked on failed gate ${failedGate}; plain approve has disposition only for non-gate parks — pass ${choices.join(" or ")}`);
         }
         journal.append("task-approved", taskId, {
             by,
@@ -78,9 +142,9 @@ export async function approve(argv, cwd = process.cwd()) {
             via: "cli",
             ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             ...(capPark ? { release: ATTEMPT_CAP_RELEASE } : {}),
-            ...(failedGate ? { release: GATE_SATISFIED_RELEASE, gate: failedGate } : {}),
         });
-        return disposition(cwd, runId, `approved ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to ${failedGate ? "continue past the approved gate" : "dispatch it"}`, serialization.contended);
+        const token = capPark ? "fresh-budget" : "dispatch";
+        return disposition(cwd, runId, token, `approved ${taskId} in ${runId} — by ${by}`, serialization.contended);
     }
     finally {
         serialization.release();
@@ -89,29 +153,40 @@ export async function approve(argv, cwd = process.cwd()) {
 // The status is command OUTPUT, not a typed sibling result: the registered approve function returns
 // one primitive string and the dispatcher prints those bytes unchanged. A compact sentinel followed
 // by JSON makes the contract unambiguous to machines without widening the shared command result type.
-// No-lock approvals keep their historical one-line result for the cockpit; a dead recorded owner and
-// a command delayed behind terminalization both emit recorded-no-owner.
-function disposition(cwd, runId, message, contended) {
+// No-lock approvals keep their historical one-line result for the cockpit; a dead recorded owner, a
+// live owner executing some OTHER run, and a command delayed behind terminalization all emit
+// recorded-no-owner — none of them is a daemon that will sweep this run's approvals.
+//
+// The ENACTMENT half of the message is completed here because only here is liveness known: the call
+// sites carry the decision, not the answer to who will act on it. `deferred-live` keeps its v1.89
+// token — machine consumers parse it — while its TEXT now names the boundary sweep. A recovery
+// command is emitted only with no live repository owner; a different run's live owner instead names
+// the blocker and waits until it ends.
+function disposition(cwd, runId, token, message, contended) {
     const owner = runLockOwner(cwd);
-    const resume = `tickmarkr resume ${runId}`;
+    const run = ownedByLiveDaemon(owner, runId);
+    const out = `approval disposition ${token}: ${message}; ${approvalEnactment(token, run)}`;
     if (!owner && !contended)
-        return message;
-    const status = owner?.live ? "deferred-live" : "recorded-no-owner";
+        return out;
+    const status = run.live ? "deferred-live" : "recorded-no-owner";
     const record = {
         status,
-        resume,
+        disposition: token,
+        // Resume is safe to prescribe only when no live repository owner would contend with it.
+        ...(!run.live && !run.blockingRunId ? { resume: `tickmarkr resume ${runId}` } : {}),
         ...(owner?.pid === undefined ? {} : { ownerPid: owner.pid }),
         ...(owner?.runId === undefined ? {} : { ownerRunId: owner.runId }),
     };
-    return `${message}\nTICKMARKR_APPROVAL ${JSON.stringify(record)}`;
+    return `${out}\nTICKMARKR_APPROVAL ${JSON.stringify(record)}`;
 }
-const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
+const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--waive|--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
 // hand-parsed argv — no CLI framework (house style). Positionals are runId then taskId; decision,
 // ceiling, actor and reason are flags. Throws usage on missing positionals (mirrors resume.ts/unlock.ts).
 function parseArgs(argv) {
     const positionals = [];
     let by;
     let reason;
+    let waive = false;
     let uphold = false;
     let recheck = false;
     let reviewRoundCeiling;
@@ -127,6 +202,9 @@ function parseArgs(argv) {
             if (!reason)
                 throw new Error(USAGE);
         }
+        else if (a === "--waive") {
+            waive = true;
+        }
         else if (a === "--uphold") {
             uphold = true;
         }
@@ -150,5 +228,19 @@ function parseArgs(argv) {
     if (!runId || !taskId) {
         throw new Error(USAGE);
     }
-    return { runId, taskId, by: by ?? userInfo().username, reason, uphold, recheck, reviewRoundCeiling };
+    return { runId, taskId, by: by ?? userInfo().username, reason, waive, uphold, recheck, reviewRoundCeiling };
+}
+function failedGateForNewestPark(events, taskId, lastHumanIndex) {
+    for (let i = lastHumanIndex - 1; i >= 0; i -= 1) {
+        const event = events[i];
+        if (event.taskId !== taskId)
+            continue;
+        if (event.event === "task-approved" || event.event === "task-human" || event.event === "task-dispatch")
+            return undefined;
+        if (event.event === "gate-result" && event.data.pass === false
+            && typeof event.data.gate === "string" && GATE_NAMES.includes(event.data.gate)) {
+            return event.data.gate;
+        }
+    }
+    return undefined;
 }

package/dist/cli/commands/doctor.d.ts

@@ -25,7 +25,7 @@ export type DoctorOpts = {
     listTests?: (cwd: string) => Promise<VitestListResult>;
 };
 type OrcaCapability = {
-    verdict: "pass" | "fail";
+    verdict: "pass" | "fail" | "warn";
     detail: string;
 };
 /**

package/dist/cli/commands/doctor.js

@@ -12,7 +12,7 @@ import { graphPath, loadGraph, tickmarkrDir, stateDirName } from "../../graph/gr
 import { catalogModelAdvisory, catalogTierRanking, declaredModelWindow, hasWindowsConfig, modelLints, suggestOverlay, ttyVisual } from "../../adapters/model-lints.js";
 import { loadConfig, overlayPreferShapes } from "../../config/config.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
-import { parseEnvelope } from "../../drivers/orca.js";
+import { ORCA_FIXTURE_VERSION, parseEnvelope, resolveOrcaCliBinary } from "../../drivers/orca.js";
 import { kimi, probeKimiDoctorTurn } from "../../adapters/kimi.js";
 import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
 import { LIVEBENCH_TABLE_DATE, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
@@ -34,7 +34,9 @@ const attentionRow = (text) => `  ${statusRow("warn", text)}`;
  * stderr (Electron timestamps), so the row is byte-stable across runs.
  */
 export async function probeOrcaCapability(cwd, opts = {}) {
-    const binary = opts.resolveOrcaBinary ? opts.resolveOrcaBinary(cwd) : resolveShellBinary("orca", cwd).resolved;
+    const binary = opts.resolveOrcaBinary
+        ? opts.resolveOrcaBinary(cwd)
+        : resolveOrcaCliBinary(cwd, { resolve: (bin, dir) => resolveShellBinary(bin, dir) });
     if (!binary)
         return { verdict: "fail", detail: "CLI not installed" };
     let response;
@@ -60,8 +62,16 @@ export async function probeOrcaCapability(cwd, opts = {}) {
         const reachable = typeof runtime === "object" && runtime !== null && !Array.isArray(runtime)
             ? runtime.reachable
             : undefined;
-        if (reachable === true)
-            return { verdict: "pass", detail: `runtime reachable (${envelope.runtimeId})` };
+        if (reachable === true) {
+            const appVersion = typeof runtime === "object" && runtime !== null && !Array.isArray(runtime)
+                ? runtime.appVersion
+                : undefined;
+            if (typeof appVersion !== "string" || !appVersion) {
+                return { verdict: "warn", detail: `runtime reachable (${envelope.runtimeId}, appVersion absent; fixture pin ${ORCA_FIXTURE_VERSION})` };
+            }
+            const detail = `runtime reachable (${envelope.runtimeId}, appVersion ${appVersion}; fixture pin ${ORCA_FIXTURE_VERSION})`;
+            return { verdict: appVersion === ORCA_FIXTURE_VERSION ? "pass" : "warn", detail };
+        }
         if (reachable === false)
             return { verdict: "fail", detail: "CLI installed but runtime unreachable" };
         return { verdict: "fail", detail: "CLI installed but runtime probe failed — status carries no reachability proof" };

package/dist/cli/commands/plan.js

@@ -17,6 +17,7 @@ import { loadRoutingProfile } from "../../run/journal.js";
 import { harnessLine, resolveHarness } from "../harness.js";
 import { shq } from "../../adapters/types.js";
 import { shGit } from "../../run/git.js";
+import { driverEvidence, pickDriver } from "../../drivers/index.js";
 // T4 (v1.50): TTY-only brand pass — the title helper frames the routing table, lint/unroutable
 // markers carry the attention glyph, section labels dim to chrome (the doctor/status system).
 // Gated on ttyVisual(): the non-TTY surface returns untouched (byte-pinned, machine-consumable).
@@ -99,7 +100,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     const DOCTOR_STALE_MS = 24 * 60 * 60 * 1000;
     // v1.51 T2: plan previews any mode without a config edit — same source precedence as run
     // (flag > spec front-matter > repo > global > default), same preset compiler.
-    const { values } = parseArgs({ args: argv, options: { mode: { type: "string" } }, allowPositionals: true });
+    const { values } = parseArgs({ args: argv, options: { mode: { type: "string" }, driver: { type: "string" } }, allowPositionals: true });
     if (values.mode !== undefined && !ROUTING_MODES.includes(values.mode)) {
         throw new Error(`--mode must be one of ${ROUTING_MODES.join(" | ")} (got ${values.mode})`);
     }
@@ -136,6 +137,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
         inputRefusals.set(finding.taskId, [...(inputRefusals.get(finding.taskId) ?? []), finding.detail]);
     }
     const { cfg, mode, source } = resolveRunMode(cwd, { flag: values.mode, spec: g.mode });
+    const selectedDriver = pickDriver(cfg, values.driver);
     // readDoctor cache path: staleness line only fires here (probeAll fallback is fresh by construction).
     const cached = readDoctor(cwd);
     const health = cached ?? (await probeAll(adapters));
@@ -157,6 +159,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     const lines = [
         `tickmarkr plan — dry run (${channels.length} channels available)`,
         `mode: ${mode.mode} (${source}) · explore ${cfg.routing.explore?.mode ?? "on"}`,
+        `driver: ${driverEvidence(cfg, selectedDriver, values.driver)}`,
         harnessLine(resolveHarness(harnessFrom)),
         "",
     ];

package/dist/cli/commands/verify.js

@@ -205,6 +205,8 @@ export async function verify(argv, cwd = process.cwd()) {
         onGate: (e) => {
             if (e.phase === "start")
                 console.error(`verify: → ${e.gate} (${e.index}/${e.total})`);
+            else if (e.phase === "note")
+                console.error(`verify: note ${e.gate} ${e.name} ${JSON.stringify(e.payload)}`);
             else
                 console.error(`verify: ${e.result.pass ? "✓" : "✗"} ${e.result.gate} — ${e.result.details.split("\n")[0] ?? ""}`);
         },

package/dist/cli/commands/version.d.ts

@@ -1 +1,2 @@
-export declare function version(_argv?: string[]): Promise<string>;
+export declare function distFingerprint(dir?: string): string;
+export declare function version(argv?: string[], dir?: string): Promise<string>;

package/dist/cli/commands/version.js

@@ -1,8 +1,29 @@
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "../../../package.json");
-export async function version(_argv = []) {
+const distDir = join(dirname(pkgPath), "dist");
+export function distFingerprint(dir = distDir) {
+    if (!existsSync(dir))
+        return "missing";
+    const files = [];
+    const visit = (path) => {
+        for (const entry of readdirSync(path, { withFileTypes: true })) {
+            const child = join(path, entry.name);
+            if (entry.isDirectory())
+                visit(child);
+            else if (entry.isFile())
+                files.push(child);
+        }
+    };
+    visit(dir);
+    const hash = createHash("sha256");
+    for (const file of files.sort())
+        hash.update(relative(dir, file)).update("\0").update(readFileSync(file)).update("\0");
+    return hash.digest("hex");
+}
+export async function version(argv = [], dir = distDir) {
     const { version: v } = JSON.parse(readFileSync(pkgPath, "utf8"));
-    return v;
+    return argv.includes("--dist") ? `${v} dist:${distFingerprint(dir)}` : v;
 }