tickmarkr 2.2.1 → 2.4.0

package/dist/adapters/types.d.ts

@@ -116,7 +116,24 @@ export declare const TrustDialogSchema: z.ZodUnion<readonly [z.ZodObject<{
     reason: z.ZodString;
 }, z.core.$strict>]>;
 export declare function matchesTrustDialog(paneText: string, dialog: TrustDialog): dialog is CapturedTrustDialog;
+export declare const ADAPTER_PROMPT_GLYPHS: {
+    readonly "claude-code": "❯";
+    readonly codex: "›";
+    readonly "cursor-agent": ">";
+    readonly opencode: ">";
+    readonly pi: ">";
+    readonly grok: ">";
+    readonly kimi: ">";
+    readonly qwen: ">";
+    readonly omp: ">";
+    readonly agy: ">";
+    readonly "prime-agent": ">";
+    readonly fake: ">";
+};
+export type PromptGlyph = (typeof ADAPTER_PROMPT_GLYPHS)[keyof typeof ADAPTER_PROMPT_GLYPHS];
+export declare function declaredPromptGlyphForAdapter(adapterId: string): PromptGlyph | undefined;
 export interface InputBox {
+    promptGlyph?: PromptGlyph;
     fingerprint: string;
     match?(paneText: string): boolean;
     emptyMatch?(paneText: string): boolean;
@@ -124,8 +141,11 @@ export interface InputBox {
     launchCommand?(command: string): boolean;
     readinessTimeoutMs?: number;
 }
-export declare function declareInputBox(adapterId: string, inputBox: InputBox): InputBox;
+export declare function declareInputBox(adapterId: string, inputBox: Omit<InputBox, "promptGlyph"> & {
+    promptGlyph?: PromptGlyph;
+}): InputBox;
 export declare function declaredInputBoxForWorkerName(workerName: string): InputBox | undefined;
+export declare function declaredPromptGlyphForWorkerName(workerName: string): PromptGlyph | undefined;
 export declare function matchesInputBox(paneText: string, inputBox: InputBox): boolean;
 export declare function matchesEmptyInputBox(paneText: string, inputBox: InputBox): boolean;
 export declare function matchesOccupiedInputBox(paneText: string, inputBox: InputBox): boolean;

package/dist/adapters/types.js

@@ -129,15 +129,56 @@ export function matchesTrustDialog(paneText, dialog) {
         return false;
     return dialog.fingerprint.trim().length > 0 && paneText.includes(dialog.fingerprint);
 }
+// v1.75 T1 / OBS-136: an adapter whose steady-state TUI presents a bordered input box declares
+// one distinctive pane-text fingerprint. The herdr driver associates declarations with worker
+// slots by the existing adapter-bearing dispatch name before that name is canonicalized.
+// v1.77 / OBS-142: launchCommand identifies the adapter-owned bootstrap command that necessarily
+// precedes the box; that command settles on a clean shell line, while every other delivery waits
+// for the declared box itself. readinessTimeoutMs bounds that evidence loop per adapter.
+// v1.85 T5 / OBS-140: typed delivery is licensed by DECLARED states, never by transcript shape.
+// `match` is the box painted, `emptyMatch` the box carrying nothing, `occupiedMatch` the box still
+// holding a prompt. An adapter may pin `occupiedMatch` directly, or leave it derived from the other
+// two — but an adapter that declares neither cannot acknowledge a submission and is refused.
+// OBS-620: prompt glyphs are adapter facts, just like the input-box matchers below. Keep the shipped
+// set in one shell-readable table: the overseer receipt cannot import TypeScript, but it reads these
+// exact declarations from src/ in a checkout or dist/ in an installed package. A newly shipped
+// adapter therefore has one visible place where omission can be enumerated and refused.
+export const ADAPTER_PROMPT_GLYPHS = {
+    "claude-code": "❯",
+    "codex": "›",
+    "cursor-agent": ">",
+    "opencode": ">",
+    "pi": ">",
+    "grok": ">",
+    "kimi": ">",
+    "qwen": ">",
+    "omp": ">",
+    "agy": ">",
+    "prime-agent": ">",
+    // Test-only, but declared so a fake interactive slot exercises the same fail-closed contract.
+    "fake": ">",
+};
+export function declaredPromptGlyphForAdapter(adapterId) {
+    return ADAPTER_PROMPT_GLYPHS[adapterId];
+}
 const inputBoxes = new Map();
 export function declareInputBox(adapterId, inputBox) {
-    inputBoxes.set(adapterId, inputBox);
-    return inputBox;
+    const promptGlyph = inputBox.promptGlyph ?? declaredPromptGlyphForAdapter(adapterId);
+    // The shipped-adapter registry is audited separately against ADAPTER_PROMPT_GLYPHS. Keep this
+    // declaration helper open to synthetic and extension adapters: Herdr's input-state tests register
+    // those at module load, and prompt glyphs are not part of its typed-delivery decision.
+    const declared = promptGlyph === undefined ? inputBox : { ...inputBox, promptGlyph };
+    inputBoxes.set(adapterId, declared);
+    return declared;
 }
 export function declaredInputBoxForWorkerName(workerName) {
     const adapterId = /^.+-worker-(.+)-a\d+-.+$/.exec(workerName)?.[1];
     return adapterId === undefined ? undefined : inputBoxes.get(adapterId);
 }
+export function declaredPromptGlyphForWorkerName(workerName) {
+    const adapterId = /^.+-worker-(.+)-a\d+-.+$/.exec(workerName)?.[1];
+    return adapterId === undefined ? undefined : declaredPromptGlyphForAdapter(adapterId);
+}
 export function matchesInputBox(paneText, inputBox) {
     return inputBox.match?.(paneText) ?? paneText.includes(inputBox.fingerprint);
 }

package/dist/cli/commands/approve.js

@@ -11,7 +11,7 @@ export const APPROVAL_DISPOSITIONS = ["dispatch", "waive-gate", "re-dispatch", "
 export const APPROVAL_ENACTS = {
     dispatch: "dispatch it",
     "waive-gate": "continue past the approved gate",
-    "re-dispatch": "re-dispatch against the full gate suite",
+    "re-dispatch": "re-dispatch against the full gate suite only if re-running the whole declared battery on the parked commit before any worker is red",
     "fund-fixed-attempt": "dispatch a fixed attempt carrying the findings",
     "fresh-budget": "dispatch it on a fresh attempt budget",
 };
@@ -85,6 +85,7 @@ export async function approve(argv, cwd = process.cwd()) {
         const lastHuman = events[lastHumanIndex];
         const capPark = lastHuman?.data.kind === ATTEMPT_CAP_RELEASE;
         const gateFailPark = lastHuman?.data.kind === "gate-fail";
+        const infraPark = lastHuman?.data.kind === "infra";
         const failedGate = gateFailPark ? failedGateForNewestPark(events, taskId, lastHumanIndex) : undefined;
         if (gateFailPark && !failedGate) {
             throw new Error(`task ${taskId} is parked on gate-fail but has no failed gate result on the newest park — refusing to infer one`);
@@ -104,8 +105,8 @@ export async function approve(argv, cwd = process.cwd()) {
             return disposition(cwd, runId, "fund-fixed-attempt", `upheld the reviewer for ${taskId} in ${runId} — by ${by}`, serialization.contended);
         }
         if (recheck) {
-            if (!gateFailPark || !failedGate) {
-                throw new Error(`--recheck applies to a gate-fail park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
+            if ((!gateFailPark || !failedGate) && !infraPark) {
+                throw new Error(`--recheck applies to a gate-fail or infra park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
             journal.append("task-approved", taskId, {
                 by,
@@ -114,7 +115,7 @@ export async function approve(argv, cwd = process.cwd()) {
                 release: RECHECK_RELEASE,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
-            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; failed gate ${failedGate}; no gate marked satisfied`, serialization.contended);
+            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : "infra park"}; no gate marked satisfied`, serialization.contended);
         }
         if (waive) {
             if (!gateFailPark || !failedGate) {

package/dist/cli/commands/beat.js

@@ -1,7 +1,7 @@
 import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { tickmarkrDir } from "../../graph/graph.js";
-import { SUPERVISION_BEAT_MS, SUPERVISION_DEFAULT_THRESHOLD_PCT, SUPERVISION_STALE_MS, SUPERVISION_TIERS, beatSupervision, supervisionStandDownPath, } from "../../run/supervision.js";
+import { SUPERVISION_BEAT_MS, SUPERVISION_DEFAULT_THRESHOLD_PCT, SUPERVISION_STALE_MS, SUPERVISION_TIERS, beatSupervision, resolveSupervisionRoot, supervisionStandDownPath, } from "../../run/supervision.js";
 // SUP-04: the writer side of supervision, as a VERB. `beatSupervision` and `SUPERVISION_BEAT_MS` shipped
 // with exactly one in-repo caller — the daemon, on one tier — so `status` printed
 // `orchestrator ARMED / overseer ABSENT / watch ABSENT` while a real overseer worked the run: two thirds
@@ -41,14 +41,17 @@ export async function beat(argv, cwd = process.cwd()) {
         throw new Error(`${named} needs --seat <identity> — a beat that names no seat arms a tier nobody occupies` +
             " (pass the seat's own pane id or agent name)");
     }
+    // A beat names repository state, never the caller's incidental directory. Resolution is read-only
+    // and happens before every write, so a non-repository invocation cannot create the state it claims.
+    const repoRoot = resolveSupervisionRoot(cwd);
     if (standDown)
-        return standDownTier(cwd, named, seat);
+        return standDownTier(repoRoot, named, seat);
     // Clear a stand-down marker left by an earlier session BEFORE beating: a valid marker outranks every
     // beat that does not strictly follow it, and two writes landing in the same millisecond do not. An
     // uncleared marker would render DISARMED while this verb claimed ARMED, so the removal is unguarded
     // too — `force` makes the ordinary "no marker" case a no-op, and anything else is a real failure.
-    rmSync(supervisionStandDownPath(cwd, named), { force: true, recursive: true });
-    beatSupervision(cwd, named, seat, pct === undefined ? undefined : { armId: armId ?? seat, pct, thresholdPct });
+    rmSync(supervisionStandDownPath(repoRoot, named), { force: true, recursive: true });
+    beatSupervision(repoRoot, named, seat, pct === undefined ? undefined : { armId: armId ?? seat, pct, thresholdPct });
     return `${named} ARMED as ${seat} — beat again every ${SUPERVISION_BEAT_MS / 1_000}s; the tier reads STALE ${SUPERVISION_STALE_MS / 1_000}s after the last beat`;
 }
 /** `--seat <identity>` or `--seat=<identity>`; blank and missing are the same answer — none. */

package/dist/cli/commands/compile.js

@@ -1,12 +1,32 @@
 import { isAbsolute, join } from "node:path";
 import { parseArgs } from "node:util";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
+import { CompileError } from "../../compile/common.js";
 import { compileSource } from "../../compile/index.js";
 import { saveGraph, stateDirName } from "../../graph/graph.js";
 import { formatPriorFindingEvidence, readPriorRunEvidence } from "../../run/journal.js";
 import { shGit } from "../../run/git.js";
 import { acquireRunLock, releaseRunLock } from "../../run/lock.js";
 import { harnessLine, resolveHarness } from "../harness.js";
+function nativeSourceScopeErrors(graph, lints) {
+    const byId = new Map(graph.tasks.map((task) => [task.id, task]));
+    const errors = [];
+    for (const lint of lints) {
+        const match = lint.match(/^(\S+): criteria implicate out-of-scope source not in files\[\]: (.*)$/);
+        if (!match)
+            continue;
+        const task = byId.get(match[1]);
+        if (!task)
+            continue;
+        const paths = match[2].replace(/ \(capped\)$/, "").split(", ").filter(Boolean);
+        for (const path of paths) {
+            if (task.goal.includes(`scope-waiver: ${path}`))
+                continue;
+            errors.push(`${task.id}: ${path} requires scope-waiver: ${path} in the task goal`);
+        }
+    }
+    return errors;
+}
 async function mergedPendingDiagnostics(cwd, pending, merges) {
     const head = await shGit("git rev-parse HEAD", cwd);
     const base = head.code === 0 ? head.stdout.trim() : "";
@@ -33,15 +53,25 @@ export async function compile(argv, cwd = process.cwd(), harnessFrom = process.a
         options: {
             type: { type: "string" },
             "dry-run": { type: "boolean" },
+            strict: { type: "boolean" },
         },
         allowPositionals: true,
     });
     const src = positionals[0];
     if (!src)
-        throw new Error("usage: tickmarkr compile <spec-dir-or-md> [--type speckit|prd|gsd|native] [--dry-run]");
+        throw new Error("usage: tickmarkr compile <spec-dir-or-md> [--type speckit|prd|gsd|native] [--dry-run] [--strict]");
     // resolve against the target repo, not the process cwd (the CLI test passes a tmp repo)
     // Both modes reach the same pure compiler; --dry-run only removes the lock/write side effect below.
-    const g = compileSource(isAbsolute(src) ? src : join(cwd, src), values.type, cwd);
+    const g = compileSource(isAbsolute(src) ? src : join(cwd, src), values.type, cwd, // repo root: gsd stores context[0] repo-relative so workers resolve it inside their worktree
+    (plan) => plan, { strict: values.strict });
+    const scopeLints = [...collateralLints(g.tasks, cwd), ...sourceScopeLints(g.tasks, cwd)];
+    const diagnostics = scopeLints.length
+        ? `\nscope lints:\n${scopeLints.map((lint) => `  ! ${lint}`).join("\n")}`
+        : "";
+    const unwaived = g.spec.source === "native" ? nativeSourceScopeErrors(g, scopeLints) : [];
+    if (unwaived.length > 0) {
+        throw new CompileError(`${src} has unwaived native source-scope authoring errors:\n${unwaived.map((line) => `  - ${line}`).join("\n")}${diagnostics}`);
+    }
     // One bounded read supplies both cross-run surfaces: unresolved findings below and merge facts for
     // the ancestry check. Neither fact mutates the compiled graph; status and every readiness predicate
     // remain the source compiler's answer.
@@ -62,10 +92,6 @@ export async function compile(argv, cwd = process.cwd(), harnessFrom = process.a
     const summary = values["dry-run"]
         ? `validated ${src} (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)}) — dry run; no graph written`
         : `compiled ${src} → ${stateDir}/graph.json (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)})`;
-    const scopeLints = [...collateralLints(g.tasks, cwd), ...sourceScopeLints(g.tasks, cwd)];
-    const diagnostics = scopeLints.length
-        ? `\nscope lints:\n${scopeLints.map((lint) => `  ! ${lint}`).join("\n")}`
-        : "";
     const priorFindings = prior.findings.length
         ? `\nprior-run evidence:\n${prior.findings.map((finding) => `  ${formatPriorFindingEvidence(finding)}`).join("\n")}`
         : "";

package/dist/cli/commands/doctor.d.ts

@@ -1,7 +1,7 @@
 import { type ClaudeAlias } from "../../adapters/claude-code.js";
 import type { WorkerAdapter } from "../../adapters/types.js";
 import { type KimiDoctorTurnResult } from "../../adapters/kimi.js";
-import { type CatalogReadResult } from "../../adapters/catalog-remote.js";
+import { type CatalogFetcher, type CatalogReadResult } from "../../adapters/catalog-remote.js";
 import { type ShResult } from "../../run/git.js";
 import { type VitestListResult } from "../../gates/acceptance.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
@@ -14,11 +14,16 @@ export type DoctorOpts = {
     resolveClaudeAliasIdentity?: (cwd: string, alias: ClaudeAlias) => string | undefined;
     catalog?: CatalogReadResult;
     catalogNow?: () => Date;
+    catalogFetcher?: CatalogFetcher;
     /** init's between-acts surface: status rows only — the model matrix and inline drift stay
      *  behind `tickmarkr doctor` (files are still written; only the RETURNED string shrinks). */
     compact?: boolean;
     /** Test seam for the same `orca status --json` transport production invokes. */
     orcaStatusProbe?: (cwd: string, binary: string) => Promise<ShResult>;
+    /** Test seam for Orca's authoritative per-agent hook coverage listing. */
+    orcaHooksStatusProbe?: (cwd: string, binary: string) => Promise<ShResult>;
+    /** Environment used only to explain whether auto-selection applies in this terminal. */
+    orcaEnv?: NodeJS.ProcessEnv | Record<string, string | undefined>;
     /** Test seam for shell-path discovery; absence remains a normal doctor row, never an exception. */
     resolveOrcaBinary?: (cwd: string) => string | undefined;
     /** Test seam for the runner-owned JSON listing used by the acceptance-oracle report row. */
@@ -36,7 +41,7 @@ type OrcaCapability = {
  * Capability-row `detail` stays hermetic — never `OrcaError.message`, which embeds volatile CLI
  * stderr (Electron timestamps), so the row is byte-stable across runs.
  */
-export declare function probeOrcaCapability(cwd: string, opts?: Pick<DoctorOpts, "orcaStatusProbe" | "resolveOrcaBinary">): Promise<OrcaCapability>;
+export declare function probeOrcaCapability(cwd: string, opts?: Pick<DoctorOpts, "orcaStatusProbe" | "orcaHooksStatusProbe" | "resolveOrcaBinary" | "orcaEnv">): Promise<OrcaCapability>;
 export declare function runnerIgnoreFinding(cwd: string): {
     verdict: "pass" | "warn";
     detail: string;
@@ -87,8 +92,8 @@ export declare function selfShadowFinding(ownVersion: string, cwd?: string, reso
  * §4.4: `LIVEBENCH_TABLE_DATE` is a hand-bumped constant, and a constant nobody lints is a stale
  * constant — the pinned table ages silently while every tier suggestion keeps citing it. Warns past
  * 90 days, naming the pinned date and the listing where a newer table is discovered.
- * ponytail: a LINT, never a fetch — doctor stays cache-only (T17); the operator (or RELEASING.md's
- * release-time check) reads the listing and bumps the constant.
+ * ponytail: the listing itself is never fetched; the operator (or RELEASING.md's release-time
+ * check) reads it and bumps the constant.
  */
 export declare function liveBenchStalenessFinding(now: Date): string | undefined;
 export declare function doctor(_argv: string[], cwd?: string, adapters?: WorkerAdapter[], opts?: DoctorOpts): Promise<string>;

package/dist/cli/commands/doctor.js

@@ -15,7 +15,7 @@ import { HerdrDriver } from "../../drivers/herdr.js";
 import { ORCA_FIXTURE_VERSION, parseEnvelope, resolveOrcaCliBinary } from "../../drivers/orca.js";
 import { kimi, probeKimiDoctorTurn } from "../../adapters/kimi.js";
 import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
-import { LIVEBENCH_TABLE_DATE, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
+import { CATALOG_REFRESH_TIMEOUT_MS, LIVEBENCH_TABLE_DATE, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { sh } from "../../run/git.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
@@ -25,6 +25,62 @@ export const LIVEBENCH_TABLE_MAX_AGE_DAYS = 90;
 const visual = () => process.stdout.isTTY === true && process.env.NO_COLOR === undefined;
 const alignedStatusRow = (verdict, key, value) => `  ${statusRow(verdict, kvRow(key, value).slice(2))}`;
 const attentionRow = (text) => `  ${statusRow("warn", text)}`;
+const ORCA_HOOK_ADAPTERS = {
+    claude: "claude-code",
+    "claude-code": "claude-code",
+    codex: "codex",
+    cursor: "cursor-agent",
+    "cursor-agent": "cursor-agent",
+    grok: "grok",
+    kimi: "kimi",
+    opencode: "opencode",
+    pi: "pi",
+};
+function orcaSelectionDetail(env) {
+    const inside = env.TERM_PROGRAM === "Orca" && !!env.ORCA_TERMINAL_HANDLE?.trim();
+    return inside
+        ? "auto picks orca in this Orca terminal"
+        : "not an Orca terminal; auto picks orca only inside one; use --driver orca";
+}
+async function orcaHookCoverage(cwd, binary, opts) {
+    // A supplied status transport is a hermetic boundary: do not escape it to a real binary for the
+    // second command. Tests (and embedders) that want coverage supply the matching hook transport.
+    if (opts.orcaHooksStatusProbe === undefined && opts.orcaStatusProbe !== undefined) {
+        return "hooks status unavailable";
+    }
+    let response;
+    try {
+        response = await (opts.orcaHooksStatusProbe ?? ((probeCwd, executable) => sh(`${shq(executable)} agent hooks status --json`, probeCwd, 10_000)))(cwd, binary);
+        if (response.code !== 0 || response.timedOut)
+            return "hooks status unavailable";
+        // Until the driver's response-family expansion lands, this still uses its one strict envelope
+        // parser. Coverage comes only from this command's `statuses[].state`; managedHooksPresent and
+        // local agent config files are deliberately not alternative oracles.
+        const envelope = parseEnvelope("status", response.stdout);
+        const statuses = envelope.result.statuses;
+        if (!Array.isArray(statuses))
+            return "hooks status unavailable";
+        const coverage = new Map();
+        for (const raw of statuses) {
+            if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+                continue;
+            const row = raw;
+            const adapter = typeof row.agent === "string" ? ORCA_HOOK_ADAPTERS[row.agent] : undefined;
+            if (!adapter)
+                continue;
+            if (row.state === "installed")
+                coverage.set(adapter, "hooked");
+            else if (row.state === "not_installed")
+                coverage.set(adapter, "unhooked");
+        }
+        return coverage.size
+            ? `hooks: ${[...coverage].map(([adapter, state]) => `${adapter} ${state}`).join(", ")}`
+            : "hooks: no tickmarkr adapter status reported";
+    }
+    catch {
+        return "hooks status unavailable";
+    }
+}
 /**
  * Orca's status body is deliberately interpreted by T1's one shared envelope parser. Doctor owns
  * only capability presentation: it may classify an absent executable, but it never invents a second
@@ -63,13 +119,15 @@ export async function probeOrcaCapability(cwd, opts = {}) {
             ? runtime.reachable
             : undefined;
         if (reachable === true) {
+            const hooks = await orcaHookCoverage(cwd, binary, opts);
+            const selection = orcaSelectionDetail(opts.orcaEnv ?? process.env);
             const appVersion = typeof runtime === "object" && runtime !== null && !Array.isArray(runtime)
                 ? runtime.appVersion
                 : undefined;
             if (typeof appVersion !== "string" || !appVersion) {
-                return { verdict: "warn", detail: `runtime reachable (${envelope.runtimeId}, appVersion absent; fixture pin ${ORCA_FIXTURE_VERSION})` };
+                return { verdict: "warn", detail: `runtime reachable (${envelope.runtimeId}, appVersion absent; fixture pin ${ORCA_FIXTURE_VERSION}); ${hooks} — ${selection}` };
             }
-            const detail = `runtime reachable (${envelope.runtimeId}, appVersion ${appVersion}; fixture pin ${ORCA_FIXTURE_VERSION})`;
+            const detail = `runtime reachable (${envelope.runtimeId}, appVersion ${appVersion}; fixture pin ${ORCA_FIXTURE_VERSION}); ${hooks} — ${selection}`;
             return { verdict: appVersion === ORCA_FIXTURE_VERSION ? "pass" : "warn", detail };
         }
         if (reachable === false)
@@ -278,8 +336,8 @@ export function selfShadowFinding(ownVersion, cwd = process.cwd(), resolve = res
  * §4.4: `LIVEBENCH_TABLE_DATE` is a hand-bumped constant, and a constant nobody lints is a stale
  * constant — the pinned table ages silently while every tier suggestion keeps citing it. Warns past
  * 90 days, naming the pinned date and the listing where a newer table is discovered.
- * ponytail: a LINT, never a fetch — doctor stays cache-only (T17); the operator (or RELEASING.md's
- * release-time check) reads the listing and bumps the constant.
+ * ponytail: the listing itself is never fetched; the operator (or RELEASING.md's release-time
+ * check) reads it and bumps the constant.
  */
 export function liveBenchStalenessFinding(now) {
     const pinnedMs = Date.parse(`${LIVEBENCH_TABLE_DATE.replace(/_/g, "-")}T00:00:00Z`);
@@ -298,9 +356,20 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     // Operator directive 2026-08-12 (declutter): long per-model lists render only when asked for.
     const listAllModels = _argv.includes("--models");
     const cfg = loadConfig(cwd);
-    // T17: synchronous/cache-only by operator ruling. The only network-bearing catalog function is the
-    // separately invoked refreshCatalogCommand; ordinary doctor never calls it.
-    const catalog = opts.catalog ?? readCachedCatalog(cwd, { now: opts.catalogNow });
+    let catalog = opts.catalog ?? readCachedCatalog(cwd, { now: opts.catalogNow });
+    let catalogRefreshWarning;
+    // RULING-222-17 reverses cache-only for these two operator-facing commands only. The refresh
+    // remains age-guarded; compile, plan, and run never import this path.
+    if (!opts.catalog && catalog.source === "cache" && catalog.stale) {
+        const refreshed = await refreshCatalogCommand({
+            repoRoot: cwd,
+            fetcher: opts.catalogFetcher,
+            timeoutMs: CATALOG_REFRESH_TIMEOUT_MS,
+            now: opts.catalogNow,
+        });
+        catalog = refreshed.catalog;
+        catalogRefreshWarning = refreshed.warning;
+    }
     // banner at START — the logo greets the operator before the ~60s probe wait, never trailing it (operator report 2026-07-17)
     if (opts.banner !== false && visual())
         process.stdout.write(BANNER);
@@ -397,6 +466,9 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     if (catalog.warning) {
         rows.push(attentionRow(`model catalog cache unreadable — ${catalog.warning}; using vendored fallback (advisory — routing unchanged)`));
     }
+    if (catalogRefreshWarning) {
+        rows.push(attentionRow(`model catalog auto-refresh failed open — ${catalogRefreshWarning}; retained ${catalog.source} catalog`));
+    }
     // v1.48 T1 / v1.86 T12: advisory sweep for known agent CLIs with no drive contract. Presence is
     // resolved through the worker's login shell; advisory targets are never executed or written to health.
     rows.push(...detectCandidateClis({ cwd }).map(({ binary, path }) => alignedStatusRow("warn", binary, `detected at ${path} (no drive contract — not routable)`)));
@@ -459,8 +531,8 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     }
     if (trustNa.length)
         rows.push(`  ${dim("=")} ${dim(`n/a (${trustNa.length}): ${trustNa.join(", ")}`)}`);
-    // Orca is an explicit choice, so its health is capability information rather than an auto-routing
-    // input. A failed probe never changes pickDriver's auto ordering or substitutes subprocess.
+    // Capability is diagnostic only: auto-selection is decided from terminal identity markers, never
+    // from this runtime probe, and a failed probe cannot silently substitute another driver.
     const orca = await probeOrcaCapability(cwd, opts);
     rows.push(legend("execution runtime:"));
     rows.push(alignedStatusRow(orca.verdict, "orca", orca.detail));
@@ -577,9 +649,11 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             const probed = probedMs !== undefined ? dim(` ${(probedMs / 1000).toFixed(1)}s`) : "";
             const auth = !v
                 ? dim("unknown")
-                : v.authed
-                    ? `${ok("authed")}${probed}`
-                    : `${fail("unauthed:")} ${trunc(v.reason ?? "probe failed", 40)} (${dateOf(v.probedAt)})`;
+                : v.probeError
+                    ? `${fail(`probe error (${v.probeError})`)}${probed}`
+                    : v.authed
+                        ? `${ok("authed")}${probed}`
+                        : `${fail("unauthed:")} ${trunc(v.reason ?? "probe failed", 40)} (${dateOf(v.probedAt)})`;
             const d = disallowedBy({ adapter: a.id, model: m }, cfg.routing);
             const denied = d?.by === "deny" ? d.entry : "—";
             const pref = preferRanks({ adapter: a.id, model: m }, cfg).map((p) => `${p.shape}#${p.rank}`).join(",") || "—";

package/dist/cli/commands/fleet.d.ts

@@ -1,3 +1,4 @@
+import { type CatalogFetcher, type CatalogReadResult } from "../../adapters/catalog-remote.js";
 import type { WorkerAdapter } from "../../adapters/types.js";
 import type { FleetEditorResult } from "../../tui/ink/fleet-app.js";
 type FleetEditorProps = Parameters<typeof import("../../tui/ink/fleet-app.js").runFleetInkEditor>[0];
@@ -16,6 +17,8 @@ export type FleetIO = {
     output?: FleetOutput;
     debug?: boolean;
     reloadGuard?: (bytes: string) => string | null;
+    catalogFetcher?: CatalogFetcher;
+    catalogNow?: () => Date;
 };
 export type FleetWriteHooks = {
     readPrior?: (path: string) => string;
@@ -36,6 +39,7 @@ export declare function fleet(argv: string[], cwd?: string, adapters?: WorkerAda
 export declare function assembleFleetEditor(cwd: string, adapters: WorkerAdapter[], io: FleetIO, opts: {
     globalDir: string;
     entry?: "presets" | "probe";
+    catalog?: CatalogReadResult;
 }): Promise<{
     props: FleetEditorProps;
     commit: (result: FleetEditorResult) => string;

package/dist/cli/commands/fleet.js

@@ -3,7 +3,7 @@ import { dirname } from "node:path";
 import { parseArgs } from "node:util";
 import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, modelAuthExclusions } from "../../adapters/registry.js";
 import { catalogModelAdvisory, catalogTierRanking, declaredModelWindow, fleetUnclassifiedModels } from "../../adapters/model-lints.js";
-import { readCachedCatalog } from "../../adapters/catalog-remote.js";
+import { CATALOG_REFRESH_TIMEOUT_MS, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, readClaudeAliasIdentity } from "../../adapters/claude-code.js";
 import { fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, overlayBytesLoadError, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, unifiedYamlDiff, } from "../../config/config.js";
 import { projectFleetWhy, renderFleetWhy } from "../../config/fleet-why.js";
@@ -96,6 +96,19 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
     const input = io.input ?? process.stdin;
     const output = io.output ?? process.stdout;
     const interactive = input.isTTY === true && output.isTTY === true;
+    let catalog = readCachedCatalog(cwd, { now: io.catalogNow });
+    let refreshReason = "";
+    if (catalog.source === "cache" && catalog.stale) {
+        const refreshed = await refreshCatalogCommand({
+            repoRoot: cwd,
+            fetcher: io.catalogFetcher,
+            timeoutMs: CATALOG_REFRESH_TIMEOUT_MS,
+            now: io.catalogNow,
+        });
+        catalog = refreshed.catalog;
+        if (refreshed.warning)
+            refreshReason = `fleet: catalog auto-refresh failed open — ${refreshed.warning}; retained ${catalog.source} catalog`;
+    }
     if (print) {
         // v1.51 T4: the print surface names the mode and its source layer right under the header —
         // comment-prefixed so the YAML body stays machine-parseable and regex-stable.
@@ -104,10 +117,10 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         const nl = body.indexOf("\n");
         // Steering comes from the same resolved config snapshot the editor consumes below,
         // not from another parse of either raw overlay.
-        return `${body.slice(0, nl)}\n# mode: ${rm.mode.mode} (${rm.source})${body.slice(nl)}${formatFleetSteering(rm.cfg)}`;
+        return `${body.slice(0, nl)}\n# mode: ${rm.mode.mode} (${rm.source})${refreshReason ? `\n# ${refreshReason}` : ""}${body.slice(nl)}${formatFleetSteering(rm.cfg)}`;
     }
     if (!why && !interactive)
-        return { out: NON_TTY_MSG, code: 1 };
+        return { out: `${refreshReason ? `${refreshReason}\n` : ""}${NON_TTY_MSG}`, code: 1 };
     // OBS-528: `--fresh` parsed since v1.92 but nothing ever RAN the probe — it forced the reuse
     // gate false and guaranteed the "probe data missing or stale" refusal. The law stands — the
     // EDITOR never probes (previews stay cache-only, `r` still exits to the operator) — but the
@@ -119,11 +132,11 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             output.write(`${await doctor([], cwd, adapters, { banner: false, compact: true })}\n`);
         }
     }
-    const assembled = await assembleFleetEditor(cwd, adapters, io, { globalDir });
+    const assembled = await assembleFleetEditor(cwd, adapters, io, { globalDir, catalog });
     if ("unavailable" in assembled)
-        return { out: assembled.unavailable, code: 1 };
+        return { out: `${refreshReason ? `${refreshReason}\n` : ""}${assembled.unavailable}`, code: 1 };
     if (why)
-        return assembled.renderWhy();
+        return `${refreshReason ? `${refreshReason}\n` : ""}${assembled.renderWhy()}`;
     // Keep Ink out of print, non-TTY, and missing-probe paths: the component runtime belongs
     // exclusively to the interactive editor. The capture window brackets only the dynamic Ink
     // import — keys typed while the module loads land in props.initialInput, never get dropped.
@@ -155,7 +168,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
     }
     assembled.props.initialInput = initialInput;
     const result = await runFleetInkEditor(assembled.props);
-    return assembled.commit(result);
+    return `${refreshReason ? `${refreshReason}\n` : ""}${assembled.commit(result)}`;
 }
 /** Everything between the doctor-reuse gate and the Ink render, packaged for reuse: `tickmarkr init`
  * runs the same editor (entry="presets": Esc is HOME to the preset overlay, never a bare quit)
@@ -192,7 +205,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     // OBS-508: the same catalog evidence doctor's drift overlay prints now rides each unclassified
     // row — it prefills the classify flow and feeds the bulk `s` stage. Suggestions stay advisory:
     // only the review-diff confirm writes, so "tickmarkr never applies" holds with less typing.
-    const catalog = readCachedCatalog(cwd);
+    const catalog = opts.catalog ?? readCachedCatalog(cwd);
     // The same alias→identity resolution doctor hands its advisory rows: models.dev has never heard of
     // `opus`, so without it the fleet's own frontier models drop out of the universe they are supposed
     // to anchor and fleet bands a different set than doctor for one fleet. The stored identity wins;
@@ -203,9 +216,32 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         : readClaudeAliasIdentity(cwd, model) ?? CLAUDE_ALIAS_IDENTITY_STAMPS[model];
     // One ranking universe for the whole screen: every unclassified row bands fleet-relatively
     // against the same set, so a suggestion never depends on which adapter group renders first.
-    const unclassifiedRows = fleetUnclassifiedModels(cfg, health, adapters)
+    const detectedRows = fleetUnclassifiedModels(cfg, health, adapters)
         .map((row) => ({ ...row, resolvedModel: resolvedCatalogModel(row.adapter, row.model) }));
-    const catalogRanking = catalogTierRanking(cfg, catalog, unclassifiedRows, resolvedCatalogModel);
+    const catalogRanking = catalogTierRanking(cfg, catalog, detectedRows, resolvedCatalogModel);
+    const foldedRows = [];
+    const folds = new Map();
+    for (const row of detectedRows) {
+        const advisory = catalogModelAdvisory(cfg, catalog, row.adapter, row.model, row.resolvedModel, catalogRanking);
+        const evidence = advisory.coverage === "covered" ? advisory.evidence : undefined;
+        const score = evidence?.agenticCodingScore ?? evidence?.intelligenceIndex ?? evidence?.codingScore;
+        const next = { ...row, advisory, ...(score !== undefined ? { score } : {}) };
+        const foldKey = evidence ? `${row.adapter}:${evidence.catalogId}` : undefined;
+        const first = foldKey ? folds.get(foldKey) : undefined;
+        if (first) {
+            first.foldedModels ??= [first.model];
+            first.foldedModels.push(row.model);
+        }
+        else {
+            foldedRows.push(next);
+            if (foldKey)
+                folds.set(foldKey, next);
+        }
+    }
+    const unclassifiedRows = foldedRows.sort((a, b) => Number(!!b.advisory.suggestion) - Number(!!a.advisory.suggestion)
+        || (b.detectedAt ?? "").localeCompare(a.detectedAt ?? "")
+        || (b.score ?? Number.NEGATIVE_INFINITY) - (a.score ?? Number.NEGATIVE_INFINITY)
+        || a.model.localeCompare(b.model));
     // OBS-508 follow-through: the browser renders the metadata the assembler always had — catalog
     // ctx/price evidence and doctor's model-probe wall clock — as columns instead of dropping them.
     const rowEvidence = (adapter, model, evidence) => {
@@ -239,14 +275,17 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 ...unclassified
                     .filter((row) => !editable.tiers[adapter.id]?.[row.model])
                     .map((row) => {
-                    const advisory = catalogModelAdvisory(cfg, catalog, adapter.id, row.model, row.resolvedModel, catalogRanking);
-                    const evidence = rowEvidence(adapter.id, row.model, advisory.coverage === "covered" ? advisory.evidence : undefined);
+                    const evidence = rowEvidence(adapter.id, row.classifyModel ?? row.model, row.advisory.coverage === "covered" ? row.advisory.evidence : undefined);
                     return {
                         model: row.model,
                         detectedAt: row.detectedAt,
+                        ...(row.classifyModel ? { classifyModel: row.classifyModel } : {}),
+                        ...(row.variants ? { variants: row.variants } : {}),
+                        ...(row.foldedModels ? { foldedModels: row.foldedModels } : {}),
+                        ...(row.score !== undefined ? { score: row.score } : {}),
                         ...(evidence ? { evidence } : {}),
-                        ...(advisory.suggestion
-                            ? { suggestion: { tier: advisory.suggestion.tier, note: advisory.suggestion.provenanceNote } }
+                        ...(row.advisory.suggestion
+                            ? { suggestion: { tier: row.advisory.suggestion.tier, note: row.advisory.suggestion.provenanceNote } }
                             : {}),
                     };
                 }),