tickmarkr 2.3.0 → 2.4.0

package/dist/cli/commands/compile.js

@@ -1,12 +1,32 @@
 import { isAbsolute, join } from "node:path";
 import { parseArgs } from "node:util";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
+import { CompileError } from "../../compile/common.js";
 import { compileSource } from "../../compile/index.js";
 import { saveGraph, stateDirName } from "../../graph/graph.js";
 import { formatPriorFindingEvidence, readPriorRunEvidence } from "../../run/journal.js";
 import { shGit } from "../../run/git.js";
 import { acquireRunLock, releaseRunLock } from "../../run/lock.js";
 import { harnessLine, resolveHarness } from "../harness.js";
+function nativeSourceScopeErrors(graph, lints) {
+    const byId = new Map(graph.tasks.map((task) => [task.id, task]));
+    const errors = [];
+    for (const lint of lints) {
+        const match = lint.match(/^(\S+): criteria implicate out-of-scope source not in files\[\]: (.*)$/);
+        if (!match)
+            continue;
+        const task = byId.get(match[1]);
+        if (!task)
+            continue;
+        const paths = match[2].replace(/ \(capped\)$/, "").split(", ").filter(Boolean);
+        for (const path of paths) {
+            if (task.goal.includes(`scope-waiver: ${path}`))
+                continue;
+            errors.push(`${task.id}: ${path} requires scope-waiver: ${path} in the task goal`);
+        }
+    }
+    return errors;
+}
 async function mergedPendingDiagnostics(cwd, pending, merges) {
     const head = await shGit("git rev-parse HEAD", cwd);
     const base = head.code === 0 ? head.stdout.trim() : "";
@@ -33,15 +53,25 @@ export async function compile(argv, cwd = process.cwd(), harnessFrom = process.a
         options: {
             type: { type: "string" },
             "dry-run": { type: "boolean" },
+            strict: { type: "boolean" },
         },
         allowPositionals: true,
     });
     const src = positionals[0];
     if (!src)
-        throw new Error("usage: tickmarkr compile <spec-dir-or-md> [--type speckit|prd|gsd|native] [--dry-run]");
+        throw new Error("usage: tickmarkr compile <spec-dir-or-md> [--type speckit|prd|gsd|native] [--dry-run] [--strict]");
     // resolve against the target repo, not the process cwd (the CLI test passes a tmp repo)
     // Both modes reach the same pure compiler; --dry-run only removes the lock/write side effect below.
-    const g = compileSource(isAbsolute(src) ? src : join(cwd, src), values.type, cwd);
+    const g = compileSource(isAbsolute(src) ? src : join(cwd, src), values.type, cwd, // repo root: gsd stores context[0] repo-relative so workers resolve it inside their worktree
+    (plan) => plan, { strict: values.strict });
+    const scopeLints = [...collateralLints(g.tasks, cwd), ...sourceScopeLints(g.tasks, cwd)];
+    const diagnostics = scopeLints.length
+        ? `\nscope lints:\n${scopeLints.map((lint) => `  ! ${lint}`).join("\n")}`
+        : "";
+    const unwaived = g.spec.source === "native" ? nativeSourceScopeErrors(g, scopeLints) : [];
+    if (unwaived.length > 0) {
+        throw new CompileError(`${src} has unwaived native source-scope authoring errors:\n${unwaived.map((line) => `  - ${line}`).join("\n")}${diagnostics}`);
+    }
     // One bounded read supplies both cross-run surfaces: unresolved findings below and merge facts for
     // the ancestry check. Neither fact mutates the compiled graph; status and every readiness predicate
     // remain the source compiler's answer.
@@ -62,10 +92,6 @@ export async function compile(argv, cwd = process.cwd(), harnessFrom = process.a
     const summary = values["dry-run"]
         ? `validated ${src} (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)}) — dry run; no graph written`
         : `compiled ${src} → ${stateDir}/graph.json (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)})`;
-    const scopeLints = [...collateralLints(g.tasks, cwd), ...sourceScopeLints(g.tasks, cwd)];
-    const diagnostics = scopeLints.length
-        ? `\nscope lints:\n${scopeLints.map((lint) => `  ! ${lint}`).join("\n")}`
-        : "";
     const priorFindings = prior.findings.length
         ? `\nprior-run evidence:\n${prior.findings.map((finding) => `  ${formatPriorFindingEvidence(finding)}`).join("\n")}`
         : "";

package/dist/cli/commands/doctor.d.ts

@@ -1,7 +1,7 @@
 import { type ClaudeAlias } from "../../adapters/claude-code.js";
 import type { WorkerAdapter } from "../../adapters/types.js";
 import { type KimiDoctorTurnResult } from "../../adapters/kimi.js";
-import { type CatalogReadResult } from "../../adapters/catalog-remote.js";
+import { type CatalogFetcher, type CatalogReadResult } from "../../adapters/catalog-remote.js";
 import { type ShResult } from "../../run/git.js";
 import { type VitestListResult } from "../../gates/acceptance.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
@@ -14,6 +14,7 @@ export type DoctorOpts = {
     resolveClaudeAliasIdentity?: (cwd: string, alias: ClaudeAlias) => string | undefined;
     catalog?: CatalogReadResult;
     catalogNow?: () => Date;
+    catalogFetcher?: CatalogFetcher;
     /** init's between-acts surface: status rows only — the model matrix and inline drift stay
      *  behind `tickmarkr doctor` (files are still written; only the RETURNED string shrinks). */
     compact?: boolean;
@@ -91,8 +92,8 @@ export declare function selfShadowFinding(ownVersion: string, cwd?: string, reso
  * §4.4: `LIVEBENCH_TABLE_DATE` is a hand-bumped constant, and a constant nobody lints is a stale
  * constant — the pinned table ages silently while every tier suggestion keeps citing it. Warns past
  * 90 days, naming the pinned date and the listing where a newer table is discovered.
- * ponytail: a LINT, never a fetch — doctor stays cache-only (T17); the operator (or RELEASING.md's
- * release-time check) reads the listing and bumps the constant.
+ * ponytail: the listing itself is never fetched; the operator (or RELEASING.md's release-time
+ * check) reads it and bumps the constant.
  */
 export declare function liveBenchStalenessFinding(now: Date): string | undefined;
 export declare function doctor(_argv: string[], cwd?: string, adapters?: WorkerAdapter[], opts?: DoctorOpts): Promise<string>;

package/dist/cli/commands/doctor.js

@@ -15,7 +15,7 @@ import { HerdrDriver } from "../../drivers/herdr.js";
 import { ORCA_FIXTURE_VERSION, parseEnvelope, resolveOrcaCliBinary } from "../../drivers/orca.js";
 import { kimi, probeKimiDoctorTurn } from "../../adapters/kimi.js";
 import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
-import { LIVEBENCH_TABLE_DATE, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
+import { CATALOG_REFRESH_TIMEOUT_MS, LIVEBENCH_TABLE_DATE, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { sh } from "../../run/git.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
@@ -336,8 +336,8 @@ export function selfShadowFinding(ownVersion, cwd = process.cwd(), resolve = res
  * §4.4: `LIVEBENCH_TABLE_DATE` is a hand-bumped constant, and a constant nobody lints is a stale
  * constant — the pinned table ages silently while every tier suggestion keeps citing it. Warns past
  * 90 days, naming the pinned date and the listing where a newer table is discovered.
- * ponytail: a LINT, never a fetch — doctor stays cache-only (T17); the operator (or RELEASING.md's
- * release-time check) reads the listing and bumps the constant.
+ * ponytail: the listing itself is never fetched; the operator (or RELEASING.md's release-time
+ * check) reads it and bumps the constant.
  */
 export function liveBenchStalenessFinding(now) {
     const pinnedMs = Date.parse(`${LIVEBENCH_TABLE_DATE.replace(/_/g, "-")}T00:00:00Z`);
@@ -356,9 +356,20 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     // Operator directive 2026-08-12 (declutter): long per-model lists render only when asked for.
     const listAllModels = _argv.includes("--models");
     const cfg = loadConfig(cwd);
-    // T17: synchronous/cache-only by operator ruling. The only network-bearing catalog function is the
-    // separately invoked refreshCatalogCommand; ordinary doctor never calls it.
-    const catalog = opts.catalog ?? readCachedCatalog(cwd, { now: opts.catalogNow });
+    let catalog = opts.catalog ?? readCachedCatalog(cwd, { now: opts.catalogNow });
+    let catalogRefreshWarning;
+    // RULING-222-17 reverses cache-only for these two operator-facing commands only. The refresh
+    // remains age-guarded; compile, plan, and run never import this path.
+    if (!opts.catalog && catalog.source === "cache" && catalog.stale) {
+        const refreshed = await refreshCatalogCommand({
+            repoRoot: cwd,
+            fetcher: opts.catalogFetcher,
+            timeoutMs: CATALOG_REFRESH_TIMEOUT_MS,
+            now: opts.catalogNow,
+        });
+        catalog = refreshed.catalog;
+        catalogRefreshWarning = refreshed.warning;
+    }
     // banner at START — the logo greets the operator before the ~60s probe wait, never trailing it (operator report 2026-07-17)
     if (opts.banner !== false && visual())
         process.stdout.write(BANNER);
@@ -455,6 +466,9 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     if (catalog.warning) {
         rows.push(attentionRow(`model catalog cache unreadable — ${catalog.warning}; using vendored fallback (advisory — routing unchanged)`));
     }
+    if (catalogRefreshWarning) {
+        rows.push(attentionRow(`model catalog auto-refresh failed open — ${catalogRefreshWarning}; retained ${catalog.source} catalog`));
+    }
     // v1.48 T1 / v1.86 T12: advisory sweep for known agent CLIs with no drive contract. Presence is
     // resolved through the worker's login shell; advisory targets are never executed or written to health.
     rows.push(...detectCandidateClis({ cwd }).map(({ binary, path }) => alignedStatusRow("warn", binary, `detected at ${path} (no drive contract — not routable)`)));

package/dist/cli/commands/fleet.d.ts

@@ -1,3 +1,4 @@
+import { type CatalogFetcher, type CatalogReadResult } from "../../adapters/catalog-remote.js";
 import type { WorkerAdapter } from "../../adapters/types.js";
 import type { FleetEditorResult } from "../../tui/ink/fleet-app.js";
 type FleetEditorProps = Parameters<typeof import("../../tui/ink/fleet-app.js").runFleetInkEditor>[0];
@@ -16,6 +17,8 @@ export type FleetIO = {
     output?: FleetOutput;
     debug?: boolean;
     reloadGuard?: (bytes: string) => string | null;
+    catalogFetcher?: CatalogFetcher;
+    catalogNow?: () => Date;
 };
 export type FleetWriteHooks = {
     readPrior?: (path: string) => string;
@@ -36,6 +39,7 @@ export declare function fleet(argv: string[], cwd?: string, adapters?: WorkerAda
 export declare function assembleFleetEditor(cwd: string, adapters: WorkerAdapter[], io: FleetIO, opts: {
     globalDir: string;
     entry?: "presets" | "probe";
+    catalog?: CatalogReadResult;
 }): Promise<{
     props: FleetEditorProps;
     commit: (result: FleetEditorResult) => string;

package/dist/cli/commands/fleet.js

@@ -3,7 +3,7 @@ import { dirname } from "node:path";
 import { parseArgs } from "node:util";
 import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, modelAuthExclusions } from "../../adapters/registry.js";
 import { catalogModelAdvisory, catalogTierRanking, declaredModelWindow, fleetUnclassifiedModels } from "../../adapters/model-lints.js";
-import { readCachedCatalog } from "../../adapters/catalog-remote.js";
+import { CATALOG_REFRESH_TIMEOUT_MS, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, readClaudeAliasIdentity } from "../../adapters/claude-code.js";
 import { fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, overlayBytesLoadError, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, unifiedYamlDiff, } from "../../config/config.js";
 import { projectFleetWhy, renderFleetWhy } from "../../config/fleet-why.js";
@@ -96,6 +96,19 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
     const input = io.input ?? process.stdin;
     const output = io.output ?? process.stdout;
     const interactive = input.isTTY === true && output.isTTY === true;
+    let catalog = readCachedCatalog(cwd, { now: io.catalogNow });
+    let refreshReason = "";
+    if (catalog.source === "cache" && catalog.stale) {
+        const refreshed = await refreshCatalogCommand({
+            repoRoot: cwd,
+            fetcher: io.catalogFetcher,
+            timeoutMs: CATALOG_REFRESH_TIMEOUT_MS,
+            now: io.catalogNow,
+        });
+        catalog = refreshed.catalog;
+        if (refreshed.warning)
+            refreshReason = `fleet: catalog auto-refresh failed open — ${refreshed.warning}; retained ${catalog.source} catalog`;
+    }
     if (print) {
         // v1.51 T4: the print surface names the mode and its source layer right under the header —
         // comment-prefixed so the YAML body stays machine-parseable and regex-stable.
@@ -104,10 +117,10 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         const nl = body.indexOf("\n");
         // Steering comes from the same resolved config snapshot the editor consumes below,
         // not from another parse of either raw overlay.
-        return `${body.slice(0, nl)}\n# mode: ${rm.mode.mode} (${rm.source})${body.slice(nl)}${formatFleetSteering(rm.cfg)}`;
+        return `${body.slice(0, nl)}\n# mode: ${rm.mode.mode} (${rm.source})${refreshReason ? `\n# ${refreshReason}` : ""}${body.slice(nl)}${formatFleetSteering(rm.cfg)}`;
     }
     if (!why && !interactive)
-        return { out: NON_TTY_MSG, code: 1 };
+        return { out: `${refreshReason ? `${refreshReason}\n` : ""}${NON_TTY_MSG}`, code: 1 };
     // OBS-528: `--fresh` parsed since v1.92 but nothing ever RAN the probe — it forced the reuse
     // gate false and guaranteed the "probe data missing or stale" refusal. The law stands — the
     // EDITOR never probes (previews stay cache-only, `r` still exits to the operator) — but the
@@ -119,11 +132,11 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
             output.write(`${await doctor([], cwd, adapters, { banner: false, compact: true })}\n`);
         }
     }
-    const assembled = await assembleFleetEditor(cwd, adapters, io, { globalDir });
+    const assembled = await assembleFleetEditor(cwd, adapters, io, { globalDir, catalog });
     if ("unavailable" in assembled)
-        return { out: assembled.unavailable, code: 1 };
+        return { out: `${refreshReason ? `${refreshReason}\n` : ""}${assembled.unavailable}`, code: 1 };
     if (why)
-        return assembled.renderWhy();
+        return `${refreshReason ? `${refreshReason}\n` : ""}${assembled.renderWhy()}`;
     // Keep Ink out of print, non-TTY, and missing-probe paths: the component runtime belongs
     // exclusively to the interactive editor. The capture window brackets only the dynamic Ink
     // import — keys typed while the module loads land in props.initialInput, never get dropped.
@@ -155,7 +168,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
     }
     assembled.props.initialInput = initialInput;
     const result = await runFleetInkEditor(assembled.props);
-    return assembled.commit(result);
+    return `${refreshReason ? `${refreshReason}\n` : ""}${assembled.commit(result)}`;
 }
 /** Everything between the doctor-reuse gate and the Ink render, packaged for reuse: `tickmarkr init`
  * runs the same editor (entry="presets": Esc is HOME to the preset overlay, never a bare quit)
@@ -192,7 +205,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     // OBS-508: the same catalog evidence doctor's drift overlay prints now rides each unclassified
     // row — it prefills the classify flow and feeds the bulk `s` stage. Suggestions stay advisory:
     // only the review-diff confirm writes, so "tickmarkr never applies" holds with less typing.
-    const catalog = readCachedCatalog(cwd);
+    const catalog = opts.catalog ?? readCachedCatalog(cwd);
     // The same alias→identity resolution doctor hands its advisory rows: models.dev has never heard of
     // `opus`, so without it the fleet's own frontier models drop out of the universe they are supposed
     // to anchor and fleet bands a different set than doctor for one fleet. The stored identity wins;
@@ -203,9 +216,32 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         : readClaudeAliasIdentity(cwd, model) ?? CLAUDE_ALIAS_IDENTITY_STAMPS[model];
     // One ranking universe for the whole screen: every unclassified row bands fleet-relatively
     // against the same set, so a suggestion never depends on which adapter group renders first.
-    const unclassifiedRows = fleetUnclassifiedModels(cfg, health, adapters)
+    const detectedRows = fleetUnclassifiedModels(cfg, health, adapters)
         .map((row) => ({ ...row, resolvedModel: resolvedCatalogModel(row.adapter, row.model) }));
-    const catalogRanking = catalogTierRanking(cfg, catalog, unclassifiedRows, resolvedCatalogModel);
+    const catalogRanking = catalogTierRanking(cfg, catalog, detectedRows, resolvedCatalogModel);
+    const foldedRows = [];
+    const folds = new Map();
+    for (const row of detectedRows) {
+        const advisory = catalogModelAdvisory(cfg, catalog, row.adapter, row.model, row.resolvedModel, catalogRanking);
+        const evidence = advisory.coverage === "covered" ? advisory.evidence : undefined;
+        const score = evidence?.agenticCodingScore ?? evidence?.intelligenceIndex ?? evidence?.codingScore;
+        const next = { ...row, advisory, ...(score !== undefined ? { score } : {}) };
+        const foldKey = evidence ? `${row.adapter}:${evidence.catalogId}` : undefined;
+        const first = foldKey ? folds.get(foldKey) : undefined;
+        if (first) {
+            first.foldedModels ??= [first.model];
+            first.foldedModels.push(row.model);
+        }
+        else {
+            foldedRows.push(next);
+            if (foldKey)
+                folds.set(foldKey, next);
+        }
+    }
+    const unclassifiedRows = foldedRows.sort((a, b) => Number(!!b.advisory.suggestion) - Number(!!a.advisory.suggestion)
+        || (b.detectedAt ?? "").localeCompare(a.detectedAt ?? "")
+        || (b.score ?? Number.NEGATIVE_INFINITY) - (a.score ?? Number.NEGATIVE_INFINITY)
+        || a.model.localeCompare(b.model));
     // OBS-508 follow-through: the browser renders the metadata the assembler always had — catalog
     // ctx/price evidence and doctor's model-probe wall clock — as columns instead of dropping them.
     const rowEvidence = (adapter, model, evidence) => {
@@ -239,14 +275,17 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 ...unclassified
                     .filter((row) => !editable.tiers[adapter.id]?.[row.model])
                     .map((row) => {
-                    const advisory = catalogModelAdvisory(cfg, catalog, adapter.id, row.model, row.resolvedModel, catalogRanking);
-                    const evidence = rowEvidence(adapter.id, row.model, advisory.coverage === "covered" ? advisory.evidence : undefined);
+                    const evidence = rowEvidence(adapter.id, row.classifyModel ?? row.model, row.advisory.coverage === "covered" ? row.advisory.evidence : undefined);
                     return {
                         model: row.model,
                         detectedAt: row.detectedAt,
+                        ...(row.classifyModel ? { classifyModel: row.classifyModel } : {}),
+                        ...(row.variants ? { variants: row.variants } : {}),
+                        ...(row.foldedModels ? { foldedModels: row.foldedModels } : {}),
+                        ...(row.score !== undefined ? { score: row.score } : {}),
                         ...(evidence ? { evidence } : {}),
-                        ...(advisory.suggestion
-                            ? { suggestion: { tier: advisory.suggestion.tier, note: advisory.suggestion.provenanceNote } }
+                        ...(row.advisory.suggestion
+                            ? { suggestion: { tier: row.advisory.suggestion.tier, note: row.advisory.suggestion.provenanceNote } }
                             : {}),
                     };
                 }),

package/dist/cli/commands/plan.js

@@ -1,7 +1,7 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { parseArgs } from "node:util";
-import { allAdapters, discoverChannels, doctorAgeMs, modelAuthExclusions, probeAll, readDoctor, servableExclusions, servabilityLine } from "../../adapters/registry.js";
+import { allAdapters, doctorAgeMs, modelAuthExclusions, probeAll, readDoctor, rolePools, servableExclusions, servabilityLine } from "../../adapters/registry.js";
 import { formatModelAuthLine, contextWindowLints, modelLints, preferEntryLints, ttyVisual } from "../../adapters/model-lints.js";
 import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
@@ -10,11 +10,11 @@ import { DEFAULT_CONFIG, overlayPreferShapes, ROUTING_MODES, TIER_RANK } from ".
 import { loadGraph } from "../../graph/graph.js";
 import { renderAcceptanceItem } from "../../graph/schema.js";
 import { resolveRunMode } from "../../run/daemon.js";
-import { excludedChannels, exclusionLine } from "../../route/preference.js";
+import { disallowedBy, excludedChannels, exclusionLine, routingEntrySeatLines } from "../../route/preference.js";
 import { staffLedEvidence } from "../../route/profile.js";
 import { route, RoutingError } from "../../route/router.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
-import { modelId } from "../../gates/review.js";
+import { modelId, modelProvider } from "../../gates/review.js";
 import { loadRoutingProfile } from "../../run/journal.js";
 import { harnessLine, resolveHarness } from "../harness.js";
 import { shq } from "../../adapters/types.js";
@@ -153,7 +153,8 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     // readDoctor cache path: staleness line only fires here (probeAll fallback is fresh by construction).
     const cached = readDoctor(cwd);
     const health = cached ?? (await probeAll(adapters));
-    const channels = discoverChannels(cfg, adapters, health);
+    const pools = rolePools(cfg, adapters, health);
+    const channels = pools.worker;
     // VIS-04 trust ramp (VALIDATION 13-01-11): preview:true bypasses the routing.learned:off short-circuit so
     // the static-vs-learned comparison renders even when the daemon's learned routing is off. Cold ⇒ undefined ⇒
     // output byte-identical to today.
@@ -175,6 +176,13 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
         harnessLine(resolveHarness(harnessFrom)),
         "",
     ];
+    const judgeDeny = disallowedBy(cfg.judge, cfg.routing, "judge");
+    if (judgeDeny?.by === "deny") {
+        lines.push(`REFUSAL OBS-576: judge seat ${cfg.judge.adapter}:${cfg.judge.model} is removed by flat routing.deny (${judgeDeny.entry}) — move worker-only policy to routing.deny.workers`, "");
+    }
+    const entrySeats = routingEntrySeatLines(cfg);
+    if (entrySeats.length)
+        lines.push(...entrySeats, "");
     const derivation = (shape) => {
         const floor = cfg.routing.floors[shape];
         return floor ? `    floor ${floor} ← ${mode.provenance[shape] ?? "config floors"}` : null;
@@ -235,6 +243,22 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     lints.push(...modelLints(cfg, health, adapters, { tty: ttyVisual() })); // health may be pre-v1.5/probeAll-fallback — no-detection branch covers both
     // v1.54 T3: dead-steering sweep — advisory only, renders with the routing lints, never alters routing.
     lints.push(...preferEntryLints(cfg, health, overlayPreferShapes(cwd)));
+    const preferMatches = (entry, pool) => pool.some((c) => entry === c.adapter || entry === `${c.adapter}:${c.model}`);
+    const lintInertPrefer = (surface, entries, poolName, pool) => {
+        for (const entry of entries ?? []) {
+            if (!preferMatches(entry, pool))
+                lints.push(`${surface} '${entry}' resolves to no live channel of ${poolName} pool`);
+        }
+    };
+    for (const [shape, entry] of Object.entries(cfg.routing.map)) {
+        lintInertPrefer(`routing.map.${shape}.prefer`, entry.prefer, "worker", pools.worker);
+    }
+    lintInertPrefer("review.prefer", cfg.review.prefer, "review", pools.review);
+    lintInertPrefer("consult.prefer", cfg.consult.prefer, "consult", pools.consult);
+    const reviewProviders = new Set(pools.review.map((c) => modelProvider(c.model, c.vendor)));
+    if (pools.review.length > 0 && reviewProviders.size < 2) {
+        lints.push(`review pool concentration: ${pools.review.length} channel(s), ${reviewProviders.size} provider(s)`);
+    }
     // The guard here was `channels.length && !fleetCanCrossVendorReview(channels)`, so the review lint went
     // SILENT at zero channels — the first-run state, where review.required is set and nothing can route at all.
     // Deleting that clause outright is worse than the silence: it fires "no cross-vendor reviewer pair in fleet"
@@ -245,7 +269,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     if (cfg.review.required && channels.length === 0) {
         lints.push("review: review.required is set but no channel can route — the fleet is empty; install or authenticate an adapter");
     }
-    else if (cfg.review.required && !fleetCanCrossVendorReview(channels)) {
+    else if (cfg.review.required && !fleetCanCrossVendorReview(pools.review)) {
         lints.push("review: no cross-vendor reviewer pair in fleet — set review.required: false to waive");
     }
     let cost = 0;

package/dist/cli/commands/status.d.ts

@@ -21,6 +21,7 @@ export declare const GATE_KEYS: {
     readonly acceptance: "A";
     readonly review: "R";
 };
+export declare const STATUS_HELP = "usage: tickmarkr status [<runId>] [--watch [--events]] [--oneline]\nWith --watch --events, stdout is one JSON document per decision event and stderr carries keepalive lines.\nDo not merge stdout and stderr (for example with 2>&1): doing so corrupts the JSON document stream.";
 export declare const decisionEventsFromJournal: (events: JournalEvent[], runId: string, stateDir?: string) => DecisionEvent[];
 export declare const taskBox: (status: TaskStatus) => string;
 export declare const gateBox: (state: "open" | "pass" | "fail" | "skip", unicode: boolean) => string;

package/dist/cli/commands/status.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
+import * as os from "node:os";
 import { join } from "node:path";
 import { GLYPHS, LIVE } from "../../brand.js";
 import { DEFAULT_CONFIG, loadConfig } from "../../config/config.js";
@@ -108,6 +109,11 @@ const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇",
 const ASCII_SPINNER = ["|", "/", "-", "\\"];
 const SAVE_TERMINAL_TITLE = "\x1b[22;0t";
 const RESTORE_TERMINAL_TITLE = "\x1b[23;0t";
+const ENTER_ALTERNATE_SCREEN = "\x1b[?1049h";
+const LEAVE_ALTERNATE_SCREEN = "\x1b[?1049l";
+export const STATUS_HELP = `usage: tickmarkr status [<runId>] [--watch [--events]] [--oneline]
+With --watch --events, stdout is one JSON document per decision event and stderr carries keepalive lines.
+Do not merge stdout and stderr (for example with 2>&1): doing so corrupts the JSON document stream.`;
 const decisionEvidence = (stateDir, runId, sequence) => `${stateDir}/runs/${runId}/journal.jsonl#L${sequence}`;
 const DECISION_GATE_VERDICTS = {
     passed: "passed",
@@ -1109,7 +1115,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
     const tally = tipPhase
         ? `${progressTone(`${progressGlyph} ${done}/${total} tasks done`)}${dot}${progressTone("run not verified")}`
         : done === total && total > 0 ? ok(`${done}/${total} done`) : information(`${done}/${total} done`);
-    const live = liveness(events, daemon, now)
+    const live = `${liveness(events, daemon, now)} · load1 ${os.loadavg()[0].toFixed(2)}`
         .replace(/\bdead\b/u, fail("dead"))
         .replace(/\bfinished\b/u, dim("finished"))
         .replace(/\balive\b/u, running("alive"))
@@ -1324,6 +1330,8 @@ const oneLine = (cwd, namedRunId) => {
     return sanitizeTaskText([record.runId, ...claims].join(" · "));
 };
 export async function status(argv, cwd = process.cwd(), opts = {}) {
+    if (argv.some((arg) => arg === "--help" || arg === "-h"))
+        return STATUS_HELP;
     const namedRunId = positionalRunId(argv);
     if (argv.includes("--oneline"))
         return oneLine(cwd, namedRunId);
@@ -1456,6 +1464,13 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
     // a dead board keeps writing and reads ARMED. That is the over-claiming direction, the one an operator
     // acts on, and the one this instrument exists to close.
     const armed = bounded ? undefined : armWatchSupervision(cwd, opts.supervisionBeatMs);
+    let alternateScreen = false;
+    const leaveAlternateScreen = () => {
+        if (!alternateScreen)
+            return;
+        alternateScreen = false;
+        process.stdout.write(LEAVE_ALTERNATE_SCREEN);
+    };
     let titleSaved = false;
     const restoreTitle = () => {
         if (!titleSaved)
@@ -1478,6 +1493,28 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
         }
         process.stdout.write(`\x1b]0;⏳ ${hotPhase.taskId} ${phaseLabel(hotPhase)} ${fmtElapsed(nowMs - hotPhase.startedAt)}\x07`);
     };
+    const signalHandlers = [];
+    const exitFromSignal = (code) => () => {
+        if (titleSaved) {
+            process.removeListener("exit", restoreTitle);
+            restoreTitle();
+        }
+        if (alternateScreen) {
+            process.removeListener("exit", leaveAlternateScreen);
+            leaveAlternateScreen();
+        }
+        process.exit(code);
+    };
+    if (!bounded && !eventStream && tty) {
+        process.stdout.write(ENTER_ALTERNATE_SCREEN);
+        alternateScreen = true;
+        process.once("exit", leaveAlternateScreen);
+        for (const [signal, code] of [["SIGINT", 130], ["SIGTERM", 143]]) {
+            const handler = exitFromSignal(code);
+            signalHandlers.push([signal, handler]);
+            process.once(signal, handler);
+        }
+    }
     try {
         for (let i = 0; i < iterations; i++) {
             const nowMs = now();
@@ -1490,6 +1527,7 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
                     if (bounded)
                         eventLines.push(line);
                 }
+                process.stderr.write("status: keepalive\n");
             }
             else {
                 frame = renderFrame(cwd, binaryVersion, nowMs, i, workerLiveness, true, namedRunId);
@@ -1525,6 +1563,12 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
             process.removeListener("exit", restoreTitle);
             restoreTitle();
         }
+        for (const [signal, handler] of signalHandlers)
+            process.removeListener(signal, handler);
+        if (alternateScreen) {
+            process.removeListener("exit", leaveAlternateScreen);
+            leaveAlternateScreen();
+        }
     }
     return bounded ? eventStream ? eventLines.join("\n") : frames.join(sep) : "";
 }

package/dist/cli/commands/verify.d.ts

@@ -9,6 +9,7 @@ export declare function verifyStateRoot(cwd: string): Promise<string>;
 /** Cache identity is repository content, never a checkout path. */
 export declare function baselineCachePath(cwd: string, baseSha: string, commands: Record<string, string>): string;
 export declare function excludeAuthorProvider(channels: BillingChannel[], author: BillingChannel): BillingChannel[];
+export declare const VERIFY_HELP = "usage: tickmarkr verify [--base <ref>] [--criteria <file> | --task <id>] [--json]\nThe final verdict and JSON result are written to stdout; progress and diagnostics are written to stderr.\nDo not merge stdout and stderr (for example with 2>&1): doing so corrupts the verdict stream.";
 export declare function verify(argv: string[], cwd?: string): Promise<{
     out: string;
     code: number;

package/dist/cli/commands/verify.js

@@ -125,7 +125,12 @@ async function warnWideTaskRange(cwd, stateRoot, taskId, mergeBase) {
         console.error(`verify: WARNING --task ${taskId} range also carries merge commit(s) for ${others.map((row) => `${row.taskId} ${row.commit.slice(0, 12)}`).join(", ")}; ${taskId}'s own merge ${own.commit} is the intended HEAD`);
     }
 }
+export const VERIFY_HELP = `usage: tickmarkr verify [--base <ref>] [--criteria <file> | --task <id>] [--json]
+The final verdict and JSON result are written to stdout; progress and diagnostics are written to stderr.
+Do not merge stdout and stderr (for example with 2>&1): doing so corrupts the verdict stream.`;
 export async function verify(argv, cwd = process.cwd()) {
+    if (argv.some((arg) => arg === "--help" || arg === "-h"))
+        return { out: VERIFY_HELP, code: 0 };
     const { values } = parseArgs({
         args: argv,
         options: {

package/dist/cli/index.d.ts

@@ -5,7 +5,7 @@ export type CommandResult = string | {
 };
 export type CommandMap = Record<string, (argv: string[]) => Promise<CommandResult>>;
 export declare const COMMANDS: CommandMap;
-export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> draft a compiled native spec beside an answered intent (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          run checked-in fixtures against every channel in isolated temp repos\n  run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)\n  status        live run state\n  stats         all-run channel delivery, red, rescue, author and reviewer statistics\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 no daemon, one verdict (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md for committable execution record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open the Fleet Studio TUI (full-screen tabbed cockpit)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   record one supervision beat for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume";
+export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> draft a compiled native spec beside an answered intent (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          run checked-in fixtures against every channel in isolated temp repos\n  run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)\n  status        live run state (--watch --events: JSON documents on stdout, keepalives on stderr; 2>&1 corrupts the stream)\n  stats         all-run channel delivery, red, rescue, author and reviewer statistics\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 verdict/JSON on stdout, progress on stderr; 2>&1 corrupts the verdict stream (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md for committable execution record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open the Fleet Studio TUI (full-screen tabbed cockpit)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   record one supervision beat for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume";
 export declare function dispatch(cmd: string | undefined, argv: string[], commands?: CommandMap): Promise<{
     out: string;
     code: number;

package/dist/cli/index.js

@@ -37,9 +37,9 @@ usage: tickmarkr <command>
   plan          dry-run routing table + cost estimate + floor lints
   eval          run checked-in fixtures against every channel in isolated temp repos
   run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)
-  status        live run state
+  status        live run state (--watch --events: JSON documents on stdout, keepalives on stderr; 2>&1 corrupts the stream)
   stats         all-run channel delivery, red, rescue, author and reviewer statistics
-  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD — no daemon, one verdict (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])
+  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD — verdict/JSON on stdout, progress on stderr; 2>&1 corrupts the verdict stream (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])
   resume <id>   continue a run from its journal
   report <id>   cost/quality report (--md for committable execution record)
   profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)

package/dist/compile/collateral.d.ts

@@ -149,14 +149,7 @@ export declare function reviewParticipationErrors(tasks: ReadonlyArray<Pick<Task
  * whose task objects carry no `context` gets byte-identical verdicts to the ones it got before the
  * field existed, because an absent declaration grants no authority at all.
  *
- * KNOWN GAP (R2 review, T6/T7 scope): the compile seam in src/compile/index.ts
- * (`enforceTaskUnitContract`) does not thread `compileSource`'s `root` argument into this call, so a
- * PROGRAMMATIC compile whose target repo differs from process.cwd() resolves the wrong root and can
- * miss that repo's own `review.criticalPaths`. Threading it is one line in src/compile/index.ts,
- * outside this task's file scope. Two things bound the exposure meanwhile, both live: the critical
- * set here is the UNION with the shipped defaults, so a wrong root can never lower enforcement below
- * the shipped floor; and the review GATE — which is handed the run's real config — refuses to skip a
- * critical path itself (src/gates/review.ts), so a lint this seam misses costs a late verdict rather
- * than an unreviewed one. The compile lint is the early warning; the gate is the fail-closed backstop.
+ * The compile seam in src/compile/index.ts threads `compileSource`'s repo root here, so CLI tests
+ * and programmatic compiles check the same repository overlay the later run will use.
  */
 export declare function taskUnitContractErrors(tasks: ReadonlyArray<Pick<Task, "id" | "goal" | "files" | "deps" | "acceptance" | "shape"> & Partial<Pick<Task, "context">>>, repoRoot?: string, review?: ReviewParticipation): string[];

package/dist/compile/collateral.js

@@ -896,15 +896,8 @@ function activeReviewParticipation(repoRoot) {
  * whose task objects carry no `context` gets byte-identical verdicts to the ones it got before the
  * field existed, because an absent declaration grants no authority at all.
  *
- * KNOWN GAP (R2 review, T6/T7 scope): the compile seam in src/compile/index.ts
- * (`enforceTaskUnitContract`) does not thread `compileSource`'s `root` argument into this call, so a
- * PROGRAMMATIC compile whose target repo differs from process.cwd() resolves the wrong root and can
- * miss that repo's own `review.criticalPaths`. Threading it is one line in src/compile/index.ts,
- * outside this task's file scope. Two things bound the exposure meanwhile, both live: the critical
- * set here is the UNION with the shipped defaults, so a wrong root can never lower enforcement below
- * the shipped floor; and the review GATE — which is handed the run's real config — refuses to skip a
- * critical path itself (src/gates/review.ts), so a lint this seam misses costs a late verdict rather
- * than an unreviewed one. The compile lint is the early warning; the gate is the fail-closed backstop.
+ * The compile seam in src/compile/index.ts threads `compileSource`'s repo root here, so CLI tests
+ * and programmatic compiles check the same repository overlay the later run will use.
  */
 export function taskUnitContractErrors(tasks, repoRoot = process.cwd(), review = activeReviewParticipation(repoRoot)) {
     return [

package/dist/compile/index.d.ts

@@ -10,6 +10,9 @@ export type PlanIR = {
     tasks: RunGraph["tasks"];
 };
 export type PlanFinalizationHook = (plan: PlanIR) => PlanIR;
+export type CompileOptions = {
+    strict?: boolean;
+};
 export declare function finalizePlan(plan: PlanIR, src: string, repoRoot?: string): RunGraph;
-export declare function compileSource(src: string, type?: SourceType, root?: string, beforeFinalize?: PlanFinalizationHook): RunGraph;
+export declare function compileSource(src: string, type?: SourceType, root?: string, beforeFinalize?: PlanFinalizationHook, options?: CompileOptions): RunGraph;
 export {};