tickmarkr 2.3.0 → 2.4.1

package/dist/compile/collateral.js

@@ -460,23 +460,18 @@ export function newDirectoryLints(tasks, repoRoot) {
     }
     return lines;
 }
-/**
- * OBS-76 class: sweep src/ for out-of-scope source files that reference a symbol the acceptance
- * criteria name — the v1.52 router.ts omission, named at plan time instead of one judge round in.
- * Advisory plan output only, same contract as collateralLints.
- */
-export function sourceScopeLints(tasks, repoRoot) {
-    const newDirLints = newDirectoryLints(tasks, repoRoot);
+/** Structured OBS-76 findings shared by human rendering and native compile enforcement. */
+export function sourceScopeFindings(tasks, repoRoot) {
     const perTask = tasks
         .map((t) => ({ t, needles: criteriaSymbols(t.acceptance) }))
         .filter((x) => x.needles.length);
     if (!perTask.length)
-        return newDirLints;
+        return [];
     const srcFiles = walkCode(repoRoot, "src");
     if (!srcFiles.length)
-        return newDirLints;
+        return [];
     const read = makeReader(repoRoot);
-    const lines = [];
+    const findings = [];
     for (const { t, needles } of perTask) {
         // OBS-22: scopeGate accepts picomatch globs; advisory warnings must agree.
         const scoped = filesGlob(t.files.map((f) => f.replace(/^\.\//, "")));
@@ -495,11 +490,23 @@ export function sourceScopeLints(tasks, repoRoot) {
         if (!hits.length)
             continue;
         hits.sort();
-        const listed = hits.slice(0, MAX_HITS_PER_TASK).join(", ");
-        const tail = hits.length > MAX_HITS_PER_TASK ? " (capped)" : "";
-        lines.push(`${t.id}: criteria implicate out-of-scope source not in files[]: ${listed}${tail}`);
+        findings.push({ taskId: t.id, paths: hits });
     }
-    return [...newDirLints, ...lines];
+    return findings;
+}
+/** Human display is derived from the structured finding; no enforcement path parses this text. */
+export function renderSourceScopeFinding(finding) {
+    const listed = finding.paths.slice(0, MAX_HITS_PER_TASK).join(", ");
+    const tail = finding.paths.length > MAX_HITS_PER_TASK ? " (capped)" : "";
+    return `${finding.taskId}: criteria implicate out-of-scope source not in files[]: ${listed}${tail}`;
+}
+/**
+ * OBS-76 class: sweep src/ for out-of-scope source files that reference a symbol the acceptance
+ * criteria name — the v1.52 router.ts omission, named at plan time instead of one judge round in.
+ * Advisory plan output only, same contract as collateralLints.
+ */
+export function sourceScopeLints(tasks, repoRoot, findings = sourceScopeFindings(tasks, repoRoot)) {
+    return [...newDirectoryLints(tasks, repoRoot), ...findings.map(renderSourceScopeFinding)];
 }
 // ── Task Unit Contract (OBS-212 / OBS-214) ────────────────────────────────────────────────────
 // These are ERRORS, not advisories. Everything above this line is a plan-time warning the author
@@ -835,9 +842,9 @@ export function symbolOwnershipErrors(tasks, repoRoot) {
  * cannot be a warning, because nothing downstream would stop it — the gate would honour the policy.
  */
 export function reviewParticipationErrors(tasks, review) {
-    // The shipped critical paths are a FLOOR, not a default that a config replaces: this lint resolves
-    // its config from a repo root the compile seam cannot always name (see taskUnitContractErrors), and
-    // the one direction that must never happen is a wrong root lowering enforcement below what tickmarkr
+    // The shipped critical paths are a FLOOR, not a default that a config replaces: a programmatic
+    // compile may rely on taskUnitContractErrors' process.cwd() default, and the one direction that
+    // must never happen is a mismatched invocation root lowering enforcement below what tickmarkr
     // ships. Union is monotone — a repo-local list can only add.
     const critical = [...new Set([...DEFAULT_REVIEW_CRITICAL_PATHS, ...(review.criticalPaths ?? [])])];
     const errors = [];
@@ -871,11 +878,10 @@ export function reviewParticipationErrors(tasks, review) {
     return errors;
 }
 /**
- * The ACTIVE participation config for a compile rooted at `repoRoot`. Same default-argument contract
- * as `repoRoot` itself: the CLI and daemon compile from inside the target repo, so the repo's own
- * config (plus the global overlay) is the config the run will gate under. A config the loader cannot
- * read degrades to the shipped defaults rather than crashing the compile — every command that reaches
- * this seam loads the same config itself and reports a malformed one loudly.
+ * The ACTIVE participation config for a compile rooted at `repoRoot`. CLI compilation supplies its
+ * target root; a programmatic caller that omits it uses taskUnitContractErrors' process.cwd() default,
+ * so its active overlay is the invocation repository. Native CLI compiles independently read the
+ * overlay fail-closed at the finalization seam, so malformed YAML is loud.
  */
 function activeReviewParticipation(repoRoot) {
     try {
@@ -888,23 +894,16 @@ function activeReviewParticipation(repoRoot) {
 }
 /**
  * Every Task Unit Contract violation in one pass, ready to throw. `repoRoot` backs the
- * symbol-ownership lint and the participation config, and defaults to the invocation directory —
- * correct for the CLI/daemon, which compile from inside the target repo.
+ * symbol-ownership lint and participation overlay, and defaults to the invocation directory for
+ * programmatic compiles. The CLI passes its target repository explicitly.
  *
  * The read declaration (`context:`) rides on this parameter, on the task objects themselves — the
  * aggregator never infers it from the repo, the config, or a sibling task. It is OPTIONAL: a caller
  * whose task objects carry no `context` gets byte-identical verdicts to the ones it got before the
  * field existed, because an absent declaration grants no authority at all.
  *
- * KNOWN GAP (R2 review, T6/T7 scope): the compile seam in src/compile/index.ts
- * (`enforceTaskUnitContract`) does not thread `compileSource`'s `root` argument into this call, so a
- * PROGRAMMATIC compile whose target repo differs from process.cwd() resolves the wrong root and can
- * miss that repo's own `review.criticalPaths`. Threading it is one line in src/compile/index.ts,
- * outside this task's file scope. Two things bound the exposure meanwhile, both live: the critical
- * set here is the UNION with the shipped defaults, so a wrong root can never lower enforcement below
- * the shipped floor; and the review GATE — which is handed the run's real config — refuses to skip a
- * critical path itself (src/gates/review.ts), so a lint this seam misses costs a late verdict rather
- * than an unreviewed one. The compile lint is the early warning; the gate is the fail-closed backstop.
+ * The compile seam in src/compile/index.ts threads `compileSource`'s repo root here when supplied;
+ * otherwise this function deliberately checks process.cwd().
  */
 export function taskUnitContractErrors(tasks, repoRoot = process.cwd(), review = activeReviewParticipation(repoRoot)) {
     return [

package/dist/compile/index.d.ts

@@ -10,6 +10,9 @@ export type PlanIR = {
     tasks: RunGraph["tasks"];
 };
 export type PlanFinalizationHook = (plan: PlanIR) => PlanIR;
+export type CompileOptions = {
+    strict?: boolean;
+};
 export declare function finalizePlan(plan: PlanIR, src: string, repoRoot?: string): RunGraph;
-export declare function compileSource(src: string, type?: SourceType, root?: string, beforeFinalize?: PlanFinalizationHook): RunGraph;
+export declare function compileSource(src: string, type?: SourceType, root?: string, beforeFinalize?: PlanFinalizationHook, options?: CompileOptions): RunGraph;
 export {};

package/dist/compile/index.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
+import { parse } from "yaml";
 import { validateGraph } from "../graph/schema.js";
 import { taskUnitContractErrors } from "./collateral.js";
 import { blocksCompile, ownershipFindings, renderOwnershipFinding } from "./ownership.js";
@@ -33,8 +34,48 @@ function detect(src) {
 // tasks are too large to converge. A violation is a compile error, never a warning — the failures it
 // prevents (silently dropped commits, a 28-dispatch task) are invisible until they have already cost
 // hours, which is exactly the class of thing that has to fail at authoring time.
-function enforceTaskUnitContract(g, src) {
-    const errors = taskUnitContractErrors(g.tasks);
+function repoOverlayMode(repoRoot) {
+    if (!repoRoot)
+        return undefined;
+    const path = join(repoRoot, ".tickmarkr", "config.yaml");
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const cfg = parse(readFileSync(path, "utf8"));
+        return typeof cfg?.routing?.mode === "string" ? cfg.routing.mode : undefined;
+    }
+    catch (error) {
+        throw new CompileError(`${path} does not parse, so compile cannot prove the repository routing overlay: `
+            + `${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function hasModeOverride(src) {
+    try {
+        for (const line of readFileSync(src, "utf8").split("\n")) {
+            if (/^##\s+T\d+:/i.test(line))
+                return false;
+            if (/^mode-override:\s*true\s*(?:#.*)?$/.test(line))
+                return true;
+        }
+    }
+    catch { /* unreadable specs fail elsewhere */ }
+    return false;
+}
+function enforceModeOverlay(graph, src, repoRoot) {
+    if (graph.spec.source !== "native")
+        return;
+    // Read every native compile's overlay before checking whether either side declares a mode. A
+    // corrupt file cannot masquerade as an absent mode and silently skip the disagreement gate.
+    const overlayMode = repoOverlayMode(repoRoot);
+    if (graph.mode === undefined)
+        return;
+    if (overlayMode === undefined || overlayMode === graph.mode || hasModeOverride(src))
+        return;
+    throw new CompileError(`${src} front-matter mode ${graph.mode} disagrees with repository routing.mode ${overlayMode}; `
+        + `write mode-override: true beside the mode line to make the override explicit.`);
+}
+function enforceTaskUnitContract(g, src, repoRoot) {
+    const errors = taskUnitContractErrors(g.tasks, repoRoot);
     if (errors.length > 0) {
         throw new CompileError(`${src} violates the task unit contract (${errors.length} error${errors.length > 1 ? "s" : ""}):\n`
             + errors.map((e) => `  - ${e}`).join("\n"));
@@ -42,7 +83,7 @@ function enforceTaskUnitContract(g, src) {
     return g;
 }
 export function finalizePlan(plan, src, repoRoot) {
-    const graph = enforceTaskUnitContract(validateGraph({
+    const graph = validateGraph({
         version: plan.version,
         ...(plan.mode !== undefined ? { mode: plan.mode } : {}),
         spec: {
@@ -52,7 +93,11 @@ export function finalizePlan(plan, src, repoRoot) {
             ...(plan.base !== undefined ? { base: plan.base } : {}),
         },
         tasks: plan.tasks,
-    }), src);
+    });
+    // Overlay readability is compile truth, not a mode-disagreement optimization. Check it before
+    // other repo-dependent lints so malformed native config cannot be hidden by an earlier finding.
+    enforceModeOverlay(graph, src, repoRoot);
+    enforceTaskUnitContract(graph, src, repoRoot);
     // overseer-217 removal condition, now paid: on this milestone's authored graph the conventional
     // name map emitted 21 raw unowned-test findings; review found 1 real and 20 false, while intersecting
     // with a direct import or command-entry spawn retained the real one and left 0 false positives. That
@@ -73,11 +118,11 @@ export function finalizePlan(plan, src, repoRoot) {
     }
     return graph;
 }
-function compilePlan(src, type, root) {
+function compilePlan(src, type, root, options = {}) {
     const kind = type ?? detect(src);
     const graph = kind === "speckit" ? compileSpecKit(src)
         : kind === "gsd" ? compileGsd(src, root)
-            : kind === "native" ? compileNative(src)
+            : kind === "native" ? compileNative(src, { strict: options.strict })
                 : kind === "prd" ? compilePrd(src)
                     : null;
     if (!graph) {
@@ -93,6 +138,6 @@ function compilePlan(src, type, root) {
         tasks: graph.tasks,
     };
 }
-export function compileSource(src, type, root, beforeFinalize = (plan) => plan) {
-    return finalizePlan(beforeFinalize(compilePlan(src, type, root)), src, root);
+export function compileSource(src, type, root, beforeFinalize = (plan) => plan, options = {}) {
+    return finalizePlan(beforeFinalize(compilePlan(src, type, root, options)), src, root);
 }

package/dist/compile/native.d.ts

@@ -17,7 +17,7 @@ export declare const COLLECTABLE_TESTS = "tests/**/*.test.ts";
 export declare const LEGACY_PREFIX: string;
 export declare const TICKMARKR_NATIVE_MARKER: RegExp;
 export declare const NATIVE_MARKER: RegExp;
-export declare const AUTHORING_LINT_CODES: readonly ["criterion-scope", "dependency-closure", "dependency-coupling", "proxy-metric", "external-referent", "closed-enumeration", "one-behavior", "concern-bundle", "seam-exists"];
+export declare const AUTHORING_LINT_CODES: readonly ["criterion-scope", "dependency-closure", "dependency-coupling", "proxy-metric", "external-referent", "closed-enumeration", "one-behavior", "concern-bundle", "seam-exists", "fence-symbol-absent"];
 export type AuthoringLintCode = (typeof AUTHORING_LINT_CODES)[number];
 export interface AuthoringLintFinding {
     code: AuthoringLintCode;
@@ -31,5 +31,7 @@ export interface AuthoringLintFinding {
  * compile boundary; the remaining checks are review findings, emitted by compileNative below.
  */
 export declare function authoringLintFindings(tasks: readonly Task[], file: string): AuthoringLintFinding[];
-export declare function compileNative(file: string): RunGraph;
+export declare function compileNative(file: string, options?: {
+    strict?: boolean;
+}): RunGraph;
 export declare function specTemplate(): string;

package/dist/compile/native.js

@@ -83,6 +83,7 @@ export const AUTHORING_LINT_CODES = [
     "one-behavior",
     "concern-bundle",
     "seam-exists",
+    "fence-symbol-absent",
 ];
 // The authoring frame's observable oracle is the branch-tip test corpus, never the mutable index or
 // an author's untracked checkout. Load it once per repository: one bounded git read replaces a grep
@@ -217,6 +218,31 @@ function criterionScopeFinding(task, text, criterion, id, tests) {
         detail: `criterion names asserting file${missing.length === 1 ? "" : "s"} outside expanded files[] and context[]: ${missing.join(", ")} — ${remedy}`,
     };
 }
+// OBS-898: the fence lint's corpus is listed ONCE per compile by git (tracked plus untracked-not-ignored,
+// the same set a checkout walk sees minus the ignored trees) and filtered per task. The walk it replaces
+// descended every dot-directory (.tickmarkr/runs alone held 3 799 files here) once PER TASK, so a
+// 20-task spec compiled in seconds and the committed-spec corpus test timed out. Fail-open like
+// testsAtHead: no git answer means no corpus, and the lint stays quiet rather than wrong.
+function repoFileList(root) {
+    const ls = spawnSync("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 1 << 25 });
+    if (ls.status !== 0 || typeof ls.stdout !== "string")
+        return [];
+    return ls.stdout.split("\0").filter(Boolean).sort();
+}
+function repoFiles(files, entries) {
+    const scoped = filesGlob(entries.map((entry) => entry.replace(/^\.\//, "")));
+    return files.filter(scoped);
+}
+const PRESERVATION_RE = /\b(?:keeps?|preserves?|retains?|does\s+not\s+weaken|do\s+not\s+weaken|not\s+weaken)\b/i;
+const IDENTIFIER_SHAPED_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+function fencedIdentifiers(text) {
+    if (!PRESERVATION_RE.test(text))
+        return [];
+    return [...new Set([...text.matchAll(/`([^`\n]{1,120})`/g)]
+            .map((match) => match[1].trim())
+            .filter((token) => IDENTIFIER_SHAPED_RE.test(token) && /[A-Z0-9_$]/.test(token)))]
+        .sort();
+}
 function exportedIdentifier(root, files, identifier) {
     const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const declaration = new RegExp(`\\bexport\\s+(?:(?:declare|default|async)\\s+)*(?:function|class|const|let|var|interface|type)\\s+${escaped}\\b|\\bexport\\s*\\{[^}]*\\b${escaped}\\b`);
@@ -240,14 +266,41 @@ export function authoringLintFindings(tasks, file) {
     const root = repositoryRoot(file);
     let indexedTests;
     const testIndex = () => indexedTests ??= root ? testsAtHead(root) : [];
+    let indexedFiles;
+    const fileIndex = () => indexedFiles ??= root ? repoFileList(root) : [];
     const findings = [];
     for (const task of tasks) {
         const criteria = criterionTexts(task);
+        const taskFiles = root && task.files.length ? repoFiles(fileIndex(), task.files) : [];
+        const taskTexts = new Map(taskFiles.map((path) => {
+            try {
+                return [path, readFileSync(join(root, path), "utf8")];
+            }
+            catch {
+                return [path, ""];
+            }
+        }));
         for (const [index, text] of criteria.entries()) {
             const needsTestIndex = /`[^`\n]{2,120}`|\b\d+\s*(?:\/|of)\s*\d+\b|\b[A-Za-z0-9_.-]+\.test\.ts\b/.test(text);
             const scope = criterionScopeFinding(task, text, index + 1, id, needsTestIndex ? testIndex() : []);
             if (scope)
                 findings.push(scope);
+            for (const symbol of fencedIdentifiers(text)) {
+                // Empty files[] is the deliberately unrestricted scope and a non-repository programmatic
+                // compile has no disk corpus to prove against. But a declared files[] that expands to zero
+                // repository files is evidence, not absence: its preservation fence cannot be satisfied.
+                if (!root || task.files.length === 0)
+                    continue;
+                if ([...taskTexts.values()].some((body) => body.includes(symbol)))
+                    continue;
+                const matchDetail = taskFiles.length === 0
+                    ? `this task's files[] matched zero files on disk (${task.files.join(", ")})`
+                    : `that symbol has zero hits in this task's files[] (${taskFiles.join(", ")})`;
+                findings.push({
+                    code: "fence-symbol-absent", fixtureId: id, taskId: task.id, criterion: index + 1,
+                    detail: `preservation fence cites \`${symbol}\` but ${matchDetail} — OBS-604`,
+                });
+            }
             if (/line[- ]count|physical line|not greater than (?:the|\d)|no larger than|at most \d+ (?:lines|bytes)/i.test(text)) {
                 findings.push({ code: "proxy-metric", fixtureId: id, taskId: task.id, criterion: index + 1, detail: "criterion uses a proxy size metric; state the structural intent instead" });
             }
@@ -308,7 +361,7 @@ function renderAuthoringFinding(finding) {
     const criterion = finding.criterion === undefined ? "" : ` criterion ${finding.criterion}`;
     return `tickmarkr: authoring-lint[${finding.code}] fixture ${finding.fixtureId} task ${finding.taskId}${criterion}: ${finding.detail}`;
 }
-export function compileNative(file) {
+export function compileNative(file, options = {}) {
     if (!existsSync(file))
         throw new CompileError(`no such native spec file: ${file}`);
     const content = readFileSync(file, "utf8");
@@ -638,13 +691,17 @@ export function compileNative(file) {
         tasks,
     });
     const authoringFindings = authoringLintFindings(result.tasks, file);
-    for (const finding of authoringFindings.filter(({ code }) => code !== "criterion-scope")) {
+    const blockingCodes = new Set(["criterion-scope", "fence-symbol-absent"]);
+    const blockingFindings = authoringFindings.filter((finding) => options.strict || blockingCodes.has(finding.code));
+    for (const finding of authoringFindings.filter((finding) => !blockingFindings.includes(finding))) {
         console.warn(renderAuthoringFinding(finding));
     }
-    const scopeErrors = authoringFindings.filter(({ code }) => code === "criterion-scope");
-    if (scopeErrors.length > 0) {
-        throw new CompileError(`${file} violates the criterion-scope authoring lint (${scopeErrors.length} error${scopeErrors.length === 1 ? "" : "s"}):\n`
-            + scopeErrors.map((finding) => `  - ${renderAuthoringFinding(finding)}`).join("\n"));
+    if (blockingFindings.length > 0) {
+        const strict = options.strict ? " under --strict" : "";
+        const onlyCriterionScope = blockingFindings.every(({ code }) => code === "criterion-scope");
+        const label = onlyCriterionScope && !options.strict ? "the criterion-scope authoring lint" : `authoring lints${strict}`;
+        throw new CompileError(`${file} violates ${label} (${blockingFindings.length} error${blockingFindings.length === 1 ? "" : "s"}):\n`
+            + blockingFindings.map((finding) => `  - ${renderAuthoringFinding(finding)}`).join("\n"));
     }
     // v1.19 read-old/write-new: a plain-string acceptance item compiles as a judge oracle. This is the
     // one-time nudge toward typed oracles (command/test/judge); PRD/Spec Kit/GSD stay silent (untouched).

package/dist/compile/ownership.js

@@ -22,19 +22,41 @@ function testSources(repoRoot) {
         return [];
     }
 }
-function namedSources(test, tasks) {
-    const stem = basename(test).replace(/\.test\.ts$/, "");
+function sourceFiles(repoRoot) {
+    const root = join(repoRoot, "src");
+    try {
+        return readdirSync(root, { recursive: true, encoding: "utf8" })
+            .filter((path) => /\.(?:[cm]?[jt]sx?)$/.test(path))
+            .map((path) => `src/${normalize(path)}`)
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+// OBS-898: expand the task's source declarations against ONE source-tree listing, once per compile.
+// Tests then query this in-memory index; neither a test file nor a second corroboration pass can
+// trigger another source walk or glob expansion.
+function namedSourceIndex(tasks, allSources) {
     const matches = new Map();
     for (const task of tasks) {
-        for (const entry of task.files.map(normalize).filter((path) => path.startsWith("src/") && !/[*?{[]/.test(path))) {
-            const source = basename(entry, extname(entry));
-            if (stem === source || stem.startsWith(`${source}-`)) {
-                matches.set(`${task.id}:${entry}`, { taskId: task.id, source: entry });
+        for (const entry of task.files.map(normalize).filter((path) => path.startsWith("src/"))) {
+            const fromGlob = /[*?{[]/.test(entry);
+            const entries = fromGlob ? allSources.filter(filesGlob(entry)) : [entry];
+            for (const sourcePath of entries) {
+                matches.set(`${task.id}:${sourcePath}`, { taskId: task.id, source: sourcePath, fromGlob });
             }
         }
     }
     return [...matches.values()];
 }
+function namedSources(test, index) {
+    const stem = basename(test).replace(/\.test\.ts$/, "");
+    return index.filter(({ source }) => {
+        const sourceStem = basename(source, extname(source));
+        return stem === sourceStem || stem.startsWith(`${sourceStem}-`);
+    });
+}
 const moduleKey = (path) => normalize(path).replace(/\.(?:[cm]?[jt]sx?)$/, "");
 function directImportSpecifiers(text) {
     // Comments cannot create an edge. Keep strings intact because they are the import target.
@@ -148,19 +170,28 @@ export function ownershipFindings(tasks, repoRoot) {
             predictedBy.set(hit, ids);
         }
     }
+    const globOwnedTests = new Map();
+    const allSources = sourceFiles(repoRoot);
+    const namedIndex = namedSourceIndex(tasks, allSources);
     for (const source of sources) {
         const ids = predictedBy.get(source.path) ?? new Set();
-        for (const { taskId } of namedSources(source.path, tasks))
-            ids.add(taskId);
+        for (const named of namedSources(source.path, namedIndex)) {
+            ids.add(named.taskId);
+            if (named.fromGlob) {
+                const owners = globOwnedTests.get(source.path) ?? new Set();
+                owners.add(named.taskId);
+                globOwnedTests.set(source.path, owners);
+            }
+        }
         if (ids.size > 0)
             predictedBy.set(source.path, ids);
     }
     const findings = [];
     for (const [test, taskIds] of predictedBy) {
-        if (owners(test).length === 0) {
+        if (owners(test).length === 0 && !(globOwnedTests.get(test)?.size)) {
             const ids = [...taskIds].sort();
             const source = sourceByPath.get(test);
-            const evidence = corroboration(source, namedSources(test, tasks));
+            const evidence = corroboration(source, namedSources(test, namedIndex));
             findings.push({
                 code: "unowned-test",
                 test,

package/dist/config/config.d.ts

@@ -266,6 +266,7 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
     }, z.core.$strip>;
     review: z.ZodObject<{
         complexityThreshold: z.ZodNumber;
+        timeoutMs: z.ZodNumber;
         required: z.ZodBoolean;
         prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
         policy: z.ZodOptional<z.ZodEnum<{

package/dist/config/config.js

@@ -355,6 +355,7 @@ export const TickmarkrConfigSchema = z.object({
         // because routing hints and the setup cockpit still read it as a complexity landmark; NOTHING in
         // src/gates/review.ts reads it any more, and a value here can no longer disable a review.
         complexityThreshold: z.number(),
+        timeoutMs: z.number().int().positive(),
         required: z.boolean(),
         prefer: z.array(z.string()).optional(),
         // R3: the operator's participation floor. "full" forces a cross-vendor review on every task;
@@ -484,8 +485,15 @@ export const DEFAULT_CONFIG = {
                 // 2026-07-16 (cursor-agent 2026.07.09); gives cursor a cheap-tier channel so low-complexity shapes
                 // stop burning its mid. Operator-approved 2026-07-16.
                 "composer-2.5-fast": "cheap",
+                // OBS-871: LiveBench 2026_06_25, fetched 2026-09-03; released 2026-09-01.
+                "claude-fable-5-1": "frontier",
+                // OBS-871: LiveBench 2026_06_25, fetched 2026-09-03; released 2026-09-02.
+                "gemini-3.8-flash": "mid",
+            },
+            windows: {
+                "composer-2.5": 200_000, "composer-2.5-fast": 200_000,
+                "claude-fable-5-1": 1_000_000, "gemini-3.8-flash": 1_000_000,
             },
-            windows: { "composer-2.5": 200_000, "composer-2.5-fast": 200_000 },
         },
         // GLM-5.2 → mid per benchmark policy (2026-07): SWE-bench Pro 62.1 (> GPT-5.5 58.6), FrontierSWE 74.4 ≈ Opus 4.8;
         // no independent Terminal-Bench score → conservative mid, overlays may raise.
@@ -507,8 +515,46 @@ export const DEFAULT_CONFIG = {
         // cross-harness) is pre-existing, FLEET-05 owns it.
         pi: {
             vendor: "zhipu", channel: "sub",
-            models: { "zai/glm-5.2": "mid" },
-            windows: { "zai/glm-5.2": 1_000_000 },
+            models: {
+                "zai/glm-5.2": "mid",
+                // OBS-871: LiveBench 2026_06_25, fetched 2026-09-03; GLM-5.3 released 2026-08-18.
+                "zai/glm-5.3": "frontier",
+                // OBS-871: same LiveBench source and 2026-09-03 fetch; speed variant remains mid.
+                "zai/glm-5.3-flash": "mid",
+            },
+            windows: { "zai/glm-5.2": 1_000_000, "zai/glm-5.3": 1_000_000, "zai/glm-5.3-flash": 200_000 },
+        },
+        // OBS-871: gateway ids and bands from LiveBench 2026_06_25, fetched 2026-09-03.
+        omp: {
+            vendor: "mixed", channel: "sub",
+            models: {
+                "google/gemini-3.8-flash": "mid",
+                "zai/glm-5.3": "frontier",
+                "alibaba/qwen3.8-max": "frontier",
+            },
+            modelOverrides: {
+                "google/gemini-3.8-flash": { vendor: "google" },
+                "zai/glm-5.3": { vendor: "zhipu" },
+                "alibaba/qwen3.8-max": { vendor: "alibaba" },
+            },
+            windows: {
+                "google/gemini-3.8-flash": 1_000_000,
+                "zai/glm-5.3": 1_000_000,
+                "alibaba/qwen3.8-max": 1_000_000,
+            },
+        },
+        // OBS-871: Qwen 3.8 Max scored 64.6 in LiveBench 2026_06_25, fetched 2026-09-03.
+        qwen: {
+            vendor: "alibaba", channel: "sub",
+            models: { "qwen3.8-max": "frontier" },
+            windows: { "qwen3.8-max": 1_000_000 },
+        },
+        // OBS-871: prime-agent listed this prime-inference route on 2026-09-03; GLM-5.2 remains mid.
+        "prime-agent": {
+            vendor: "mixed", channel: "sub",
+            models: { "prime-inference/z-ai/glm-5.2": "mid" },
+            modelOverrides: { "prime-inference/z-ai/glm-5.2": { vendor: "zhipu" } },
+            windows: { "prime-inference/z-ai/glm-5.2": 1_000_000 },
         },
         // Native grok CLI (Phase 40). grok-4.5 → mid: same benchmark provenance as the retired cursor-agent
         // grok-4.5-xhigh seed above (AA 54, TB2.1 83.3%, SWE-b Pro 64.7% — researched 2026-07-10).
@@ -543,7 +589,7 @@ export const DEFAULT_CONFIG = {
     judge: { adapter: "claude-code", model: "fable" },
     // R3: no `policy` floor — the neutral floor leaves the compiler's per-task assignment standing, so
     // the path-keyed rule is reachable out of the box rather than raised to full by construction.
-    review: { complexityThreshold: 7, required: true, criticalPaths: [...DEFAULT_REVIEW_CRITICAL_PATHS] },
+    review: { complexityThreshold: 7, timeoutMs: 900_000, required: true, criticalPaths: [...DEFAULT_REVIEW_CRITICAL_PATHS] },
     consult: { adapter: "claude-code", model: "fable", stallMinutes: 15 },
     // v1.4: gate LLM calls (judge/review/consult) run headless by default; pane opts back into visible agents.
     // v1.2: workers are the real agent TUI in the pane; "print" restores the -p-rendered-in-pane path.
@@ -765,7 +811,7 @@ export function configTemplate(overlay) {
 #   test: npm test
 #   byShape:
 #     docs: { acceptance: false, review: false }  # baseline, evidence, and scope are mandatory
-# review: { complexityThreshold: 7, required: true, prefer: [codex:gpt-5.6-sol, kimi] }
+# review: { complexityThreshold: 7, timeoutMs: 900000, required: true, prefer: [codex:gpt-5.6-sol, kimi] }
 #                         # prefer: ordered reviewer seat preference (adapter | adapter:model); ranks
 #                         # diversity-eligible channels only — never admits a same-vendor/same-model reviewer
 # consult: { adapter: claude-code, model: fable, stallMinutes: 15, prefer: [codex:gpt-5.6-sol, kimi:kimi-code/k3] }

package/dist/drivers/herdr.d.ts

@@ -56,6 +56,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     private journal?;
     id: string;
     interactive: boolean;
+    readSource: string;
     private groups;
     private groupSerial;
     private deliverySerial;
@@ -70,6 +71,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     private watches;
     constructor(bin?: string, workersPerTab?: number, time?: HerdrTimeSource, journal?: DriverJournal | undefined);
     private appendDispatchRetry;
+    private appendPaneClose;
     private openRunJournal;
     private liveSupervisionSeats;
     private journalReconcile;

package/dist/drivers/herdr.js

@@ -142,6 +142,7 @@ export class HerdrDriver {
     journal;
     id = "herdr";
     interactive = true;
+    readSource = "recent-unwrapped";
     groups = new Map();
     // grouped slot()/close() mutate shared group state across awaits — serialize them so two
     // concurrent first members can never both create the group tab (mergeSerial idiom, daemon.ts)
@@ -195,6 +196,29 @@ export class HerdrDriver {
         // recovery to the file and the pipe while the operator's rail stays silent about it.
         Journal.open(repoRoot, owned.runId, this.narrate).append("dispatch-retry", owned.taskId, data);
     }
+    // OBS-906: close() is the harvest path, not a reconcile path, so the sweep's close row cannot
+    // describe it. Persist the worker slot identity beside the exact pane/tab address this path used.
+    // A driver used outside a daemon has no bound run journal; the injectable sink remains the unit
+    // seam there, while every daemon-created worktree is bound by worktree() below.
+    appendPaneClose(slot, placement) {
+        const owned = parseOwnedName(slot.name);
+        if (owned?.role !== "worker")
+            return;
+        try {
+            const data = { slot: slot.name, ...placement };
+            if (this.journal) {
+                this.journal("pane-close", slot.name, data);
+                return;
+            }
+            const repoRoot = this.journalRoots.get(slot.cwd);
+            if (!repoRoot)
+                return;
+            Journal.open(repoRoot, owned.runId, this.narrate).append("pane-close", owned.taskId, data);
+        }
+        catch {
+            /* close is best-effort; a journal failure must not make a successful pane reap fatal */
+        }
+    }
     openRunJournal(runId) {
         const roots = new Set(this.journalRoots.values());
         roots.add(process.cwd());
@@ -1100,11 +1124,15 @@ export class HerdrDriver {
             return this.serial(() => this.closeGrouped(slot));
         }
         if (slot.tabId) {
-            await this.herdr(`tab close ${shq(slot.tabId)}`); // reaps the slot's whole tab, best-effort
+            const closed = await this.herdr(`tab close ${shq(slot.tabId)}`); // reaps the slot's whole tab, best-effort
+            if (closed.code === 0)
+                this.appendPaneClose(slot, { tabId: slot.tabId });
             return;
         }
         const pane = await this.paneId(slot);
-        await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        const closed = await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        if (closed.code === 0)
+            this.appendPaneClose(slot, { paneId: pane });
     }
     // D-08 ref-counted teardown, PER GENERATION (VIS-09 item 2): pane close per member; a generation's
     // tab closes only when ITS OWN last member leaves; the group entry dies when all generations are gone.
@@ -1118,7 +1146,9 @@ export class HerdrDriver {
         if (!gen)
             return; // generation already torn down — its tab is gone
         const pane = await this.paneId(slot);
-        await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        const closed = await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        if (closed.code === 0)
+            this.appendPaneClose(slot, { paneId: pane, tabId: gen.tabId });
         gen.members = gen.members.filter((m) => m.name !== slot.name);
         await this.renameGroupTab(gen);
         if (gen.members.length === 0) {
@@ -1339,7 +1369,16 @@ export class HerdrDriver {
                 if (alive.has(tab))
                     continue;
                 const closed = await this.herdr(`tab close ${shq(tab)}`);
-                if (closed.code !== 0) {
+                if (closed.code !== 0 && /tab_not_found/i.test(`${closed.stderr}\n${closed.stdout}`)) {
+                    this.journalReconcile(journalHandle, "tab-reconcile-close-skipped", undefined, {
+                        tabId: tab,
+                        runId,
+                        sweeperRunId: runId,
+                        exitCode: 0,
+                        reason: "tab_not_found",
+                    });
+                }
+                else if (closed.code !== 0) {
                     this.journalReconcile(journalHandle, "tab-reconcile-close-failed", undefined, {
                         tabId: tab,
                         runId,