tickmarkr 2.3.0 → 2.4.1

package/dist/run/git.d.ts

@@ -90,6 +90,10 @@ export interface ShResult {
     stdout: string;
     stderr: string;
     timedOut?: boolean;
+    /** The shell exited, but descendants still held its process group and pipes past the grace. */
+    reapedGroup?: boolean;
+    /** The grace reap's group kill failed with something other than ESRCH (for example EPERM). */
+    reapError?: string;
     durationMs?: number;
     /** T7: the capacity THIS child ran under, stamped where its environment was built (see `shell`). */
     capacity?: RunCapacity;

package/dist/run/git.js

@@ -138,6 +138,9 @@ export const resetSpawnForTests = () => { spawnChild = undefined; };
 const RETRYABLE_SPAWN_CODE = "EAGAIN";
 export const SPAWN_ATTEMPT_LIMIT = 4;
 export const SPAWN_RETRY_BACKOFF_MS = 50;
+// RULING-P99-28: SHIP — every gate user can hit the inherited-pipe hang at this product seam.
+/** Give a normally-exited shell's descendants this long to close their inherited pipes themselves. */
+const SHELL_REAP_GRACE_MS = 2000;
 // stdin "ignore": same class as HARD-05 / SubprocessDriver — never leave an open pipe a child can block on
 // (pi -p / codex exec wait for stdin EOF). timedOut distinguishes SIGKILL-timeout from a real nonzero exit.
 function shell(cmd, cwd, timeoutMs, login) {
@@ -170,23 +173,42 @@ function shell(cmd, cwd, timeoutMs, login) {
         let stdout = "", stderr = "";
         const stdoutDecoder = new StringDecoder("utf8");
         const stderrDecoder = new StringDecoder("utf8");
-        let timedOut = false, done = false, started = false, outputSeen = false;
+        let timedOut = false, reapedGroup = false, done = false, started = false, outputSeen = false;
+        let reapError, exitedCode;
+        let reapTimer;
         const finish = (code, err) => {
             if (done)
                 return;
             done = true;
             clearTimeout(timer);
+            clearTimeout(reapTimer);
             stdout += stdoutDecoder.end();
             stderr += stderrDecoder.end();
-            resolve({ code, stdout, stderr: err ?? stderr, timedOut, durationMs: Date.now() - startedAt, capacity });
+            resolve({
+                code,
+                stdout,
+                stderr: err ?? stderr,
+                timedOut,
+                durationMs: Date.now() - startedAt,
+                capacity,
+                ...(reapedGroup ? { reapedGroup: true } : {}),
+                ...(reapError ? { reapError } : {}),
+            });
         };
         const timer = setTimeout(() => {
             timedOut = true;
             try {
                 process.kill(-p.pid, "SIGKILL");
             }
-            catch {
+            catch (error) {
+                const code = error?.code;
+                if (code !== "ESRCH") {
+                    reapError ??= `${code ?? "kill"}: ${error instanceof Error ? error.message : String(error)}`;
+                }
                 p.kill("SIGKILL");
+                // A failed group kill can leave inherited pipes open forever; the command ceiling still wins.
+                if (code !== "ESRCH")
+                    finish(exitedCode ?? 1);
             }
         }, timeoutMs);
         p.on("spawn", () => { started = true; }); // the command exists from here on — never retryable past it
@@ -215,9 +237,32 @@ function shell(cmd, cwd, timeoutMs, login) {
             finish(127, String(e));
         });
         p.on("close", (code) => finish(code ?? 1));
-        // "close" waits for stdio to drain; a surviving pipe-holder must not outlive the timeout
-        p.on("exit", (code) => { if (timedOut)
-            finish(code ?? 1); });
+        // "close" waits for stdio to drain. Once bash exits normally, give descendants a bounded grace
+        // to exit with it; a survivor still in bash's detached group is then reaped so its inherited pipe
+        // cannot hold this promise until the command ceiling. A real timeout wins first and is never
+        // reclassified as a grace reap.
+        p.on("exit", (code) => {
+            exitedCode = code ?? 1;
+            if (timedOut) {
+                finish(exitedCode);
+                return;
+            }
+            reapTimer = setTimeout(() => {
+                if (done)
+                    return;
+                try {
+                    process.kill(-p.pid, "SIGKILL");
+                    reapedGroup = true;
+                }
+                catch (error) {
+                    // ESRCH means the group closed in the grace race; every other error must survive to the
+                    // result while the command timeout remains the explicit backstop.
+                    const code = error?.code;
+                    if (code !== "ESRCH")
+                        reapError = `${code ?? "kill"}: ${error instanceof Error ? error.message : String(error)}`;
+                }
+            }, SHELL_REAP_GRACE_MS);
+        });
     });
     return (async () => {
         const startedAt = Date.now();

package/dist/run/journal.d.ts

@@ -196,7 +196,7 @@ export declare const PARK_KINDS: readonly ["human-gate", "ladder-exhausted", "at
 export type ParkKind = (typeof PARK_KINDS)[number];
 export declare const RETRY_MODES: readonly ["resume", "fresh", "repair"];
 export type RetryMode = (typeof RETRY_MODES)[number];
-export declare const WORKER_RESULT_CAUSES: readonly ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer"];
+export declare const WORKER_RESULT_CAUSES: readonly ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer", "startup-failure"];
 export type WorkerResultCause = (typeof WORKER_RESULT_CAUSES)[number];
 export declare function isQualityFailureParkKind(kind: ParkKind): boolean;
 export declare function classifyTaskFailure(taskEvents: JournalEvent[]): ParkKind;

package/dist/run/journal.js

@@ -5,6 +5,7 @@ import { z } from "zod";
 import { channelKey, shq, TokenUsageSchema } from "../adapters/types.js";
 import { stateDirName, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES, TIERS } from "../graph/schema.js";
+import { channelRouteIdentity } from "../route/preference.js";
 import { buildProfile, classify } from "../route/profile.js";
 import { DecisionEventSchema, trackJournalRows, } from "./protocol.js";
 import { normalizeGateOutcome } from "./outcome.js";
@@ -752,7 +753,9 @@ export function activeRetryBan(events, taskId, channel) {
             || (e.event === "task-approved" && e.data.release === RECHECK_RELEASE))
             pending = undefined;
     }
-    return pending && pending.data.channel === channel && typeof pending.data.gate === "string"
+    return pending && typeof pending.data.channel === "string"
+        && channelRouteIdentity(pending.data.channel) === channelRouteIdentity(channel)
+        && typeof pending.data.gate === "string"
         ? pending.data.gate
         : undefined;
 }
@@ -779,7 +782,7 @@ export const RETRY_MODES = ["resume", "fresh", "repair"];
 // concludes a worker while the rolling stall window still has most of its time left, so labelling it
 // stall-timeout points every downstream reader — the repair brief, the consult — at a mechanism that
 // cannot have fired.
-export const WORKER_RESULT_CAUSES = ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer"];
+export const WORKER_RESULT_CAUSES = ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer", "startup-failure"];
 // Status consumes the routing profile's existing quality split directly: verified park kinds classify
 // to 0, while availability/recovery noise classifies to null. Keep the synthetic row here at the
 // run↔route seam so presentation code never grows a second list of "bad" park kinds.

package/dist/run/lock.d.ts

@@ -9,6 +9,10 @@ export interface Inspection {
     mtimeMs: number;
     ino: number;
 }
+export type RunLineEvent = {
+    event: string;
+    ts: string;
+};
 export declare function shouldRefuse(i: Pick<Inspection, "garbage" | "dead">): boolean;
 export declare function isPidLive(pid: number): boolean;
 export declare function acquireRunLock(repoRoot: string, runId: string): {
@@ -29,6 +33,8 @@ export declare function runLockOwner(repoRoot: string): {
     runId?: string;
     live: boolean;
 } | undefined;
+export declare function runLockRunId(repoRoot: string): string | undefined;
+export declare function runStatusLine(repoRoot: string, runId: string, events: readonly RunLineEvent[]): string | null;
 export declare function isRunLockLive(repoRoot: string): boolean;
 export declare function unlockRun(repoRoot: string): {
     held: false;

package/dist/run/lock.js

@@ -2,6 +2,7 @@ import { linkSync, readFileSync, statSync, unlinkSync, utimesSync, writeFileSync
 import { join } from "node:path";
 import { z } from "zod";
 import { tickmarkrDir, stateDirName } from "../graph/graph.js";
+import { parseRunId } from "./journal.js";
 // HARD-01/02: coarse per-run advisory lock over .tickmarkr/graph.json. LOCK-02: the lock is created by
 // the link(2) idiom — write the full payload to graph.lock.<pid>.tmp, then linkSync(tmp, lockPath),
 // which is atomic and throws EEXIST if the lock already exists (the mutual-exclusion primitive).
@@ -238,7 +239,7 @@ export async function acquireApprovalSerialization(repoRoot, runId) {
 export function runLockOwner(repoRoot) {
     let insp;
     try {
-        insp = inspect(lockPath(repoRoot));
+        insp = inspect(join(repoRoot, stateDirName(repoRoot), "graph.lock"));
     }
     catch {
         return undefined;
@@ -247,6 +248,45 @@ export function runLockOwner(repoRoot) {
     // REPOSITORY-wide, so a live pid here is not proof it is running the run the caller cares about.
     return { pid: insp.pid, runId: insp.runId, live: shouldRefuse(insp) };
 }
+export function runLockRunId(repoRoot) {
+    const runId = runLockOwner(repoRoot)?.runId;
+    if (runId === undefined)
+        return undefined;
+    try {
+        return parseRunId(runId);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function runStatusLine(repoRoot, runId, events) {
+    let parsedRunId;
+    try {
+        parsedRunId = parseRunId(runId);
+    }
+    catch {
+        return null;
+    }
+    const owner = runLockOwner(repoRoot);
+    const ownerRunId = owner?.runId === undefined ? undefined : (() => {
+        try {
+            return parseRunId(owner.runId);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (owner && ownerRunId === parsedRunId) {
+        if (owner.live)
+            return `run ${parsedRunId} active`;
+        return owner.pid === undefined
+            ? `run ${parsedRunId} stale lock`
+            : `run ${parsedRunId} stale lock naming dead holder pid ${owner.pid}`;
+    }
+    if (events.some((event) => event.event === "run-end"))
+        return null;
+    return `run ${parsedRunId} abandoned since ${events.at(-1)?.ts ?? "unknown"}`;
+}
 // Read-only predicate: true iff a lock exists that the decision table would REFUSE on (alive,
 // EPERM, or ANY garbage). A provably-dead holder (ESRCH) reads not-live (LOCK-02/OBS-05). Never
 // mutates the lock. compile now acquires via acquireRunLock; this remains for drift oracles/tests.

package/dist/tui/ink/fleet-app.d.ts

@@ -68,6 +68,10 @@ export type FleetModelGroup = {
         detectedAt?: string;
         suggestion?: FleetModelSuggestion;
         evidence?: FleetModelEvidence;
+        classifyModel?: string;
+        variants?: string[];
+        foldedModels?: string[];
+        score?: number;
     }>;
 };
 export type FleetClassification = {

package/dist/tui/ink/fleet-app.js

@@ -96,7 +96,8 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
     };
     const groupRows = (group) => {
         const rows = group.rows.map((row) => {
-            const staged = ui.classifications.find((classification) => classification.adapter === group.adapter && classification.model === row.model);
+            const staged = ui.classifications.find((classification) => classification.adapter === group.adapter
+                && (classification.model === row.model || classification.model === row.classifyModel));
             return {
                 adapter: group.adapter,
                 model: row.model,
@@ -105,10 +106,14 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                 suggestion: row.suggestion,
                 evidence: row.evidence,
                 channel: group.channel,
+                classifyModel: row.classifyModel,
+                variants: row.variants,
+                foldedModels: row.foldedModels,
+                score: row.score,
                 denied: ui.denyModels.has(`${group.adapter}:${row.model}`),
             };
         });
-        const known = new Set(rows.map((row) => row.model));
+        const known = new Set(rows.flatMap((row) => row.classifyModel ? [row.model, row.classifyModel] : [row.model]));
         for (const staged of ui.classifications) {
             if (staged.adapter === group.adapter && !known.has(staged.model)) {
                 rows.push({
@@ -125,10 +130,21 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
     const matches = (label, f) => f === "" || label.toLowerCase().includes(f.toLowerCase());
     // Operator directive 2026-08-13: retired shapes (dated snapshots, previews, non-worker SKUs,
     // legacy families) hide by DEFAULT. `a` reveals them; a CLASSIFIED row is never hidden.
-    const modelRows = (f = ui.filter) => scopedGroups().flatMap(groupRows).filter((row) => matches(`${row.adapter}/${row.model}`, f)
-        && (ui.showAll || row.tier !== undefined || retiredModelReason(row.model) === null));
-    const hiddenModelCount = (f = ui.filter) => scopedGroups().flatMap(groupRows).filter((row) => matches(`${row.adapter}/${row.model}`, f)).length
+    const modelRows = (f = ui.filter) => {
+        const rows = scopedGroups().flatMap(groupRows).filter((row) => matches(`${row.adapter}/${row.model} ${(row.foldedModels ?? []).join(" ")}`, f)
+            && (ui.showAll || row.tier !== undefined || retiredModelReason(row.model) === null));
+        const classified = rows.filter((row) => row.tier !== undefined);
+        const unclassified = rows.filter((row) => row.tier === undefined).sort((a, b) => Number(!!b.suggestion) - Number(!!a.suggestion)
+            || (b.detectedAt ?? "").localeCompare(a.detectedAt ?? "")
+            || (b.score ?? Number.NEGATIVE_INFINITY) - (a.score ?? Number.NEGATIVE_INFINITY)
+            || `${a.adapter}/${a.model}`.localeCompare(`${b.adapter}/${b.model}`));
+        return [...classified, ...unclassified];
+    };
+    const hiddenModelCount = (f = ui.filter) => scopedGroups().flatMap(groupRows)
+        .filter((row) => matches(`${row.adapter}/${row.model} ${(row.foldedModels ?? []).join(" ")}`, f)).length
         - modelRows(f).length;
+    const foldedModelCount = (f = ui.filter) => modelRows(f)
+        .reduce((count, row) => count + Math.max((row.foldedModels?.length ?? 1) - 1, 0), 0);
     /** rail counts mirror the list's retired-hide (never the text filter) so numbers agree on screen */
     const visibleCount = (scope) => {
         const groups = scope === -1 ? enabledGroups() : (modelGroups[scope] ? [modelGroups[scope]] : []);
@@ -232,14 +248,17 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
             return;
         // OBS-508: catalog evidence prefills the flow — the tier cursor lands on the suggested band and
         // (when the operator keeps that band) the provenance note arrives pre-typed. Free to override.
-        const suggestion = group.rows.find((row) => row.model === model)?.suggestion ?? null;
+        const source = group.rows.find((row) => row.model === model);
+        const suggestion = source?.suggestion ?? null;
+        const classifyModel = source?.classifyModel ?? model;
         const tierAt = suggestion ? Math.max(TIERS.indexOf(suggestion.tier), 0) : 0;
         const firstTouch = !group.rows.some((row) => row.tier !== undefined)
             && !ui.classifications.some((c) => c.adapter === adapter);
         const base = {
             kind: "classify",
             adapter,
-            model,
+            model: classifyModel,
+            ...(classifyModel !== model ? { displayModel: model } : {}),
             channelAt: 0,
             tierAt,
             note: "",
@@ -966,7 +985,7 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                 const group = modelGroups[ui.adapterAt];
                 const suggested = rows
                     .filter((candidate) => candidate.adapter === group.adapter && !candidate.tier && candidate.suggestion !== undefined)
-                    .map((candidate) => ({ model: candidate.model, suggestion: candidate.suggestion }));
+                    .map((candidate) => ({ model: candidate.classifyModel ?? candidate.model, suggestion: candidate.suggestion }));
                 if (!suggested.length) {
                     ui.notice = "no catalog tier suggestions among the visible unclassified models — evidence comes from the cached catalogs (AA index / API pricing)";
                     bump();
@@ -1101,6 +1120,9 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
         const parts = [
             `${row.adapter}:${row.model}`,
             row.tier ?? "unclassified",
+            row.variants?.length ? `variants ${row.variants.join(", ")}` : "",
+            row.classifyModel ? `classify writes ${row.classifyModel}` : "",
+            row.foldedModels?.length ? `${row.foldedModels.length} gateway ids folded: ${row.foldedModels.join(", ")}` : "",
             row.evidence?.unauthed !== undefined ? `UNAUTHED — ${row.evidence.unauthed}` : "",
             row.evidence?.contextWindow !== undefined ? `${fmtCtx(row.evidence.contextWindow)} ctx` : "",
             row.evidence?.outputWindow !== undefined ? `${fmtCtx(row.evidence.outputWindow)} out` : "",
@@ -1120,7 +1142,8 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
         const nameW = bodyW - 4 - 11 - 6 - (showPrice ? 12 : 0) - (showProbe ? 7 : 0);
         // OBS-531: deep router ids (omp/prime-agent) clip tail-preserving — the LAST segment is the
         // distinguishing half; end-clipping rendered ten identical "prime-agent/anthropic/claude-…" rows.
-        const name = clipPathTail(`${row.adapter}/${row.model}`, nameW);
+        const folded = row.foldedModels?.length ?? 1;
+        const name = clipPathTail(`${row.adapter}/${row.model}${folded > 1 ? ` ×${folded}` : ""}`, nameW);
         const prefixLen = Math.min(name.length, row.adapter.length + 1);
         return (_jsxs(Text, { wrap: "truncate", children: [_jsx(Pointer, { on: selected }), row.denied
                     ? _jsx(Glyph, { kind: "off" })
@@ -1174,7 +1197,9 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
         if (overlay.kind === "classify") {
             const subject = overlay.bulk
                 ? `${overlay.adapter} · ${overlay.bulk.rows.length} suggested models`
-                : `${overlay.adapter}:${overlay.model}`;
+                : overlay.displayModel
+                    ? `${overlay.adapter}:${overlay.displayModel} · writes ${overlay.model}`
+                    : `${overlay.adapter}:${overlay.model}`;
             return (_jsxs(OverlayPanel, { title: `classify · ${subject}`, width: bodyW, children: [overlay.stage === "channel" && (_jsxs(_Fragment, { children: [_jsxs(Text, { dimColor: true, children: ["first touch for ", overlay.adapter, " \u2014 how is this CLI billed?"] }), _jsx(Text, { children: " " }), CHANNELS.map((channel, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: overlay.channelAt === index }), _jsx(Text, { bold: overlay.channelAt === index, children: padCell(channel, 5) }), _jsx(Text, { dimColor: true, children: channel === "sub" ? "flat-rate subscription quota" : "metered API billing" })] }, channel)))] })), overlay.stage === "tier" && (_jsxs(_Fragment, { children: [_jsx(Text, { dimColor: true, children: overlay.suggestion
                                     ? `catalog suggests ${overlay.suggestion.tier} — keep it and the provenance note arrives pre-typed`
                                     : "pick the capability band this model routes as" }), _jsx(Text, { children: " " }), TIERS.map((tier, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: overlay.tierAt === index }), overlay.suggestion?.tier === tier ? _jsx(Glyph, { kind: "on" }) : _jsx(Text, { children: " " }), _jsx(Text, { bold: overlay.tierAt === index, children: ` ${padCell(tier, 9)}` }), _jsx(Text, { dimColor: true, children: tier === "frontier" ? "strongest band — integrity shapes" : tier === "mid" ? "capable daily driver" : "fast + cheap" })] }, tier)))] })), overlay.stage === "note" && (_jsxs(_Fragment, { children: [_jsx(Text, { dimColor: true, children: "benchmark provenance (required) \u2014 where does this tier claim come from?" }), _jsx(Text, { children: " " }), _jsxs(Text, { children: [_jsx(Text, { color: INK.brand, children: "> " }), _jsx(Text, { children: clip(overlay.note, bodyW - 6) || "" }), _jsx(Text, { color: INK.brand, children: "\u2588" })] })] }))] }));
@@ -1220,6 +1245,15 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
         const selectedSeat = ui.judgeSeat ?? judgeKeepRow;
         return (_jsxs(OverlayPanel, { title: "pick \u00B7 judge", width: bodyW, children: [_jsx(Text, { dimColor: true, children: "one seat judges acceptance criteria \u2014 failover stays runtime (GATE-09)" }), _jsx(SearchRow, { filter: ui.filter, active: true }), above > 0 && _jsx(ElisionMark, { count: above, side: "above" }), visible.map((label, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: start + index === overlay.at }), label === selectedSeat ? _jsx(Glyph, { kind: "on" }) : _jsx(Text, { children: " " }), _jsx(Text, { bold: start + index === overlay.at, children: ` ${clip(label, bodyW - 10)}` })] }, label))), below > 0 && _jsx(ElisionMark, { count: below, side: "below" })] }));
     })();
+    const modelVisibilityLine = () => {
+        const hidden = hiddenModelCount();
+        const folded = foldedModelCount();
+        return [
+            ...(folded ? [`${folded} same-model gateway id${folded === 1 ? "" : "s"} folded`] : []),
+            ...(hidden ? [`${hidden} retired/preview/non-worker hidden — a shows all`] : []),
+            ...(ui.showAll ? ["showing retired models — a hides them again"] : []),
+        ].join(" · ");
+    };
     const listNode = (() => {
         if (overlayNode)
             return overlayNode;
@@ -1230,7 +1264,7 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                 ? "All models"
                 : modelGroups[ui.adapterAt]?.adapter ?? "";
             const scopeDenied = ui.adapterAt !== -1 && ui.deny.has(modelGroups[ui.adapterAt]?.adapter ?? "");
-            return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { children: [_jsx(Text, { bold: true, children: scopeLabel }), _jsx(Text, { dimColor: true, children: `  ${rows.length}` })] }), _jsx(SearchRow, { filter: ui.filter, active: ui.searching, hint: "/ to search" }), scopeDenied && _jsx(Text, { color: INK.warn, children: `${modelGroups[ui.adapterAt]?.adapter} is out of the fleet — Space on its rail row adds it back` }), above > 0 && _jsx(ElisionMark, { count: above, side: "above" }), visible.map((row, index) => renderModelRow(row, ui.focus === "list" && start + index === ui.listAt)), below > 0 && _jsx(ElisionMark, { count: below, side: "below", hint: "/ to search" }), rows.length === 0 && !scopeDenied && _jsx(Text, { dimColor: true, children: "  no models match" })] }));
+            return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { children: [_jsx(Text, { bold: true, children: scopeLabel }), _jsx(Text, { dimColor: true, children: `  ${rows.length}` })] }), _jsx(SearchRow, { filter: ui.filter, active: ui.searching, hint: "/ to search" }), modelVisibilityLine() && _jsx(Text, { dimColor: true, children: `  ${modelVisibilityLine()}` }), scopeDenied && _jsx(Text, { color: INK.warn, children: `${modelGroups[ui.adapterAt]?.adapter} is out of the fleet — Space on its rail row adds it back` }), above > 0 && _jsx(ElisionMark, { count: above, side: "above" }), visible.map((row, index) => renderModelRow(row, ui.focus === "list" && start + index === ui.listAt)), below > 0 && _jsx(ElisionMark, { count: below, side: "below", hint: "/ to search" }), rows.length === 0 && !scopeDenied && _jsx(Text, { dimColor: true, children: "  no models match" })] }));
         }
         if (ui.view === "shapes") {
             const rows = shapeList();
@@ -1266,11 +1300,6 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                         : "unclassified — Space/Enter classifies; unclassified models are never routed");
                 }
             }
-            const hidden = hiddenModelCount();
-            if (hidden > 0 && lines.length < 2)
-                lines.push(`${hidden} retired/preview/non-worker hidden — a shows all`);
-            if (ui.showAll && lines.length < 2)
-                lines.push("showing retired models — a hides them again");
             return lines;
         }
         if (ui.view === "shapes") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.3.0",
+  "version": "2.4.1",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -57,5 +57,63 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^3.0.0"
+  },
+  "tickmarkrExport": {
+    "publicPaths": {
+      "exact": [
+        ".gitignore",
+        ".oxlintrc.json",
+        "CHANGELOG.md",
+        "CODE_OF_CONDUCT.md",
+        "CONTRIBUTING.md",
+        "FLEET.md",
+        "LICENSE",
+        "README.md",
+        "RELEASING.md",
+        "SECURITY.md",
+        "package-lock.json",
+        "package.json",
+        "tickmarkr.spec.md",
+        "tsconfig.json",
+        "vitest.config.ts",
+        ".github/pull_request_template.md",
+        "scripts/assert-test-file-count.sh",
+        "scripts/emit-schema.ts",
+        "scripts/probe-rig.mjs",
+        "specs/export-selftest.spec.md"
+      ],
+      "prefixes": [
+        ".github/ISSUE_TEMPLATE/",
+        ".github/workflows/",
+        "assets/",
+        "docs/codebase/",
+        "fixtures/",
+        "schema/",
+        "skills/tickmarkr-auto/",
+        "skills/tickmarkr-loop/",
+        "skills/tickmarkr-overseer/",
+        "src/",
+        "tests/"
+      ]
+    },
+    "excludedPaths": [
+      ".planning",
+      "specs",
+      ".tickmarkr",
+      ".overseer",
+      ".claude",
+      "docs",
+      "ASSESSMENT-*.md",
+      ".gitignore",
+      "scripts/measure-trailer-width.mjs",
+      "scripts/scan-scope-corpus.mjs",
+      "scripts/repro-obs96.mjs",
+      "CLAUDE.md",
+      "scripts/export-public.sh",
+      "scripts/verify-export.sh",
+      "tests/scripts/verify-export.test.ts",
+      ".github/workflows/ci.yml",
+      "**/*.local.*"
+    ]
   }
 }

package/skills/tickmarkr-overseer/SKILL.md

@@ -165,6 +165,21 @@ overseer holds the mission's judgment. A tier collapse is therefore a context le
 **The tell, and you will not notice it from inside:** if you are typing `tickmarkr resume`, or reading a
 journal tail to decide what happens next, or sweeping orphans — you have taken the loop. Hand it back.
 
+### Pre-run checklist — install these laws in the brief before `compile` / `plan` / `run`
+
+1. **Run the files[]-versus-oracle pin sweep (RULING-222-36).** Read every acceptance item and enumerate
+   the PINS its satisfaction must move: implementation files, callers, fixtures, tests, snapshots and
+   documentation assertions. Put every pin in that task's `files[]` before compile. A criterion that
+   forces a file its scope forbids is a plan defect; repair the plan before dispatch, never spend a
+   worker's repair ladder on the scope/test catch-22.
+2. **Install the live-run command boundary (RULING-222-28 §5 and 222-29 §3).** While a run is live, run
+   no `vitest` probe of any size — the daemon's `suite-wait` guard counts it. During that same window the
+   runner's name never enters a shell argv: not reason text, a heredoc, `pgrep -f`, or a commit subject.
+   Write records containing the word through an editor, and wait for run-end before probing.
+3. **Gate a mid-run fix at the base, not at a summary (law 47 / OBS-909).** A fix landed on main while a
+   run is live is proved with `tickmarkr verify --base <main>`, never with a suite summary copied from a
+   different tree. A release proof runs every CI-ordered step — including lint — before its suite.
+
 ### What the ORCHESTRATOR does, and what you require of it
 
 - **The live surface arrives with the run.** `tickmarkr run` is stdout-silent until run-end by design;
@@ -358,7 +373,7 @@ The protocol, in both directions:
    herdr pane run <partner> "I am at <N>%. Clear me: send /clear to <my-pane>, then point me at <my-handoff>."
    # 3. the PARTNER sends the clear, then VERIFIES before pointing:
    herdr pane run <my-pane> "/clear"
-   #    read the pane back — a cleared claude session shows an empty prompt and a reset context gauge
+   #    read the pane back — a cleared claude session shows an empty prompt and a LOWER context percentage
    # 4. and only THEN, as a SEPARATE send, the re-orientation:
    herdr pane run <my-pane> "You were cleared at <N>%. Read <handoff> and <brief>. Same-process clear kept
    every background task alive: retire only your recorded watcher pids, verify twice, kill-by-pid, arm,
@@ -367,7 +382,9 @@ The protocol, in both directions:
 
    ⚠ **Steps 3 and 4 are two sends, never one.** A pointer batched with the clear lands *during* it and is
    lost with the context it was meant to survive. Verify the clear landed by reading the prompt line
-   before sending the pointer — the same read-back every other send in this skill requires.
+   and re-reading the banner percentage below its pre-clear value before sending the pointer — the same
+   read-back every other send in this skill requires. A working seat or a typed prompt defers the act;
+   neither authorises a queued `/clear`.
    ⚠ **The partner must not clear itself in the same window.** One supervising tier stays live at all
    times; the seat holding the endgame goes second.
    ⚠ **Step 4 must state an EXPECTED-RETURN DEADLINE**, e.g. *"confirm you are back within 10 minutes."*
@@ -451,7 +468,9 @@ The first argument chooses the closed per-seat tier (`orchestrator-context` or `
 and every beat names the second argument as that tier's seat. The watcher beats only after reading a
 rendered percentage, keeps beating on the supervision cadence even when its requested poll is slower,
 continues past WARN to ACT, and records a stand-down on each controlled exit. A killed watcher alone
-leaves its last beat to age into `STALE`.
+leaves its last beat to age into `STALE`. Auto-clear waits for `idle` plus an empty or dim-only ANSI
+prompt line, prints `CONTEXT_ACT_DEFERRED` while that gate is closed, and emits `CONTEXT_CLEARED` only
+after a banner read-back proves the percentage dropped; only then does it send the re-brief.
 **Every handoff's re-arm list ends with the announce step from Setup 0** — inform the surviving
 orchestrator the fresh seat is live — or the next seat re-arms silently beside a tier that still
 believes it is alone.
@@ -545,6 +564,11 @@ they are left implicit:
   that discriminates** — text sitting on `❯` is exactly what will not run — and a delivery report
   is prompt-line state alone, or nothing: a decorative check beside a real one reads as
   corroboration (two greens, one of which was never capable of disagreeing).
+  **Law 50 applies to every handoff, including `/clear`: a seat-send to a WORKING seat leaves a DRAFT.**
+  Send only when the seat is idle and the ANSI prompt line is empty or dim-only (the Esc/SGR discriminator
+  separates an autosuggest ghost from typed input), then read back activity or an ACK; presence is not
+  delivery. If a stale draft must be replaced, supersede it explicitly with
+  `agent prompt " <-- disregard … ACTUAL: …"` instead of stacking another instruction behind it.
 - **A MESSAGE TO A WORKING SEAT IS A QUEUED MESSAGE, AND THE QUEUE DRAINS ONLY AT TURN BOUNDARIES.**
   Delivery is not arrival: `agent prompt` to a `working` claude seat lands in its queue (`Press up to
   edit queued messages` on the seat's prompt line is the tell) and is READ only when the current turn
@@ -994,10 +1018,21 @@ orchestrator turn boundary.
    - **RUN BOTH RELEASE PROOFS BEFORE STANDING DOWN.** The first is the exported-tree suite, which
      maintainers run from the private repo with its `verify:export` script — that tooling is deliberately
      not part of this package, so the command does not exist in a public checkout; it must install,
-     build, and run the suite in the exported tree; then
+     build, lint, and only then run the suite in the exported tree; then
      `TICKMARKR_E2E=1 npx vitest run tests/e2e/orca-smoke.e2e.test.ts` must exercise the installed-Orca
      smoke. A skipped smoke is not proof. Record both results before declaring the release complete.
 
+   - **GRADE PUBLIC CI FROM JOB LOGS AT RUN-END ONLY (law 48).** A badge is not the grade, and
+     `gh run view --job --log` is empty while the run is in progress. At run-end execute
+     `scripts/grade-ci.sh <run-id> <expected-count> <tag>` and require GREEN from both jobs; its
+     UNREADABLE state is a hard stop, not a green default. Derive the expected glob pathspec count with
+     `git ls-files ':(glob)tests/**/*.test.ts'` (including the `.tsx` sibling where present), never a bare
+     `tests/**/*.test.ts`: bare `**` is not a git glob (law 49).
+
+   - **RE-READ THE REGISTRY BEFORE RULING (law 51).** A successful Release run and the first
+     `npm view` are separate observations: registry propagation can briefly return the prior version.
+     Read `npm view tickmarkr version` again and verify provenance before recording the publish verdict.
+
    - **REWRITE THE MEMORY INDEX FIRST, and read it back.** Minutes after `2.1.1` hit npm, the index line
      a fresh session loads still read *"⛔ 2.1.1 CANNOT ship from run …2011"* — true when written, and by
      then the exact opposite of the truth. **The index is what everyone loads and the body is what nobody

package/skills/tickmarkr-overseer/scripts/grade-ci.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+# grade-ci.sh <run-id> <expected-count> [tag] — grade both public CI jobs from their JOB LOGS.
+# Grade only at run-end. A missing/in-progress/empty log is UNREADABLE, never evidence of green.
+# Tri-state: exit 0 GREEN, 1 RED, 2 UNREADABLE. UNREADABLE dominates a mixed result.
+set -u
+
+run=${1:?run id required}
+expected=${2:?expected tracked test-file count required}
+tag=${3:-$run}
+repo=${TKR_GRADE_CI_REPO:-alzahrani-khalid/tickmarkr}
+out_dir=${TKR_GRADE_CI_DIR:-${TKR_STATE_DIR:-.tickmarkr}/overseer/diag}
+mkdir -p "$out_dir" || { echo "UNREADABLE: cannot create log directory $out_dir"; exit 2; }
+
+verdict=0
+mark_unreadable() { verdict=2; }
+mark_red() { [ "$verdict" -eq 0 ] && verdict=1; }
+
+jobs=$(gh run view "$run" --repo "$repo" --json jobs \
+  --jq '.jobs[] | [.databaseId, .name, .status, (.conclusion // "")] | @tsv') \
+  || { echo "UNREADABLE: job list"; exit 2; }
+[ -n "$jobs" ] || { echo "UNREADABLE: empty job list"; exit 2; }
+
+seen_test=0
+seen_macos=0
+while IFS=$'\t' read -r id name status conclusion; do
+  case "$name" in
+    test) seen_test=1 ;;
+    test-macos) seen_macos=1 ;;
+    *) continue ;;
+  esac
+
+  echo "$name: status=$status conclusion=${conclusion:-none} job=$id"
+  if [ "$status" != "completed" ]; then
+    echo "$name: UNREADABLE (job has not reached run-end)"
+    mark_unreadable
+    continue
+  fi
+
+  log="$out_dir/CI-$tag-$name.log"
+  gh run view --repo "$repo" --job "$id" --log > "$log" 2>/dev/null
+  if [ ! -s "$log" ]; then
+    echo "$name: UNREADABLE (empty log)"
+    mark_unreadable
+    continue
+  fi
+
+  oracle=$(grep -oE 'COUNT_ORACLE [A-Z]+ expected=[0-9A-Z]+ actual=[0-9A-Z]+' "$log" | tail -1)
+  files=$(grep -oE 'Test Files .*' "$log" | sed 's/[[:space:]]*$//')
+  passed=$(printf '%s\n' "$files" | grep -oE '[0-9]+ passed' | awk '{s+=$1} END{print s+0}')
+  skipped=$(printf '%s\n' "$files" | grep -oE '[0-9]+ skipped' | awk '{s+=$1} END{print s+0}')
+  failed=$(printf '%s\n' "$files" | grep -oE '[0-9]+ failed' | awk '{s+=$1} END{print s+0}')
+  timedout=$(grep -cE 'Test timed out|Error: Hook timed out' "$log" || true)
+  errors=$(grep -oE '##\[error\].*' "$log" | sort | uniq -c | sed 's/^ *//' | tr '\n' ';')
+
+  echo "$name: oracle=[${oracle:-MISSING}] files=[$(printf '%s' "$files" | tr '\n' '|')] passed=$passed skipped=$skipped failed=$failed timedout=$timedout errors=[$errors]"
+  if [ -z "$oracle" ] || [ -z "$files" ]; then
+    echo "$name: UNREADABLE"
+    mark_unreadable
+  elif [ "$oracle" = "COUNT_ORACLE GREEN expected=$expected actual=$expected" ] \
+       && [ "$failed" -eq 0 ] && [ "$timedout" -eq 0 ] \
+       && [ $((passed + skipped)) -eq "$expected" ]; then
+    echo "$name: GREEN"
+  else
+    echo "$name: RED"
+    mark_red
+  fi
+done <<< "$jobs"
+
+if [ "$seen_test" -ne 1 ]; then
+  echo "test: UNREADABLE (job missing from run)"
+  mark_unreadable
+fi
+if [ "$seen_macos" -ne 1 ]; then
+  echo "test-macos: UNREADABLE (job missing from run)"
+  mark_unreadable
+fi
+
+echo "VERDICT rc=$verdict (0=all GREEN 1=RED 2=UNREADABLE)"
+exit "$verdict"