tickmarkr 2.4.0 → 2.4.1

package/dist/adapters/catalog-remote.d.ts

@@ -11,6 +11,7 @@ export interface CatalogCache {
     modelsDev: unknown;
     artificialAnalysis?: unknown;
     liveBench?: unknown;
+    legFetchedAt?: Partial<Record<"modelsDev" | "artificialAnalysis" | "liveBench", string>>;
 }
 export interface CatalogReadResult {
     catalog: CatalogCache;
@@ -47,11 +48,21 @@ export interface RefreshCatalogOptions {
     timeoutMs?: number;
     now?: () => Date;
 }
+export type CatalogLegName = "models.dev" | "Artificial Analysis" | "LiveBench";
+export type CatalogLegStatus = "updated" | "failed" | "skipped";
+export interface CatalogLegResult {
+    leg: CatalogLegName;
+    status: CatalogLegStatus;
+    detail: string;
+    retry: string;
+}
 export interface RefreshCatalogResult {
     updated: boolean;
     catalog: CatalogReadResult;
     warning?: string;
+    legs: CatalogLegResult[];
 }
+export declare const formatCatalogRefreshLegs: (legs: readonly CatalogLegResult[]) => string;
 export declare const catalogCachePath: (repoRoot: string) => string;
 /**
  * Doctor's catalog seam: one synchronous local read with a vendored fail-open fallback.

package/dist/adapters/catalog-remote.js

@@ -60,9 +60,14 @@ const validModelsDevCatalog = (value) => {
     });
 };
 const staleAt = (fetchedAt, now) => {
-    const age = now.getTime() - Date.parse(fetchedAt);
+    const age = now.getTime() - Date.parse(fetchedAt ?? "");
     return !Number.isFinite(age) || age > CATALOG_CACHE_MAX_AGE_MS;
 };
+const legFetchedAt = (catalog, leg) => catalog.legFetchedAt?.[leg] ?? catalog.fetchedAt;
+const catalogStale = (catalog, now, source) => source === "vendored" || staleAt(legFetchedAt(catalog, "modelsDev"), now) || staleAt(legFetchedAt(catalog, "liveBench"), now)
+    || (catalog.artificialAnalysis !== undefined && catalog.legFetchedAt?.artificialAnalysis !== undefined
+        && staleAt(catalog.legFetchedAt.artificialAnalysis, now));
+export const formatCatalogRefreshLegs = (legs) => `catalog refresh: ${legs.map((leg) => `${leg.leg} ${leg.status} (${leg.detail}; ${leg.retry})`).join("; ")}`;
 export const catalogCachePath = (repoRoot) => join(repoRoot, ".tickmarkr", "catalog-cache.json");
 /**
  * Doctor's catalog seam: one synchronous local read with a vendored fail-open fallback.
@@ -74,14 +79,14 @@ export function readCachedCatalog(repoRoot, opts = {}) {
         const parsed = JSON.parse(readFileSync(catalogCachePath(repoRoot), "utf8"));
         if (!validCache(parsed))
             throw new Error("catalog cache schema is invalid");
-        return { catalog: parsed, source: "cache", stale: staleAt(parsed.fetchedAt, now) };
+        return { catalog: parsed, source: "cache", stale: catalogStale(parsed, now, "cache") };
     }
     catch (error) {
         const missing = error.code === "ENOENT";
         return {
             catalog: VENDORED_CATALOG,
             source: "vendored",
-            stale: staleAt(VENDORED_CATALOG.fetchedAt, now),
+            stale: true,
             ...(!missing ? { warning: error instanceof Error ? error.message : String(error) } : {}),
         };
     }
@@ -410,6 +415,13 @@ export async function refreshCatalogCommand(opts) {
     const fetcher = opts.fetcher ?? globalThis.fetch.bind(globalThis);
     const timeoutMs = opts.timeoutMs ?? CATALOG_REFRESH_TIMEOUT_MS;
     const warnings = [];
+    const legs = [];
+    const stamp = now().toISOString();
+    const legAt = {
+        modelsDev: legFetchedAt(current.catalog, "modelsDev"),
+        liveBench: legFetchedAt(current.catalog, "liveBench"),
+        ...(current.catalog.artificialAnalysis !== undefined ? { artificialAnalysis: legFetchedAt(current.catalog, "artificialAnalysis") } : {}),
+    };
     let modelsDev = current.catalog.modelsDev;
     let modelsDevUpdated = false;
     try {
@@ -417,46 +429,76 @@ export async function refreshCatalogCommand(opts) {
         if (!validModelsDevCatalog(modelsDev))
             throw new Error("models.dev catalog schema is invalid");
         modelsDevUpdated = true;
+        legAt.modelsDev = stamp;
+        legs.push({ leg: "models.dev", status: "updated", detail: "fetched", retry: "next retry after this leg is stale" });
     }
     catch (error) {
-        warnings.push(`models.dev refresh failed: ${error instanceof Error ? error.message : String(error)}`);
+        const detail = error instanceof Error ? error.message : String(error);
+        warnings.push(`models.dev refresh failed: ${detail}`);
+        legs.push({ leg: "models.dev", status: "failed", detail, retry: "retry next refresh because this leg kept its prior age" });
     }
     let artificialAnalysis = current.catalog.artificialAnalysis;
+    let artificialAnalysisUpdated = false;
     const apiKey = opts.artificialAnalysisKey ?? process.env.ARTIFICIAL_ANALYSIS_API_KEY?.trim();
     if (apiKey) {
         try {
             artificialAnalysis = await fetchArtificialAnalysis(fetcher, apiKey, timeoutMs);
+            artificialAnalysisUpdated = true;
+            legAt.artificialAnalysis = stamp;
+            legs.push({ leg: "Artificial Analysis", status: "updated", detail: "fetched", retry: "next retry after this leg is stale" });
         }
         catch (error) {
-            warnings.push(`Artificial Analysis refresh failed: ${error instanceof Error ? error.message : String(error)}`);
+            const detail = error instanceof Error ? error.message : String(error);
+            warnings.push(`Artificial Analysis refresh failed: ${detail}`);
+            legs.push({ leg: "Artificial Analysis", status: "failed", detail, retry: "retry next refresh because this leg kept its prior age" });
         }
     }
+    else {
+        delete legAt.artificialAnalysis;
+        legs.push({ leg: "Artificial Analysis", status: "skipped", detail: "no API key", retry: "retry when ARTIFICIAL_ANALYSIS_API_KEY is set" });
+    }
     let liveBench = current.catalog.liveBench;
     let liveBenchUpdated = false;
     try {
         liveBench = await fetchLiveBench(fetcher, timeoutMs);
         liveBenchUpdated = true;
+        legAt.liveBench = stamp;
+        legs.push({ leg: "LiveBench", status: "updated", detail: `table ${LIVEBENCH_TABLE_DATE}`, retry: "next retry after this leg is stale" });
     }
     catch (error) {
-        warnings.push(`LiveBench refresh failed: ${error instanceof Error ? error.message : String(error)}`);
+        const detail = error instanceof Error ? error.message : String(error);
+        warnings.push(`LiveBench refresh failed: ${detail}`);
+        legs.push({ leg: "LiveBench", status: "failed", detail, retry: "retry next refresh because this leg kept its prior age" });
     }
-    // models.dev is the required cache spine. Still run every independent leg after it fails, but do
-    // not write a cache that would make the vendored fallback look fetched.
-    if (!modelsDevUpdated) {
-        return { updated: false, catalog: current, warning: warnings.join("; ") };
+    const updated = modelsDevUpdated || artificialAnalysisUpdated || liveBenchUpdated;
+    // models.dev is the cache spine: do not write a cache that would make the vendored fallback look
+    // fetched. Independent legs may only merge onto models.dev fetched now or already held in cache.
+    if (!updated || (!modelsDevUpdated && current.source !== "cache")) {
+        const reportedLegs = !modelsDevUpdated && current.source !== "cache"
+            ? legs.map((leg) => leg.status === "updated"
+                ? {
+                    ...leg,
+                    status: "failed",
+                    detail: "fetched but discarded — models.dev spine unavailable",
+                    retry: "retry next refresh",
+                }
+                : leg)
+            : legs;
+        return { updated: false, catalog: current, legs: reportedLegs, ...(warnings.length ? { warning: warnings.join("; ") } : {}) };
     }
     const catalog = {
         schemaVersion: 1,
-        // A failed keyless leg keeps the old age so doctor/fleet retry it rather than masking it for 7d.
-        fetchedAt: liveBenchUpdated ? now().toISOString() : current.catalog.fetchedAt,
+        fetchedAt: legAt.modelsDev ?? current.catalog.fetchedAt,
         modelsDev,
         ...(artificialAnalysis !== undefined ? { artificialAnalysis } : {}),
         ...(liveBench !== undefined ? { liveBench } : {}),
+        legFetchedAt: legAt,
     };
     writeCatalogCache(opts.repoRoot, catalog);
     return {
-        updated: true,
+        updated,
         catalog: readCachedCatalog(opts.repoRoot, { now }),
+        legs,
         ...(warnings.length ? { warning: warnings.join("; ") } : {}),
     };
 }

package/dist/adapters/codex.js

@@ -184,17 +184,16 @@ export const codex = {
     probeConcurrency: 1,
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
-    // v1.65 T3: every flag the command builders below hardcode (incl. codexMcpSuppressionFlags' -c/
+    // v1.65 T3: every flag the command builder below hardcodes (incl. codexMcpSuppressionFlags' -c/
     // --disable and GITDIR_WRITABLE's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
-    hardcodedFlags: { binary: "codex", flags: ["--sandbox", "--model", "-a", "-s", "-c", "--disable", "--dangerously-bypass-hook-trust"] },
+    hardcodedFlags: { binary: "codex", flags: ["--sandbox", "--model", "-c", "--disable", "--dangerously-bypass-hook-trust"] },
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
     // MCP suppression built per dispatch (config can change between runs) — see codexMcpSuppressionFlags.
     // CODEX_HOOK_TRUST (OBS-125) clears the per-worktree "Hooks need review" gate while keeping the sandbox.
-    headlessCommand: (promptFile, model) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
-    // TUI uses expanded -a never -s workspace-write (exec-only flags do not apply)
-    // (--help 2026-07-09: valid approval policies are untrusted|on-request|never; the previously
-    // used `on-failure` is invalid and made codex exit 2 pre-inference)
-    interactiveCommand: (promptFile, model) => `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
+    headlessCommand: (promptFile, model) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} - < ${shq(promptFile)}`,
+    // OBS-889: Codex's TUI has no file/stdin prompt form. Returning null makes the daemon journal
+    // worker-mode-fallback before it runs the argv-safe headless command in the visible pane.
+    interactiveCommand: () => null,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },

package/dist/adapters/qwen.js

@@ -58,7 +58,7 @@ function decodeQwenEvents(events) {
         }
     }
     const assistantText = text.join("\n");
-    const apiError = text.find((line) => line.startsWith("[API Error:"));
+    const apiError = assistantText.match(/\[API Error:[^\n]*/)?.[0];
     if (apiError)
         failed = true;
     if (!failed)
@@ -134,8 +134,8 @@ export const qwen = {
     probeCwd: "neutral",
     probe: async () => probeQwen(),
     channels: (cfg) => channelsFromConfig("qwen", cfg),
-    hardcodedFlags: { binary: "qwen", flags: ["--approval-mode", "-m", "-o", "-p"] },
-    headlessCommand: (promptFile, model) => `${QWEN_SKIP_UPDATE} qwen --approval-mode yolo -m ${shq(model)} -o json -p '' < ${shq(promptFile)}`,
+    hardcodedFlags: { binary: "qwen", flags: ["--safe-mode", "--approval-mode", "-m", "-o", "-p"] },
+    headlessCommand: (promptFile, model) => `${QWEN_SKIP_UPDATE} qwen --safe-mode --approval-mode yolo -m ${shq(model)} -o json -p '' < ${shq(promptFile)}`,
     // OBS-905: qwen has NO interactive form. The `-i "$(cat prompt)"` TUI launch put the whole prompt in
     // argv (the OBS-889 leak-and-census shape) and produced a rendered transcript the JSON decoder above
     // can never read — under the herdr driver every qwen task read "unparseable" and merged only by harvest.

package/dist/adapters/registry.js

@@ -399,6 +399,17 @@ function reasonTail(output) {
     const sp = tail.indexOf(" ");
     return sp === -1 ? tail : tail.slice(sp + 1);
 }
+function parsedStartupFailureReason(adapter, output) {
+    try {
+        const parsed = adapter.parse(output, "tickmarkr-model-probe");
+        const cause = parsed.cause;
+        if (!parsed.ok && cause === "startup-failure" && parsed.summary.trim()) {
+            return reasonTail(parsed.summary.trim().replace(/\s+/g, " "));
+        }
+    }
+    catch { /* adapter parse is advisory for probe diagnostics */ }
+    return undefined;
+}
 function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TIMEOUT_MS) {
     // SIGKILL-timeout is not exit-1: report the budget, never the masked kill code (v1.27 T1).
     if (timedOut)
@@ -456,7 +467,8 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
                         if (r.timedOut && !retry && priorModelAuth?.[model]?.reason?.includes("timed out") === true) {
                             return { verdict: v(false, `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`), timedOut: true };
                         }
-                        const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
+                        const output = `${r.stderr}\n${r.stdout}`.trim();
+                        const reason = parsedStartupFailureReason(a, output) ?? probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
                         if (!reason)
                             return { verdict: v(true), timedOut: false };
                         if (!retry)

package/dist/cli/commands/compile.d.ts

@@ -1 +1,4 @@
+import { type SourceScopeFinding } from "../../compile/collateral.js";
+import { compileSource } from "../../compile/index.js";
+export declare function nativeSourceScopeErrors(graph: ReturnType<typeof compileSource>, findings: readonly SourceScopeFinding[]): string[];
 export declare function compile(argv: string[], cwd?: string, harnessFrom?: string | undefined): Promise<string>;

package/dist/cli/commands/compile.js

@@ -1,25 +1,21 @@
 import { isAbsolute, join } from "node:path";
 import { parseArgs } from "node:util";
-import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
+import { collateralLints, sourceScopeFindings, sourceScopeLints, } from "../../compile/collateral.js";
 import { CompileError } from "../../compile/common.js";
 import { compileSource } from "../../compile/index.js";
-import { saveGraph, stateDirName } from "../../graph/graph.js";
+import { clearCompileRefusal, saveCompileRefusal, saveGraph, stateDirName } from "../../graph/graph.js";
 import { formatPriorFindingEvidence, readPriorRunEvidence } from "../../run/journal.js";
 import { shGit } from "../../run/git.js";
 import { acquireRunLock, releaseRunLock } from "../../run/lock.js";
 import { harnessLine, resolveHarness } from "../harness.js";
-function nativeSourceScopeErrors(graph, lints) {
+export function nativeSourceScopeErrors(graph, findings) {
     const byId = new Map(graph.tasks.map((task) => [task.id, task]));
     const errors = [];
-    for (const lint of lints) {
-        const match = lint.match(/^(\S+): criteria implicate out-of-scope source not in files\[\]: (.*)$/);
-        if (!match)
-            continue;
-        const task = byId.get(match[1]);
+    for (const finding of findings) {
+        const task = byId.get(finding.taskId);
         if (!task)
             continue;
-        const paths = match[2].replace(/ \(capped\)$/, "").split(", ").filter(Boolean);
-        for (const path of paths) {
+        for (const path of finding.paths) {
             if (task.goal.includes(`scope-waiver: ${path}`))
                 continue;
             errors.push(`${task.id}: ${path} requires scope-waiver: ${path} in the task goal`);
@@ -60,43 +56,78 @@ export async function compile(argv, cwd = process.cwd(), harnessFrom = process.a
     const src = positionals[0];
     if (!src)
         throw new Error("usage: tickmarkr compile <spec-dir-or-md> [--type speckit|prd|gsd|native] [--dry-run] [--strict]");
-    // resolve against the target repo, not the process cwd (the CLI test passes a tmp repo)
-    // Both modes reach the same pure compiler; --dry-run only removes the lock/write side effect below.
-    const g = compileSource(isAbsolute(src) ? src : join(cwd, src), values.type, cwd, // repo root: gsd stores context[0] repo-relative so workers resolve it inside their worktree
-    (plan) => plan, { strict: values.strict });
-    const scopeLints = [...collateralLints(g.tasks, cwd), ...sourceScopeLints(g.tasks, cwd)];
-    const diagnostics = scopeLints.length
-        ? `\nscope lints:\n${scopeLints.map((lint) => `  ! ${lint}`).join("\n")}`
-        : "";
-    const unwaived = g.spec.source === "native" ? nativeSourceScopeErrors(g, scopeLints) : [];
-    if (unwaived.length > 0) {
-        throw new CompileError(`${src} has unwaived native source-scope authoring errors:\n${unwaived.map((line) => `  - ${line}`).join("\n")}${diagnostics}`);
-    }
-    // One bounded read supplies both cross-run surfaces: unresolved findings below and merge facts for
-    // the ancestry check. Neither fact mutates the compiled graph; status and every readiness predicate
-    // remain the source compiler's answer.
-    const prior = readPriorRunEvidence(cwd, g.tasks);
-    const mergedPending = await mergedPendingDiagnostics(cwd, new Set(g.tasks.filter((task) => task.status === "pending").map((task) => task.id)), prior.merges);
-    const stateDir = stateDirName(cwd);
-    if (!values["dry-run"]) {
-        // HARD-01 / Sol #3: hold the same link(2) run lock as the daemon around saveGraph so compile
-        // cannot swap graph.json under an active run between the daemon's read and act.
-        acquireRunLock(cwd, "compile");
-        try {
-            saveGraph(cwd, g);
+    const sourcePath = isAbsolute(src) ? src : join(cwd, src);
+    let stateWriteStarted = false;
+    try {
+        // Resolve against the target repo, not the process cwd (the CLI test passes a tmp repo).
+        // Both modes reach the same pure compiler; --dry-run removes every state write below.
+        const g = compileSource(sourcePath, values.type, cwd, // repo root: gsd stores context[0] repo-relative so workers resolve it inside their worktree
+        (plan) => plan, { strict: values.strict });
+        const sourceFindings = sourceScopeFindings(g.tasks, cwd);
+        const scopeLints = [
+            ...collateralLints(g.tasks, cwd),
+            ...sourceScopeLints(g.tasks, cwd, sourceFindings),
+        ];
+        const diagnostics = scopeLints.length
+            ? `\nscope lints:\n${scopeLints.map((lint) => `  ! ${lint}`).join("\n")}`
+            : "";
+        const unwaived = g.spec.source === "native" ? nativeSourceScopeErrors(g, sourceFindings) : [];
+        if (unwaived.length > 0) {
+            throw new CompileError(`${src} has unwaived native source-scope authoring errors:\n${unwaived.map((line) => `  - ${line}`).join("\n")}${diagnostics}`);
         }
-        finally {
-            releaseRunLock(cwd);
+        // One bounded read supplies both cross-run surfaces: unresolved findings below and merge facts for
+        // the ancestry check. Neither fact mutates the compiled graph; status and every readiness predicate
+        // remain the source compiler's answer.
+        const prior = readPriorRunEvidence(cwd, g.tasks);
+        const mergedPending = await mergedPendingDiagnostics(cwd, new Set(g.tasks.filter((task) => task.status === "pending").map((task) => task.id)), prior.merges);
+        const stateDir = stateDirName(cwd);
+        if (!values["dry-run"]) {
+            // HARD-01 / Sol #3: hold the same link(2) run lock as the daemon around both truth records so
+            // compile cannot swap graph.json under an active run between the daemon's read and act.
+            stateWriteStarted = true;
+            acquireRunLock(cwd, "compile");
+            try {
+                saveGraph(cwd, g);
+                clearCompileRefusal(cwd);
+            }
+            finally {
+                releaseRunLock(cwd);
+            }
+        }
+        const summary = values["dry-run"]
+            ? `validated ${src} (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)}) — dry run; no graph written`
+            : `compiled ${src} → ${stateDir}/graph.json (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)})`;
+        const priorFindings = prior.findings.length
+            ? `\nprior-run evidence:\n${prior.findings.map((finding) => `  ${formatPriorFindingEvidence(finding)}`).join("\n")}`
+            : "";
+        const mergeHistory = mergedPending.length
+            ? `\nmerge history:\n${mergedPending.map((line) => `  ${line}`).join("\n")}`
+            : "";
+        return `${harnessLine(resolveHarness(harnessFrom))}\n${summary}${diagnostics}${priorFindings}${mergeHistory}`;
+    }
+    catch (error) {
+        // A dry run is a pure validation query. A real authoring refusal records the negative result
+        // without replacing the last good graph; run treats this sibling as newer truth than that graph.
+        // State-write failures are excluded: a live daemon's lock refusal is not a verdict on the spec.
+        if (!values["dry-run"] && !stateWriteStarted) {
+            try {
+                acquireRunLock(cwd, "compile-refusal");
+                try {
+                    saveCompileRefusal(cwd, {
+                        refusedAt: new Date().toISOString(),
+                        source: sourcePath,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+                finally {
+                    releaseRunLock(cwd);
+                }
+            }
+            catch {
+                // The refusal record is best-effort when a live run owns the state boundary. That lock
+                // verdict must never replace the compile error that tells the operator what to repair.
+            }
         }
+        throw error;
     }
-    const summary = values["dry-run"]
-        ? `validated ${src} (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)}) — dry run; no graph written`
-        : `compiled ${src} → ${stateDir}/graph.json (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)})`;
-    const priorFindings = prior.findings.length
-        ? `\nprior-run evidence:\n${prior.findings.map((finding) => `  ${formatPriorFindingEvidence(finding)}`).join("\n")}`
-        : "";
-    const mergeHistory = mergedPending.length
-        ? `\nmerge history:\n${mergedPending.map((line) => `  ${line}`).join("\n")}`
-        : "";
-    return `${harnessLine(resolveHarness(harnessFrom))}\n${summary}${diagnostics}${priorFindings}${mergeHistory}`;
 }

package/dist/cli/commands/doctor.js

@@ -15,13 +15,14 @@ import { HerdrDriver } from "../../drivers/herdr.js";
 import { ORCA_FIXTURE_VERSION, parseEnvelope, resolveOrcaCliBinary } from "../../drivers/orca.js";
 import { kimi, probeKimiDoctorTurn } from "../../adapters/kimi.js";
 import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
-import { CATALOG_REFRESH_TIMEOUT_MS, LIVEBENCH_TABLE_DATE, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
+import { CATALOG_REFRESH_TIMEOUT_MS, LIVEBENCH_TABLE_DATE, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { sh } from "../../run/git.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
  *  concatenation and publishes no index, so the release listing is the only enumerable surface. */
 export const LIVEBENCH_RELEASES_URL = "https://api.github.com/repos/LiveBench/livebench.github.io/contents/public";
 export const LIVEBENCH_TABLE_MAX_AGE_DAYS = 90;
+const initialFetch = globalThis.fetch;
 const visual = () => process.stdout.isTTY === true && process.env.NO_COLOR === undefined;
 const alignedStatusRow = (verdict, key, value) => `  ${statusRow(verdict, kvRow(key, value).slice(2))}`;
 const attentionRow = (text) => `  ${statusRow("warn", text)}`;
@@ -348,19 +349,23 @@ export function liveBenchStalenessFinding(now) {
 }
 export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(), opts = {}) {
     if (_argv.length === 1 && _argv[0] === "--refresh-catalog") {
-        const refreshed = await refreshCatalogCommand({ repoRoot: cwd, now: opts.catalogNow });
+        const refreshed = await refreshCatalogCommand({ repoRoot: cwd, fetcher: opts.catalogFetcher, now: opts.catalogNow });
         return refreshed.updated
-            ? `tickmarkr doctor --refresh-catalog: model catalog refreshed${refreshed.warning ? `; ${refreshed.warning}` : ""}`
-            : `tickmarkr doctor --refresh-catalog: catalog refresh unavailable — ${refreshed.warning ?? "unknown failure"}; retained ${refreshed.catalog.source} catalog`;
+            ? `tickmarkr doctor --refresh-catalog: model catalog refreshed — ${formatCatalogRefreshLegs(refreshed.legs)}${refreshed.warning ? `; ${refreshed.warning}` : ""}`
+            : `tickmarkr doctor --refresh-catalog: catalog refresh unavailable — ${formatCatalogRefreshLegs(refreshed.legs)}${refreshed.warning ? `; ${refreshed.warning}` : ""}`;
     }
     // Operator directive 2026-08-12 (declutter): long per-model lists render only when asked for.
     const listAllModels = _argv.includes("--models");
     const cfg = loadConfig(cwd);
     let catalog = opts.catalog ?? readCachedCatalog(cwd, { now: opts.catalogNow });
-    let catalogRefreshWarning;
+    let catalogRefreshLine;
     // RULING-222-17 reverses cache-only for these two operator-facing commands only. The refresh
     // remains age-guarded; compile, plan, and run never import this path.
-    if (!opts.catalog && catalog.source === "cache" && catalog.stale) {
+    const catalogRefreshAllowed = process.env.VITEST !== "true"
+        || opts.catalogFetcher !== undefined
+        || opts.catalogNow !== undefined
+        || globalThis.fetch !== initialFetch;
+    if (!opts.catalog && catalog.stale && catalogRefreshAllowed) {
         const refreshed = await refreshCatalogCommand({
             repoRoot: cwd,
             fetcher: opts.catalogFetcher,
@@ -368,7 +373,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             now: opts.catalogNow,
         });
         catalog = refreshed.catalog;
-        catalogRefreshWarning = refreshed.warning;
+        catalogRefreshLine = formatCatalogRefreshLegs(refreshed.legs);
     }
     // banner at START — the logo greets the operator before the ~60s probe wait, never trailing it (operator report 2026-07-17)
     if (opts.banner !== false && visual())
@@ -466,8 +471,8 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     if (catalog.warning) {
         rows.push(attentionRow(`model catalog cache unreadable — ${catalog.warning}; using vendored fallback (advisory — routing unchanged)`));
     }
-    if (catalogRefreshWarning) {
-        rows.push(attentionRow(`model catalog auto-refresh failed open — ${catalogRefreshWarning}; retained ${catalog.source} catalog`));
+    if (catalogRefreshLine) {
+        rows.push(attentionRow(`model catalog auto-refresh — ${catalogRefreshLine}`));
     }
     // v1.48 T1 / v1.86 T12: advisory sweep for known agent CLIs with no drive contract. Presence is
     // resolved through the worker's login shell; advisory targets are never executed or written to health.

package/dist/cli/commands/fleet.js

@@ -3,7 +3,7 @@ import { dirname } from "node:path";
 import { parseArgs } from "node:util";
 import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, modelAuthExclusions } from "../../adapters/registry.js";
 import { catalogModelAdvisory, catalogTierRanking, declaredModelWindow, fleetUnclassifiedModels } from "../../adapters/model-lints.js";
-import { CATALOG_REFRESH_TIMEOUT_MS, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
+import { CATALOG_REFRESH_TIMEOUT_MS, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, readClaudeAliasIdentity } from "../../adapters/claude-code.js";
 import { fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, overlayBytesLoadError, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, unifiedYamlDiff, } from "../../config/config.js";
 import { projectFleetWhy, renderFleetWhy } from "../../config/fleet-why.js";
@@ -14,6 +14,7 @@ import { route } from "../../route/router.js";
 import { disallowedBy } from "../../route/preference.js";
 import { resolveRunMode } from "../../run/daemon.js";
 import { loadRoutingProfile } from "../../run/journal.js";
+const initialFetch = globalThis.fetch;
 const NON_TTY_MSG = "tickmarkr fleet: interactive fleet editor requires a TTY — use `tickmarkr fleet --print` for non-interactive output";
 const QUIT = "fleet: quit without writing";
 // v1.60 T3: every preview surface ranks with the SAME exploration setting as the candidate picker
@@ -98,16 +99,21 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
     const interactive = input.isTTY === true && output.isTTY === true;
     let catalog = readCachedCatalog(cwd, { now: io.catalogNow });
     let refreshReason = "";
-    if (catalog.source === "cache" && catalog.stale) {
+    let catalogRefreshAttempted = false;
+    const catalogRefreshAllowed = process.env.VITEST !== "true"
+        || io.catalogFetcher !== undefined
+        || io.catalogNow !== undefined
+        || globalThis.fetch !== initialFetch;
+    if (catalog.stale && catalogRefreshAllowed) {
         const refreshed = await refreshCatalogCommand({
             repoRoot: cwd,
             fetcher: io.catalogFetcher,
             timeoutMs: CATALOG_REFRESH_TIMEOUT_MS,
             now: io.catalogNow,
         });
+        catalogRefreshAttempted = true;
         catalog = refreshed.catalog;
-        if (refreshed.warning)
-            refreshReason = `fleet: catalog auto-refresh failed open — ${refreshed.warning}; retained ${catalog.source} catalog`;
+        refreshReason = `fleet: catalog auto-refresh — ${formatCatalogRefreshLegs(refreshed.legs)}`;
     }
     if (print) {
         // v1.51 T4: the print surface names the mode and its source layer right under the header —
@@ -129,7 +135,7 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
     if (!why && interactive) {
         const { reuse } = initDoctorReuse(cwd, values.fresh ?? false);
         if (!reuse) {
-            output.write(`${await doctor([], cwd, adapters, { banner: false, compact: true })}\n`);
+            output.write(`${await doctor([], cwd, adapters, { banner: false, compact: true, ...(catalogRefreshAttempted ? { catalog } : {}), catalogFetcher: io.catalogFetcher, catalogNow: io.catalogNow })}\n`);
         }
     }
     const assembled = await assembleFleetEditor(cwd, adapters, io, { globalDir, catalog });

package/dist/cli/commands/init.js

@@ -11,6 +11,7 @@ import { BANNER, kvRow, legend, rule, statusRow, title } from "../../brand.js";
 import { tickmarkrDir } from "../../graph/graph.js";
 import { orcaHostDetected } from "../../drivers/index.js";
 import { Journal } from "../../run/journal.js";
+import { runLockRunId, runStatusLine } from "../../run/lock.js";
 import { doctor } from "./doctor.js";
 import { assembleFleetEditor } from "./fleet.js";
 const SCAFFOLD_SPEC = "tickmarkr.spec.md";
@@ -24,20 +25,18 @@ const ENVIRONMENTS_FOOTER = [
     "  claude code — tickmarkr init --agent installs the /tkr skills + AGENTS.md so Claude Code (or any agent CLI) drives the loop natively",
     "  anywhere — no herdr or Orca terminal? same fail-closed gates, headless subprocess driver (legacy: no herdr? same fail-closed gates, headless subprocess driver when Orca markers are absent)",
 ].join("\n");
-/** Latest journal without a run-end event, if any. */
-function activeRunId(cwd) {
-    const runId = Journal.latestRunId(cwd, { withJournal: true });
+/** Current run truth, lock first; falls back to an abandoned journal. */
+function activeRunLine(cwd) {
+    const locked = runLockRunId(cwd);
+    const runId = locked ?? Journal.latestRunId(cwd, { withJournal: true });
     if (!runId)
         return null;
+    let events = [];
     try {
-        const events = Journal.open(cwd, runId).read();
-        if (events.some((e) => e.event === "run-end"))
-            return null;
-        return runId;
-    }
-    catch {
-        return null;
+        events = Journal.open(cwd, runId).read();
     }
+    catch { /* lock may exist before first journal row */ }
+    return runStatusLine(cwd, runId, events);
 }
 /** Relative paths of specs/*.spec.md already in the repo. */
 function existingSpecs(cwd) {
@@ -56,9 +55,9 @@ function existingSpecs(cwd) {
 }
 /** Context-aware next-steps line (operator-approved 2026-07-17). */
 function nextSteps(cwd, scaffoldedSpec) {
-    const runId = activeRunId(cwd);
-    if (runId)
-        return `run ${runId} active — tickmarkr status`;
+    const runLine = activeRunLine(cwd);
+    if (runLine)
+        return `${runLine} — tickmarkr status`;
     const specs = existingSpecs(cwd);
     if (specs.length > 0) {
         const listed = specs.length <= 3 ? specs.join(", ") : `${specs.slice(0, 3).join(", ")}, …`;