tickmarkr 2.4.0 → 2.4.1

package/dist/cli/commands/plan.js

@@ -6,7 +6,7 @@ import { formatModelAuthLine, contextWindowLints, modelLints, preferEntryLints,
 import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
 import { classifyContextPath } from "../../compile/native.js";
-import { DEFAULT_CONFIG, overlayPreferShapes, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
+import { DEFAULT_CONFIG, effectiveReviewPolicy, overlayPreferShapes, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
 import { loadGraph } from "../../graph/graph.js";
 import { renderAcceptanceItem } from "../../graph/schema.js";
 import { resolveRunMode } from "../../run/daemon.js";
@@ -14,11 +14,12 @@ import { disallowedBy, excludedChannels, exclusionLine, routingEntrySeatLines }
 import { staffLedEvidence } from "../../route/profile.js";
 import { route, RoutingError } from "../../route/router.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
-import { modelId, modelProvider } from "../../gates/review.js";
-import { loadRoutingProfile } from "../../run/journal.js";
+import { modelId, modelProvider, pickReviewer } from "../../gates/review.js";
+import { Journal, loadRoutingProfile } from "../../run/journal.js";
 import { harnessLine, resolveHarness } from "../harness.js";
-import { shq } from "../../adapters/types.js";
+import { channelKey, shq } from "../../adapters/types.js";
 import { shGit } from "../../run/git.js";
+import { runLockRunId, runStatusLine } from "../../run/lock.js";
 import { driverEvidence, pickDriver } from "../../drivers/index.js";
 // T4 (v1.50): TTY-only brand pass — the title helper frames the routing table, lint/unroutable
 // markers carry the attention glyph, section labels dim to chrome (the doctor/status system).
@@ -44,6 +45,19 @@ const fleetCanCrossVendorReview = (channels) => {
     return false;
 };
 const NAMED_CRITERION_PATH = /(?:^|[\s("'`])((?:src|tests|fixtures|scripts)\/[A-Za-z0-9_@{}*?.,/+-]+\.(?:tsx|ts|jsx|json|js|mjs|cjs|md|txt))(?![A-Za-z0-9])/g;
+const judgeOracle = (task) => task.acceptance.some((item) => typeof item === "string" || (typeof item === "object" && item.oracle === "judge"));
+const latestRunStatusLine = (cwd) => {
+    const locked = runLockRunId(cwd);
+    const runId = locked ?? Journal.latestRunId(cwd, { withJournal: true });
+    if (!runId)
+        return null;
+    let events = [];
+    try {
+        events = Journal.open(cwd, runId).read();
+    }
+    catch { /* lock may exist before first journal row */ }
+    return runStatusLine(cwd, runId, events);
+};
 async function taskInputFindings(tasks, cwd) {
     const pathsByTask = tasks.map((task) => {
         const paths = new Set(task.files.map((path) => path.replace(/^\.\//, "")));
@@ -169,11 +183,13 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     // source, and the explore posture; each task row carries a floor-derivation line below.
     // v1.89 T4: the harness names itself ABOVE the routing table — the table is only as trustworthy as the
     // binary that produced it, and version equality cannot tell an installed package from a checkout.
+    const runLine = latestRunStatusLine(cwd);
     const lines = [
         `tickmarkr plan — dry run (${channels.length} channels available)`,
         `mode: ${mode.mode} (${source}) · explore ${cfg.routing.explore?.mode ?? "on"}`,
         `driver: ${driverEvidence(cfg, selectedDriver, values.driver)}`,
         harnessLine(resolveHarness(harnessFrom)),
+        ...(runLine ? [runLine] : []),
         "",
     ];
     const judgeDeny = disallowedBy(cfg.judge, cfg.routing, "judge");
@@ -273,6 +289,28 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
         lints.push("review: no cross-vendor reviewer pair in fleet — set review.required: false to waive");
     }
     let cost = 0;
+    const seatCost = (seat) => seat?.channel === "api" ? cfg.pricing[seat.tier] : 0;
+    const judgeSeat = (task) => {
+        const shapeGates = cfg.gates.byShape?.[task.shape];
+        if (!task.gates.includes("acceptance") || shapeGates?.acceptance === false)
+            return { line: "none — acceptance gate disabled", cost: 0 };
+        if (!judgeOracle(task))
+            return { line: "none — no judge oracle", cost: 0 };
+        const seat = pools.judge.find((c) => c.adapter === cfg.judge.adapter && c.model === cfg.judge.model);
+        return { line: `${cfg.judge.adapter}:${cfg.judge.model}`, cost: seatCost(seat) };
+    };
+    const reviewSeat = (task, author) => {
+        const shapeGates = cfg.gates.byShape?.[task.shape];
+        if (!task.gates.includes("review") || shapeGates?.review === false)
+            return { line: "none — review gate disabled", cost: 0 };
+        const policy = effectiveReviewPolicy(task.files, cfg.review);
+        if (policy === "judge-only")
+            return { line: "none — reviewPolicy judge-only: declared leaf paths", cost: 0 };
+        const reviewer = pickReviewer(author, pools.review, [], cfg.review.prefer ?? [], task.routingHints?.floor);
+        if (!reviewer)
+            return { line: "none — no cross-vendor reviewer available", cost: 0 };
+        return { line: `${channelKey(reviewer)} — reviewPolicy full`, cost: seatCost(reviewer) };
+    };
     const routed = [];
     for (const t of g.tasks) {
         const refusals = [...(oracleRefusals.get(t.id) ?? []), ...(inputRefusals.get(t.id) ?? [])];
@@ -288,8 +326,10 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
                 lints.push(suf ? `${l}${suf}` : l);
             }
             const est = r.assignment.channel === "sub" ? 0 : cfg.pricing[r.assignment.tier];
-            cost += est;
-            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`);
+            const judge = judgeSeat(t);
+            const review = reviewSeat(t, r.assignment);
+            cost += est + judge.cost + review.cost;
+            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`, `    judge: ${judge.line}${judge.cost ? ` ~$${judge.cost.toFixed(2)}` : ""}`, `    review: ${review.line}${review.cost ? ` ~$${review.cost.toFixed(2)}` : ""}`);
             const d = derivation(t.shape);
             if (d)
                 lines.push(d);
@@ -326,7 +366,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     if (inputWarnings.length) {
         lines.push("", "input warnings:", ...inputWarnings.map((finding) => `  ! ${finding.taskId}: ${finding.detail}`));
     }
-    lines.push("", `est. cost (API channels only, rough): ~$${cost.toFixed(2)} + judge/review/consult calls`);
+    lines.push("", `est. cost (API LLM seats, rough): ~$${cost.toFixed(2)} + consult calls`);
     // VIS-04: summary only when a profile is active AND something deviates. Labeled by the switch — off = preview.
     if (profile && deviations) {
         lines.push(cfg.routing.learned === "off"

package/dist/cli/commands/run.js

@@ -2,7 +2,7 @@ import { parseArgs } from "node:util";
 import { allAdapters, discoverChannels, probeAll, readDoctor } from "../../adapters/registry.js";
 import { ROUTING_MODES } from "../../config/config.js";
 import { parseDriverOverride, pickDriver } from "../../drivers/index.js";
-import { loadGraph } from "../../graph/graph.js";
+import { loadGraph, onDiskSpecHash, readCompileRefusal } from "../../graph/graph.js";
 import { formatSummary, resolveRunMode, runDaemon } from "../../run/daemon.js";
 import { isRunLockLive } from "../../run/lock.js";
 import { route, NO_EXPLORE_ENV } from "../../route/router.js";
@@ -424,7 +424,26 @@ export async function run(argv, cwd = process.cwd()) {
     if (values.quality)
         console.warn(QUALITY_ALIAS_NOTICE);
     const flagMode = values.mode ?? (values.quality ? "partner-led" : undefined);
+    const refusal = (() => {
+        try {
+            return readCompileRefusal(cwd);
+        }
+        catch (error) {
+            throw new Error(`refusing to run: ${error instanceof Error ? error.message : String(error)}. `
+                + "Recompile successfully with `tickmarkr compile <src>` before running.");
+        }
+    })();
+    if (refusal) {
+        throw new Error(`refusing to run the prior graph: the last compile of ${refusal.source} was refused at ${refusal.refusedAt}:\n`
+            + `${refusal.error}\n`
+            + "Recompile successfully with `tickmarkr compile <src>` to clear the refusal record before running.");
+    }
     const graph = loadGraph(cwd);
+    const diskSpec = onDiskSpecHash(cwd, graph);
+    if (diskSpec && diskSpec.hash !== graph.spec.hash) {
+        throw new Error(`refusing to run a stale graph: ${diskSpec.path} content hash ${diskSpec.hash} differs from `
+            + `the graph's recorded spec hash ${graph.spec.hash}. Recompile with \`tickmarkr compile <src>\` before running.`);
+    }
     const { cfg, conflict } = resolveRunMode(cwd, { flag: flagMode, spec: graph.mode });
     if (conflict) {
         // Loud, never silent: live intent (the flag) may override compiled intent (the spec) — strict refuses.

package/dist/cli/commands/status.js

@@ -9,7 +9,7 @@ import { blockedTasks, graphDefinitionHash, loadGraph, stateDirName } from "../.
 import { GATE_NAMES } from "../../graph/schema.js";
 import { foldActivity } from "../../run/activity.js";
 import { Journal, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, } from "../../run/journal.js";
-import { isPidLive, runLockOwner } from "../../run/lock.js";
+import { isPidLive, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
 import { normalizeStallSnapshot } from "../../run/stall.js";
@@ -860,17 +860,6 @@ const parseJournalSnapshot = (raw) => raw.split("\n").flatMap((line) => {
 // .tickmarkr metadata; an engine-written lock necessarily passed through that initializer already, so
 // status avoids invoking it in stripped reader-purity fixtures where no engine lock can exist.
 const canReadRunLockOwner = (cwd) => existsSync(join(cwd, stateDirName(cwd), ".gitignore"));
-const reportableLockRunId = (owner) => {
-    if (!owner?.live || owner.runId === undefined)
-        return undefined;
-    try {
-        return parseRunId(owner.runId);
-    }
-    catch {
-        // Repository-wide locks can be held for non-run work such as compile; those are not a status run.
-        return undefined;
-    }
-};
 const readRunJournalRaw = (cwd, runId, allowMissingJournal) => {
     const dir = join(cwd, stateDirName(cwd), "runs", runId);
     try {
@@ -900,7 +889,7 @@ const readRunJournalRaw = (cwd, runId, allowMissingJournal) => {
 const readRunRecord = (cwd, graph, namedRunId) => {
     const explicitRunId = namedRunId === undefined ? undefined : parseRunId(namedRunId);
     const lockedRunId = explicitRunId === undefined && canReadRunLockOwner(cwd)
-        ? reportableLockRunId(runLockOwner(cwd))
+        ? runLockRunId(cwd)
         : undefined;
     const runId = explicitRunId ?? lockedRunId ?? Journal.latestRunId(cwd, { withJournal: true });
     if (!runId)
@@ -947,6 +936,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
     const record = readRunRecord(cwd, g, namedRunId);
     const runId = record?.runId;
     const events = record?.events ?? [];
+    const runLine = runId && record ? runStatusLine(cwd, runId, events) : null;
     // The header and every live-phase consumer share this exact process reading. Proved death retires
     // stale phase markers; unknown identity deliberately does not, preserving pre-identity journals.
     const daemon = daemonLiveness(events);
@@ -1091,7 +1081,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
         });
         const zone = journalRowsOnly ? `${divider}zone ${localZoneLabel(zoneReference)}` : "";
         const header = runId
-            ? `tickmarkr status${divider}run ${runId}${zone}${supersededBy ? `${divider}superseded by ${supersededBy}` : ""}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events, daemon, now).replaceAll(" · ", divider)}${verify ? `${divider}${verify}` : ""}${divider}${tipPhase ? `${done}/${total} tasks done${divider}run not verified` : `${done}/${total} done`}`
+            ? `tickmarkr status${divider}${runLine ?? `run ${runId}`}${zone}${supersededBy ? `${divider}superseded by ${supersededBy}` : ""}${!comparable ? `${divider}${NOT_COMPARABLE_NOTICE}` : ""}${divider}${liveness(events, daemon, now).replaceAll(" · ", divider)}${verify ? `${divider}${verify}` : ""}${divider}${tipPhase ? `${done}/${total} tasks done${divider}run not verified` : `${done}/${total} done`}`
             : `tickmarkr status${zone}${divider}no runs yet${divider}${done}/${total} done`;
         const legendLine = `  gates: ${GATE_NAMES.map((gate) => `${GATE_KEYS[gate]} ${gate}`).join(divider)}`;
         return {
@@ -1115,7 +1105,8 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
     const tally = tipPhase
         ? `${progressTone(`${progressGlyph} ${done}/${total} tasks done`)}${dot}${progressTone("run not verified")}`
         : done === total && total > 0 ? ok(`${done}/${total} done`) : information(`${done}/${total} done`);
-    const live = `${liveness(events, daemon, now)} · load1 ${os.loadavg()[0].toFixed(2)}`
+    const load1 = os.loadavg()[0] ?? 0;
+    const live = `${liveness(events, daemon, now)} · load1 ${load1.toFixed(2)}`
         .replace(/\bdead\b/u, fail("dead"))
         .replace(/\bfinished\b/u, dim("finished"))
         .replace(/\balive\b/u, running("alive"))
@@ -1133,6 +1124,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
                     ? ok(verify)
                     : tipFailed ? fail(`${GLYPHS.fail} ${verify}`) : warn(`${GLYPHS.attention} ${verify}`)]),
         ...(runId ? [live] : []),
+        ...(runLine && runLine !== `run ${runId}` ? [runLine] : []),
         ...(journalRowsOnly ? [`zone ${localZoneLabel(zoneReference)}`] : []),
     ].join(separator);
     // The brand lockup is two rows and stays two rows at every width: the muted chip, and the running
@@ -1427,7 +1419,7 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
         // newer runs start. The no-argument form tracks the live lock first, then latest journal.
         const explicitRunId = namedRunId === undefined ? undefined : parseRunId(namedRunId);
         const lockedRunId = explicitRunId === undefined && canReadRunLockOwner(cwd)
-            ? reportableLockRunId(runLockOwner(cwd))
+            ? runLockRunId(cwd)
             : undefined;
         const runId = explicitRunId ?? lockedRunId ?? Journal.latestRunId(cwd, { withJournal: true });
         if (!runId)
@@ -1494,16 +1486,22 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
         process.stdout.write(`\x1b]0;⏳ ${hotPhase.taskId} ${phaseLabel(hotPhase)} ${fmtElapsed(nowMs - hotPhase.startedAt)}\x07`);
     };
     const signalHandlers = [];
+    let exitingFromSignal = false;
     const exitFromSignal = (code) => () => {
+        if (exitingFromSignal)
+            return;
+        exitingFromSignal = true;
         if (titleSaved) {
             process.removeListener("exit", restoreTitle);
             restoreTitle();
         }
-        if (alternateScreen) {
-            process.removeListener("exit", leaveAlternateScreen);
-            leaveAlternateScreen();
+        if (!alternateScreen) {
+            process.exit(code);
+            return;
         }
-        process.exit(code);
+        process.removeListener("exit", leaveAlternateScreen);
+        alternateScreen = false;
+        process.stdout.write(LEAVE_ALTERNATE_SCREEN, () => process.exit(code));
     };
     if (!bounded && !eventStream && tty) {
         process.stdout.write(ENTER_ALTERNATE_SCREEN);
@@ -1527,7 +1525,8 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
                     if (bounded)
                         eventLines.push(line);
                 }
-                process.stderr.write("status: keepalive\n");
+                if (decisionEvents.length === 0)
+                    process.stderr.write("status: keepalive\n");
             }
             else {
                 frame = renderFrame(cwd, binaryVersion, nowMs, i, workerLiveness, true, namedRunId);

package/dist/cli/commands/version.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { dirname, join, relative } from "node:path";
+import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "../../../package.json");
 const distDir = join(dirname(pkgPath), "dist");
@@ -25,5 +25,5 @@ export function distFingerprint(dir = distDir) {
 }
 export async function version(argv = [], dir = distDir) {
     const { version: v } = JSON.parse(readFileSync(pkgPath, "utf8"));
-    return argv.includes("--dist") ? `${v} dist:${distFingerprint(dir)}` : v;
+    return argv.includes("--dist") ? `${v} dist:${resolve(dir)} fingerprint:${distFingerprint(dir)}` : v;
 }

package/dist/compile/collateral.d.ts

@@ -47,12 +47,21 @@ export declare function collateralLints(tasks: ReadonlyArray<Pick<Task, "id" | "
  */
 export declare function criterionReadsOnly(text: string, target: string): boolean;
 export declare function newDirectoryLints(tasks: ReadonlyArray<Pick<Task, "id" | "files">>, repoRoot: string): string[];
+export interface SourceScopeFinding {
+    taskId: string;
+    /** Complete sorted hit set. Rendering may cap it; compile-time enforcement never does. */
+    paths: string[];
+}
+/** Structured OBS-76 findings shared by human rendering and native compile enforcement. */
+export declare function sourceScopeFindings(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>, repoRoot: string): SourceScopeFinding[];
+/** Human display is derived from the structured finding; no enforcement path parses this text. */
+export declare function renderSourceScopeFinding(finding: SourceScopeFinding): string;
 /**
  * OBS-76 class: sweep src/ for out-of-scope source files that reference a symbol the acceptance
  * criteria name — the v1.52 router.ts omission, named at plan time instead of one judge round in.
  * Advisory plan output only, same contract as collateralLints.
  */
-export declare function sourceScopeLints(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>, repoRoot: string): string[];
+export declare function sourceScopeLints(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>, repoRoot: string, findings?: readonly SourceScopeFinding[]): string[];
 /** Max acceptance items per task. Consult-converged (copus/csol/cfable R2). */
 export declare const MAX_ACCEPTANCE_ITEMS = 6;
 /** Max files[] patterns per task. */
@@ -141,15 +150,15 @@ export type ReviewParticipation = TickmarkrConfig["review"] & {
 export declare function reviewParticipationErrors(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "shape">>, review: ReviewParticipation): string[];
 /**
  * Every Task Unit Contract violation in one pass, ready to throw. `repoRoot` backs the
- * symbol-ownership lint and the participation config, and defaults to the invocation directory —
- * correct for the CLI/daemon, which compile from inside the target repo.
+ * symbol-ownership lint and participation overlay, and defaults to the invocation directory for
+ * programmatic compiles. The CLI passes its target repository explicitly.
  *
  * The read declaration (`context:`) rides on this parameter, on the task objects themselves — the
  * aggregator never infers it from the repo, the config, or a sibling task. It is OPTIONAL: a caller
  * whose task objects carry no `context` gets byte-identical verdicts to the ones it got before the
  * field existed, because an absent declaration grants no authority at all.
  *
- * The compile seam in src/compile/index.ts threads `compileSource`'s repo root here, so CLI tests
- * and programmatic compiles check the same repository overlay the later run will use.
+ * The compile seam in src/compile/index.ts threads `compileSource`'s repo root here when supplied;
+ * otherwise this function deliberately checks process.cwd().
  */
 export declare function taskUnitContractErrors(tasks: ReadonlyArray<Pick<Task, "id" | "goal" | "files" | "deps" | "acceptance" | "shape"> & Partial<Pick<Task, "context">>>, repoRoot?: string, review?: ReviewParticipation): string[];

package/dist/compile/collateral.js

@@ -460,23 +460,18 @@ export function newDirectoryLints(tasks, repoRoot) {
     }
     return lines;
 }
-/**
- * OBS-76 class: sweep src/ for out-of-scope source files that reference a symbol the acceptance
- * criteria name — the v1.52 router.ts omission, named at plan time instead of one judge round in.
- * Advisory plan output only, same contract as collateralLints.
- */
-export function sourceScopeLints(tasks, repoRoot) {
-    const newDirLints = newDirectoryLints(tasks, repoRoot);
+/** Structured OBS-76 findings shared by human rendering and native compile enforcement. */
+export function sourceScopeFindings(tasks, repoRoot) {
     const perTask = tasks
         .map((t) => ({ t, needles: criteriaSymbols(t.acceptance) }))
         .filter((x) => x.needles.length);
     if (!perTask.length)
-        return newDirLints;
+        return [];
     const srcFiles = walkCode(repoRoot, "src");
     if (!srcFiles.length)
-        return newDirLints;
+        return [];
     const read = makeReader(repoRoot);
-    const lines = [];
+    const findings = [];
     for (const { t, needles } of perTask) {
         // OBS-22: scopeGate accepts picomatch globs; advisory warnings must agree.
         const scoped = filesGlob(t.files.map((f) => f.replace(/^\.\//, "")));
@@ -495,11 +490,23 @@ export function sourceScopeLints(tasks, repoRoot) {
         if (!hits.length)
             continue;
         hits.sort();
-        const listed = hits.slice(0, MAX_HITS_PER_TASK).join(", ");
-        const tail = hits.length > MAX_HITS_PER_TASK ? " (capped)" : "";
-        lines.push(`${t.id}: criteria implicate out-of-scope source not in files[]: ${listed}${tail}`);
+        findings.push({ taskId: t.id, paths: hits });
     }
-    return [...newDirLints, ...lines];
+    return findings;
+}
+/** Human display is derived from the structured finding; no enforcement path parses this text. */
+export function renderSourceScopeFinding(finding) {
+    const listed = finding.paths.slice(0, MAX_HITS_PER_TASK).join(", ");
+    const tail = finding.paths.length > MAX_HITS_PER_TASK ? " (capped)" : "";
+    return `${finding.taskId}: criteria implicate out-of-scope source not in files[]: ${listed}${tail}`;
+}
+/**
+ * OBS-76 class: sweep src/ for out-of-scope source files that reference a symbol the acceptance
+ * criteria name — the v1.52 router.ts omission, named at plan time instead of one judge round in.
+ * Advisory plan output only, same contract as collateralLints.
+ */
+export function sourceScopeLints(tasks, repoRoot, findings = sourceScopeFindings(tasks, repoRoot)) {
+    return [...newDirectoryLints(tasks, repoRoot), ...findings.map(renderSourceScopeFinding)];
 }
 // ── Task Unit Contract (OBS-212 / OBS-214) ────────────────────────────────────────────────────
 // These are ERRORS, not advisories. Everything above this line is a plan-time warning the author
@@ -835,9 +842,9 @@ export function symbolOwnershipErrors(tasks, repoRoot) {
  * cannot be a warning, because nothing downstream would stop it — the gate would honour the policy.
  */
 export function reviewParticipationErrors(tasks, review) {
-    // The shipped critical paths are a FLOOR, not a default that a config replaces: this lint resolves
-    // its config from a repo root the compile seam cannot always name (see taskUnitContractErrors), and
-    // the one direction that must never happen is a wrong root lowering enforcement below what tickmarkr
+    // The shipped critical paths are a FLOOR, not a default that a config replaces: a programmatic
+    // compile may rely on taskUnitContractErrors' process.cwd() default, and the one direction that
+    // must never happen is a mismatched invocation root lowering enforcement below what tickmarkr
     // ships. Union is monotone — a repo-local list can only add.
     const critical = [...new Set([...DEFAULT_REVIEW_CRITICAL_PATHS, ...(review.criticalPaths ?? [])])];
     const errors = [];
@@ -871,11 +878,10 @@ export function reviewParticipationErrors(tasks, review) {
     return errors;
 }
 /**
- * The ACTIVE participation config for a compile rooted at `repoRoot`. Same default-argument contract
- * as `repoRoot` itself: the CLI and daemon compile from inside the target repo, so the repo's own
- * config (plus the global overlay) is the config the run will gate under. A config the loader cannot
- * read degrades to the shipped defaults rather than crashing the compile — every command that reaches
- * this seam loads the same config itself and reports a malformed one loudly.
+ * The ACTIVE participation config for a compile rooted at `repoRoot`. CLI compilation supplies its
+ * target root; a programmatic caller that omits it uses taskUnitContractErrors' process.cwd() default,
+ * so its active overlay is the invocation repository. Native CLI compiles independently read the
+ * overlay fail-closed at the finalization seam, so malformed YAML is loud.
  */
 function activeReviewParticipation(repoRoot) {
     try {
@@ -888,16 +894,16 @@ function activeReviewParticipation(repoRoot) {
 }
 /**
  * Every Task Unit Contract violation in one pass, ready to throw. `repoRoot` backs the
- * symbol-ownership lint and the participation config, and defaults to the invocation directory —
- * correct for the CLI/daemon, which compile from inside the target repo.
+ * symbol-ownership lint and participation overlay, and defaults to the invocation directory for
+ * programmatic compiles. The CLI passes its target repository explicitly.
  *
  * The read declaration (`context:`) rides on this parameter, on the task objects themselves — the
  * aggregator never infers it from the repo, the config, or a sibling task. It is OPTIONAL: a caller
  * whose task objects carry no `context` gets byte-identical verdicts to the ones it got before the
  * field existed, because an absent declaration grants no authority at all.
  *
- * The compile seam in src/compile/index.ts threads `compileSource`'s repo root here, so CLI tests
- * and programmatic compiles check the same repository overlay the later run will use.
+ * The compile seam in src/compile/index.ts threads `compileSource`'s repo root here when supplied;
+ * otherwise this function deliberately checks process.cwd().
  */
 export function taskUnitContractErrors(tasks, repoRoot = process.cwd(), review = activeReviewParticipation(repoRoot)) {
     return [

package/dist/compile/index.js

@@ -37,12 +37,16 @@ function detect(src) {
 function repoOverlayMode(repoRoot) {
     if (!repoRoot)
         return undefined;
+    const path = join(repoRoot, ".tickmarkr", "config.yaml");
+    if (!existsSync(path))
+        return undefined;
     try {
-        const cfg = parse(readFileSync(join(repoRoot, ".tickmarkr", "config.yaml"), "utf8"));
+        const cfg = parse(readFileSync(path, "utf8"));
         return typeof cfg?.routing?.mode === "string" ? cfg.routing.mode : undefined;
     }
-    catch {
-        return undefined;
+    catch (error) {
+        throw new CompileError(`${path} does not parse, so compile cannot prove the repository routing overlay: `
+            + `${error instanceof Error ? error.message : String(error)}`);
     }
 }
 function hasModeOverride(src) {
@@ -58,9 +62,13 @@ function hasModeOverride(src) {
     return false;
 }
 function enforceModeOverlay(graph, src, repoRoot) {
-    if (graph.spec.source !== "native" || graph.mode === undefined)
+    if (graph.spec.source !== "native")
         return;
+    // Read every native compile's overlay before checking whether either side declares a mode. A
+    // corrupt file cannot masquerade as an absent mode and silently skip the disagreement gate.
     const overlayMode = repoOverlayMode(repoRoot);
+    if (graph.mode === undefined)
+        return;
     if (overlayMode === undefined || overlayMode === graph.mode || hasModeOverride(src))
         return;
     throw new CompileError(`${src} front-matter mode ${graph.mode} disagrees with repository routing.mode ${overlayMode}; `
@@ -75,7 +83,7 @@ function enforceTaskUnitContract(g, src, repoRoot) {
     return g;
 }
 export function finalizePlan(plan, src, repoRoot) {
-    const graph = enforceTaskUnitContract(validateGraph({
+    const graph = validateGraph({
         version: plan.version,
         ...(plan.mode !== undefined ? { mode: plan.mode } : {}),
         spec: {
@@ -85,8 +93,11 @@ export function finalizePlan(plan, src, repoRoot) {
             ...(plan.base !== undefined ? { base: plan.base } : {}),
         },
         tasks: plan.tasks,
-    }), src, repoRoot);
+    });
+    // Overlay readability is compile truth, not a mode-disagreement optimization. Check it before
+    // other repo-dependent lints so malformed native config cannot be hidden by an earlier finding.
     enforceModeOverlay(graph, src, repoRoot);
+    enforceTaskUnitContract(graph, src, repoRoot);
     // overseer-217 removal condition, now paid: on this milestone's authored graph the conventional
     // name map emitted 21 raw unowned-test findings; review found 1 real and 20 false, while intersecting
     // with a direct import or command-entry spawn retained the real one and left 0 false positives. That

package/dist/compile/native.js

@@ -286,11 +286,19 @@ export function authoringLintFindings(tasks, file) {
             if (scope)
                 findings.push(scope);
             for (const symbol of fencedIdentifiers(text)) {
-                if (!taskTexts.size || [...taskTexts.values()].some((body) => body.includes(symbol)))
+                // Empty files[] is the deliberately unrestricted scope and a non-repository programmatic
+                // compile has no disk corpus to prove against. But a declared files[] that expands to zero
+                // repository files is evidence, not absence: its preservation fence cannot be satisfied.
+                if (!root || task.files.length === 0)
                     continue;
+                if ([...taskTexts.values()].some((body) => body.includes(symbol)))
+                    continue;
+                const matchDetail = taskFiles.length === 0
+                    ? `this task's files[] matched zero files on disk (${task.files.join(", ")})`
+                    : `that symbol has zero hits in this task's files[] (${taskFiles.join(", ")})`;
                 findings.push({
                     code: "fence-symbol-absent", fixtureId: id, taskId: task.id, criterion: index + 1,
-                    detail: `preservation fence cites \`${symbol}\` but that symbol has zero hits in this task's files[] (${taskFiles.join(", ")}) — OBS-604`,
+                    detail: `preservation fence cites \`${symbol}\` but ${matchDetail} — OBS-604`,
                 });
             }
             if (/line[- ]count|physical line|not greater than (?:the|\d)|no larger than|at most \d+ (?:lines|bytes)/i.test(text)) {

package/dist/compile/ownership.js

@@ -34,24 +34,29 @@ function sourceFiles(repoRoot) {
         return [];
     }
 }
-// OBS-898: `allSources` is indexed once per ownership pass by the caller, never per test source.
-function namedSources(test, tasks, allSources) {
-    const stem = basename(test).replace(/\.test\.ts$/, "");
+// OBS-898: expand the task's source declarations against ONE source-tree listing, once per compile.
+// Tests then query this in-memory index; neither a test file nor a second corroboration pass can
+// trigger another source walk or glob expansion.
+function namedSourceIndex(tasks, allSources) {
     const matches = new Map();
     for (const task of tasks) {
         for (const entry of task.files.map(normalize).filter((path) => path.startsWith("src/"))) {
             const fromGlob = /[*?{[]/.test(entry);
             const entries = fromGlob ? allSources.filter(filesGlob(entry)) : [entry];
             for (const sourcePath of entries) {
-                const source = basename(sourcePath, extname(sourcePath));
-                if (stem === source || stem.startsWith(`${source}-`)) {
-                    matches.set(`${task.id}:${sourcePath}`, { taskId: task.id, source: sourcePath, fromGlob });
-                }
+                matches.set(`${task.id}:${sourcePath}`, { taskId: task.id, source: sourcePath, fromGlob });
             }
         }
     }
     return [...matches.values()];
 }
+function namedSources(test, index) {
+    const stem = basename(test).replace(/\.test\.ts$/, "");
+    return index.filter(({ source }) => {
+        const sourceStem = basename(source, extname(source));
+        return stem === sourceStem || stem.startsWith(`${sourceStem}-`);
+    });
+}
 const moduleKey = (path) => normalize(path).replace(/\.(?:[cm]?[jt]sx?)$/, "");
 function directImportSpecifiers(text) {
     // Comments cannot create an edge. Keep strings intact because they are the import target.
@@ -167,9 +172,10 @@ export function ownershipFindings(tasks, repoRoot) {
     }
     const globOwnedTests = new Map();
     const allSources = sourceFiles(repoRoot);
+    const namedIndex = namedSourceIndex(tasks, allSources);
     for (const source of sources) {
         const ids = predictedBy.get(source.path) ?? new Set();
-        for (const named of namedSources(source.path, tasks, allSources)) {
+        for (const named of namedSources(source.path, namedIndex)) {
             ids.add(named.taskId);
             if (named.fromGlob) {
                 const owners = globOwnedTests.get(source.path) ?? new Set();
@@ -185,7 +191,7 @@ export function ownershipFindings(tasks, repoRoot) {
         if (owners(test).length === 0 && !(globOwnedTests.get(test)?.size)) {
             const ids = [...taskIds].sort();
             const source = sourceByPath.get(test);
-            const evidence = corroboration(source, namedSources(test, tasks, allSources));
+            const evidence = corroboration(source, namedSources(test, namedIndex));
             findings.push({
                 code: "unowned-test",
                 test,

package/dist/drivers/herdr.d.ts

@@ -71,6 +71,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     private watches;
     constructor(bin?: string, workersPerTab?: number, time?: HerdrTimeSource, journal?: DriverJournal | undefined);
     private appendDispatchRetry;
+    private appendPaneClose;
     private openRunJournal;
     private liveSupervisionSeats;
     private journalReconcile;

package/dist/drivers/herdr.js

@@ -196,6 +196,29 @@ export class HerdrDriver {
         // recovery to the file and the pipe while the operator's rail stays silent about it.
         Journal.open(repoRoot, owned.runId, this.narrate).append("dispatch-retry", owned.taskId, data);
     }
+    // OBS-906: close() is the harvest path, not a reconcile path, so the sweep's close row cannot
+    // describe it. Persist the worker slot identity beside the exact pane/tab address this path used.
+    // A driver used outside a daemon has no bound run journal; the injectable sink remains the unit
+    // seam there, while every daemon-created worktree is bound by worktree() below.
+    appendPaneClose(slot, placement) {
+        const owned = parseOwnedName(slot.name);
+        if (owned?.role !== "worker")
+            return;
+        try {
+            const data = { slot: slot.name, ...placement };
+            if (this.journal) {
+                this.journal("pane-close", slot.name, data);
+                return;
+            }
+            const repoRoot = this.journalRoots.get(slot.cwd);
+            if (!repoRoot)
+                return;
+            Journal.open(repoRoot, owned.runId, this.narrate).append("pane-close", owned.taskId, data);
+        }
+        catch {
+            /* close is best-effort; a journal failure must not make a successful pane reap fatal */
+        }
+    }
     openRunJournal(runId) {
         const roots = new Set(this.journalRoots.values());
         roots.add(process.cwd());
@@ -1101,11 +1124,15 @@ export class HerdrDriver {
             return this.serial(() => this.closeGrouped(slot));
         }
         if (slot.tabId) {
-            await this.herdr(`tab close ${shq(slot.tabId)}`); // reaps the slot's whole tab, best-effort
+            const closed = await this.herdr(`tab close ${shq(slot.tabId)}`); // reaps the slot's whole tab, best-effort
+            if (closed.code === 0)
+                this.appendPaneClose(slot, { tabId: slot.tabId });
             return;
         }
         const pane = await this.paneId(slot);
-        await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        const closed = await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        if (closed.code === 0)
+            this.appendPaneClose(slot, { paneId: pane });
     }
     // D-08 ref-counted teardown, PER GENERATION (VIS-09 item 2): pane close per member; a generation's
     // tab closes only when ITS OWN last member leaves; the group entry dies when all generations are gone.
@@ -1119,7 +1146,9 @@ export class HerdrDriver {
         if (!gen)
             return; // generation already torn down — its tab is gone
         const pane = await this.paneId(slot);
-        await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        const closed = await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        if (closed.code === 0)
+            this.appendPaneClose(slot, { paneId: pane, tabId: gen.tabId });
         gen.members = gen.members.filter((m) => m.name !== slot.name);
         await this.renameGroupTab(gen);
         if (gen.members.length === 0) {