tickmarkr 2.4.0 → 2.4.1

package/dist/drivers/orca.d.ts

@@ -15,6 +15,8 @@ export declare const NOT_WRITABLE_CODE = "terminal_not_writable";
 export declare const RUNNING_STATUS = "running";
 export declare const STATUS_GOVERNED_METHODS: readonly ["read", "waitOutput", "status", "waitAgentStatus"];
 export declare const WORKTREE_ADOPTION_TIMEOUT_MS = 60000;
+/** A missing slot gets the same bounded chance to appear as a reaped shell gets to settle. */
+export declare const PENDING_PROJECT_GRACE_MS = 2000;
 export interface OrcaExec {
     (args: string[], cwd: string, timeoutMs?: number): Promise<ShResult>;
 }
@@ -136,7 +138,7 @@ export declare class OrcaDriver implements ExecutorDriver {
     describe(slot: Slot): {
         surface?: string;
         hostPlatform?: string;
-    };
+    } | undefined;
     run(slot: Slot, cmd: string): Promise<void>;
     private sendText;
     private sendReceipt;
@@ -221,6 +223,8 @@ export declare class OrcaDriver implements ExecutorDriver {
      * that still reports truncated at totalCount rows is a listing this sweep declines to judge on.
      */
     private listAll;
+    private openRunJournal;
+    private dropExpiredProjects;
     /**
      * Sweep tickmarkr-owned terminals down to `desired`. Ownership is decided ONLY by parseOwnedName
      * over the owned TAB title, through the same panesToClose fold herdr uses (drivers/types.ts): an

package/dist/drivers/orca.js

@@ -58,6 +58,8 @@ export const WORKTREE_ADOPTION_TIMEOUT_MS = 60_000;
 const WORKTREE_ADOPTION_POLL_MS = 1_000;
 const WORKTREE_ADOPTION_JOURNAL_MS = 2_000;
 const NUDGE_ECHO_TIMEOUT_MS = 2_000;
+/** A missing slot gets the same bounded chance to appear as a reaped shell gets to settle. */
+export const PENDING_PROJECT_GRACE_MS = 2_000;
 const SYSTEM_TIME = {
     now: () => Date.now(),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -366,7 +368,7 @@ export class OrcaDriver {
             this.taskWorktrees.set(owned.taskId, worktree);
             const pending = this.pendingProjects.get(owned.taskId);
             if (pending) {
-                await this.setWorkspaceStatus(worktree, pending);
+                await this.setWorkspaceStatus(worktree, pending.state);
                 this.pendingProjects.delete(owned.taskId);
             }
         }
@@ -1007,7 +1009,7 @@ export class OrcaDriver {
         if (!worktree) {
             // The daemon projects in-progress immediately before it creates the task checkout/slot.
             // Hold only that latest state; slot() applies it once the task's own path is known.
-            this.pendingProjects.set(taskId, state);
+            this.pendingProjects.set(taskId, { state, since: this.time.now() });
             return;
         }
         await this.setWorkspaceStatus(worktree, state);
@@ -1076,6 +1078,52 @@ export class OrcaDriver {
             throw new OrcaError("list", "terminal list is still truncated at totalCount rows", whole.raw);
         return whole;
     }
+    openRunJournal(runId) {
+        const roots = new Set(this.journalRoots.values());
+        roots.add(process.cwd());
+        for (const repoRoot of roots) {
+            try {
+                return Journal.open(repoRoot, runId, this.narrate);
+            }
+            catch {
+                /* try the next daemon-bound root */
+            }
+        }
+        return undefined;
+    }
+    // A projection exists only to bridge project() to the worker slot that follows it. After the
+    // grace, desired remains the dispatch oracle: a declared worker is still being placed and must
+    // keep its projection. Make genuine absence durable by appending first and deleting second; with
+    // no writable run journal the entry remains eligible for a later reconcile.
+    dropExpiredProjects(desired, runId) {
+        const now = this.time.now();
+        const desiredTasks = new Set();
+        for (const name of desired) {
+            const owned = parseOwnedName(name);
+            if (owned?.role === "worker")
+                desiredTasks.add(owned.taskId);
+        }
+        const expired = [...this.pendingProjects].filter(([, pending]) => now - pending.since > PENDING_PROJECT_GRACE_MS).filter(([taskId]) => !desiredTasks.has(taskId));
+        if (expired.length === 0)
+            return;
+        const journal = this.openRunJournal(runId);
+        if (!journal)
+            return;
+        for (const [taskId, pending] of expired) {
+            try {
+                const pendingMs = Math.max(0, now - pending.since);
+                journal.append("project-unplaced", taskId, {
+                    state: pending.state,
+                    pendingMs,
+                    graceMs: PENDING_PROJECT_GRACE_MS,
+                });
+                this.pendingProjects.delete(taskId);
+            }
+            catch {
+                /* reconcile is cosmetic; preserve the projection until a later journalled drop */
+            }
+        }
+    }
     /**
      * Sweep tickmarkr-owned terminals down to `desired`. Ownership is decided ONLY by parseOwnedName
      * over the owned TAB title, through the same panesToClose fold herdr uses (drivers/types.ts): an
@@ -1091,6 +1139,7 @@ export class OrcaDriver {
      * Cosmetic by contract: every failure is swallowed, per candidate and overall.
      */
     async reconcile(desired, runId, opts) {
+        this.dropExpiredProjects(desired, runId);
         try {
             // Every call below is handle-addressed or explicitly selectored, so the CLI's own cwd selects
             // nothing — it only has to exist, which the checkouts being swept no longer need to.

package/dist/drivers/types.d.ts

@@ -76,7 +76,7 @@ export interface ExecutorDriver {
     /** The exact terminal read surface used for liveness evidence. */
     readSource?: string;
     /** Placement facts returned by drivers whose terminal host exposes them. */
-    describe?(slot: Slot): SlotPlacement | Promise<SlotPlacement>;
+    describe?(slot: Slot): SlotPlacement | Promise<SlotPlacement> | undefined;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
     run(slot: Slot, cmd: string): Promise<void>;
     waitOutput(slot: Slot, pattern: string, timeoutMs: number, opts?: {

package/dist/gates/baseline.d.ts

@@ -24,7 +24,9 @@ export interface BaselineCommand {
     fingerprints: string[];
     missingCommand?: boolean;
     /** Why a capture returned no verdict. */
-    invalidCause?: "ceiling-kill" | "resource-exhaustion";
+    invalidCause?: "ceiling-kill" | "resource-exhaustion" | "infra";
+    /** The runner's summary was green and only its teardown fingerprint followed. */
+    teardownFingerprint?: true;
     /** What this command actually took at capture, on a pristine tree. Absent in pre-v1.90 baselines. */
     durationMs?: number;
     /** Sum of the per-file durations named by the runner; null when its output names none. */
@@ -154,4 +156,26 @@ export declare function detectVacuousOracles(cwd: string, tasks: ReadonlyArray<{
     id: string;
     acceptance: AcceptanceItem[];
 }>): Promise<VacuousOracleWarning[]>;
-export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[]): Promise<GateResult[]>;
+export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[], opts?: {
+    rerunOf?: HostStarvedRerun;
+}): Promise<GateResult[]>;
+export interface HostStarvedRerun {
+    durationMs: number;
+    referenceMs: number;
+    waitedMs: number;
+}
+export type RunnerVerdict = FailureClassification | "green-teardown" | undefined;
+/** One interpretation of runner bytes, shared by baseline capture and every gate consumer. */
+export declare function classifyRunnerOutput(raw: string, code: number): RunnerVerdict;
+export declare const HOST_STARVED_DURATION_FACTOR = 2;
+/** Every fresh failure head is timeout-class and the suite took twice its own baseline measurement. */
+export declare function hostStarved(fresh: string, durationMs: number, referenceMs: number | undefined): boolean;
+interface CalmWindow {
+    pollMs: number;
+    maxWaitMs: number;
+    loadProvider: () => number;
+    calmLoad: () => number;
+}
+export declare function setCalmWindowForTests(over: Partial<CalmWindow>): void;
+export declare function resetCalmWindowForTests(): void;
+export {};

package/dist/gates/baseline.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
+import { availableParallelism, loadavg } from "node:os";
 import { join } from "node:path";
 import { DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 // incident #2 (run-20260709-104447): a vitest ✓ PASS line with "error" in the test NAME, wrapped in ANSI
@@ -501,11 +502,20 @@ export async function captureBaseline(cwd, commands) {
             base.commands[name] = invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines);
             continue;
         }
+        // OBS-885/887: capture and gate ask the same classifier. A green summary followed only by the
+        // teardown fingerprint is a pass; infrastructure without a summary is no verdict to forgive.
+        const runnerVerdict = classifyRunnerOutput(raw, r.code);
+        if (runnerVerdict === "infra") {
+            console.error(`tickmarkr: baseline capture for "${name}" carries runner-infrastructure evidence and no green summary — it recorded NO verdict; nothing is forgiven for this command`);
+            base.commands[name] = invalidCaptureEntry(durationMs, "infra");
+            continue;
+        }
         base.commands[name] = {
-            exitCode: r.code,
+            exitCode: runnerVerdict === "green-teardown" ? 0 : r.code,
+            ...(runnerVerdict === "green-teardown" ? { teardownFingerprint: true } : {}),
             // a command that exits 0 has no failures to fingerprint — recording any would be a lie the
             // compare step then has to forgive
-            fingerprints: r.code === 0 ? [] : fingerprint(raw),
+            fingerprints: r.code === 0 || runnerVerdict === "green-teardown" ? [] : fingerprint(raw),
             missingCommand: missingConfiguredCommand(cmd, r),
             durationMs,
             ...fileTiming(raw, durationMs),
@@ -570,8 +580,9 @@ function headlineDetails(raw, fresh) {
         meta: { failingTests: headlines.filter(namesFailureEitherForm) },
     };
 }
-export async function compareToBaseline(cwd, commands, baseline, enabled) {
+export async function compareToBaseline(cwd, commands, baseline, enabled, opts = {}) {
     const results = [];
+    const rerunOf = opts.rerunOf;
     for (const name of enabled) {
         const cmd = commands[name];
         if (!cmd) {
@@ -595,7 +606,13 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // states no capacity — a row that never divided the machine must not claim that it did.
         const record = (g) => {
             const withReap = r.reapedGroup ? { ...g, meta: { ...g.meta, reapedGroup: true } } : g;
-            results.push(r.capacity ? { ...withReap, capacity: r.capacity } : withReap);
+            const withReapError = r.reapError ? { ...withReap, meta: { ...withReap.meta, reapError: r.reapError } } : withReap;
+            const withRerun = rerunOf ? {
+                ...withReapError,
+                details: `host-starved rerun after waiting ${rerunOf.waitedMs}ms for a calm load window: ${withReapError.details}`,
+                meta: { ...withReapError.meta, hostStarvedRerun: rerunOf },
+            } : withReapError;
+            results.push(r.capacity ? { ...withRerun, capacity: r.capacity } : withRerun);
         };
         // …and whether the entry that would forgive this command was measured in the same world. A
         // baseline captured under a different fork cap forgives nothing: its fingerprints describe a
@@ -629,6 +646,12 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
             continue;
         }
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
+        // OBS-885/887: the same classifier the capture applied names a completed green suite on both sides.
+        const runnerVerdict = classifyRunnerOutput(raw, r.code);
+        if (runnerVerdict === "green-teardown") {
+            record({ gate: name, pass: true, details: `exit ${r.code} after a green suite summary; only the runner's teardown fingerprint followed it`, meta: { teardownFingerprint: true } });
+            continue;
+        }
         // OBS-278: only a failure SHAPE is a verdict — everything fingerprint() keeps is one, except the
         // unrecognized-output marker, which is evidence for the operator and never grounds to reject.
         // ponytail: ceiling — a runner whose failure output holds no shape above and whose baseline is
@@ -640,10 +663,20 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // T9: classify the FRESH diff before charging it. The complete runner output can legitimately
         // contain a baseline-recorded assertion beside a newly introduced infrastructure death; letting
         // that known assertion outvote the fresh birpc line turns machine failure into a worker defect.
-        // `classifyFailureOutput` remains the single discriminator. When there is no fresh fingerprint,
+        // `classifyRunnerOutput` remains the single discriminator. When there is no fresh fingerprint,
         // retain the whole-output read so a repeated infra abort can never be baseline-forgiven as green.
-        const freshClassification = failing.length ? classifyFailureOutput(failing.join("\n")) : undefined;
-        const classification = freshClassification ?? (!failing.length ? classifyFailureOutput(raw) : undefined);
+        const freshVerdict = failing.length ? classifyRunnerOutput(failing.join("\n"), r.code) : undefined;
+        const freshClassification = freshVerdict === "infra" || freshVerdict === "regression" ? freshVerdict : undefined;
+        const classification = freshClassification ?? (!failing.length && (runnerVerdict === "infra" || runnerVerdict === "regression") ? runnerVerdict : undefined);
+        // OBS-896: every fresh failure must be timeout-class, and the suite must take at least twice its
+        // own baseline measurement. The first read buys one calm rerun here, never a worker repair.
+        if (name === "test" && classification !== "infra" && failing.length && !rerunOf
+            && hostStarved(failing.join("\n"), r.durationMs ?? 0, entry?.durationMs)) {
+            const waitedMs = await waitForCalmWindow();
+            const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
+            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { rerunOf: provenance }));
+            continue;
+        }
         if (classification === "infra") {
             const evidence = failing.length
                 ? failing.slice(0, 10).join("\n")
@@ -708,3 +741,53 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
     }
     return results;
 }
+const SUMMARY_LINE_RE = /^[^\S\n]*Test Files[^\S\n]+(.+)$/m;
+const TEARDOWN_RE = /\[vitest-worker\]: Timeout calling\b|\[birpc\] rpc is closed, cannot call\b/;
+const UNHANDLED_HEADER_RE = /^\s*[^\w]*(?:Unhandled Errors|Uncaught Exception)\b/;
+/** One interpretation of runner bytes, shared by baseline capture and every gate consumer. */
+export function classifyRunnerOutput(raw, code) {
+    if (code === 0)
+        return undefined;
+    const lines = withoutVitestEchoBlocks(raw).map((l) => l.replace(ANSI_RE, ""));
+    const text = lines.join("\n");
+    const summary = SUMMARY_LINE_RE.exec(text);
+    if (summary) {
+        const failed = [...summary[1].matchAll(/\b(\d+)\s+failed\b/g)].map((match) => Number(match[1]));
+        const summaryGreen = failed.every((count) => count === 0);
+        const summaryLine = text.slice(0, summary.index).split("\n").length - 1;
+        const teardownLine = lines.findIndex((line, index) => index > summaryLine && TEARDOWN_RE.test(line));
+        const otherFailure = lines.some((line, index) => {
+            if (index === summaryLine || TEARDOWN_RE.test(line))
+                return false;
+            if (PASS_LINE_RE.test(line) || OPERATOR_LINE_RE.test(line))
+                return false;
+            if (index > summaryLine && UNHANDLED_HEADER_RE.test(line))
+                return false;
+            return namesRegression(line);
+        });
+        if (summaryGreen && teardownLine > summaryLine && !otherFailure)
+            return "green-teardown";
+    }
+    return classifyFailureOutput(text);
+}
+const TIMEOUT_CLASS_RE = /\b(?:Test|Hook) timed out in (?:\d+|#) ?ms\b|\bexceeded (?:\d+|#) ?(?:ms|s|seconds)\b|\btimed out after (?:\d+|#)/i;
+const ERROR_HEAD_RE = /^\s*(?:[A-Za-z][A-Za-z0-9]*Error|Error):\s/;
+export const HOST_STARVED_DURATION_FACTOR = 2;
+/** Every fresh failure head is timeout-class and the suite took twice its own baseline measurement. */
+export function hostStarved(fresh, durationMs, referenceMs) {
+    if (!referenceMs || durationMs < HOST_STARVED_DURATION_FACTOR * referenceMs)
+        return false;
+    const heads = fresh.split("\n").map((line) => line.replace(ANSI_RE, "")).filter((line) => ERROR_HEAD_RE.test(line));
+    return heads.length > 0 && heads.every((line) => TIMEOUT_CLASS_RE.test(line));
+}
+const DEFAULT_CALM = { pollMs: 5_000, maxWaitMs: 600_000, loadProvider: () => loadavg()[0] ?? 0, calmLoad: () => availableParallelism() / 2 };
+let calm = DEFAULT_CALM;
+export function setCalmWindowForTests(over) { calm = { ...calm, ...over }; }
+export function resetCalmWindowForTests() { calm = DEFAULT_CALM; }
+async function waitForCalmWindow() {
+    const started = Date.now();
+    while (calm.loadProvider() > calm.calmLoad() && Date.now() - started < calm.maxWaitMs) {
+        await new Promise((resolve) => setTimeout(resolve, calm.pollMs));
+    }
+    return Date.now() - started;
+}

package/dist/gates/review.d.ts

@@ -1,6 +1,7 @@
 import { type Assignment, type BillingChannel, type WorkerAdapter } from "../adapters/types.js";
 import { type TickmarkrConfig, type Tier } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
+import { modelProvider } from "../route/preference.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
 import { type VerdictUnparseableCause } from "./verdict-cause.js";
@@ -48,8 +49,7 @@ export declare function checkTaskDiffCaps(gate: string, measured: Pick<TaskDiffM
 export declare function isDiffCapPark(result: GateResult): boolean;
 export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
-/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
-export declare function modelProvider(model: string, fallback?: string): string;
+export { modelProvider };
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor?: Tier, // task-declared only; config floors govern workers and must not silently move review seats

package/dist/gates/review.js

@@ -8,6 +8,7 @@ import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { redactSecrets } from "../run/redact.js";
 import { marginalCostRank } from "../route/router.js";
+import { modelProvider } from "../route/preference.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlmDetailed, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
 import { captureDiffCapFor, measureArtifactDiff, reviewableLogicDiff, } from "./artifact-manifest.js";
@@ -165,24 +166,7 @@ export function diffCapParkReason(results) {
 export function modelId(model) {
     return model.slice(model.lastIndexOf("/") + 1);
 }
-/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
-export function modelProvider(model, fallback = "unknown") {
-    const id = model.toLowerCase();
-    const prefix = id.includes("/") ? id.slice(0, id.indexOf("/")) : "";
-    if (prefix === "openai" || prefix === "openai-codex" || /^(?:gpt|o\d)/.test(id))
-        return "openai";
-    if (prefix === "anthropic" || /^(?:claude|opus|sonnet|haiku|fable)(?:-|$)/.test(id))
-        return "anthropic";
-    if (prefix === "google" || /^gemini(?:-|$)/.test(id))
-        return "google";
-    if (prefix === "xai" || /^grok(?:-|$)/.test(id))
-        return "xai";
-    if (["zai", "zhipu", "zai-coding-plan"].includes(prefix) || /^glm(?:-|$)/.test(id))
-        return "zhipu";
-    if (["kimi-code", "moonshot"].includes(prefix) || /^kimi(?:-|$)/.test(id))
-        return "moonshot";
-    return fallback;
-}
+export { modelProvider };
 // v1.53 T2: same entry grammar as routing.map.prefer (router.ts preferIndex — router is out of this
 // module's dependency direction for a private fn, so the 3 lines live here too): `adapter` matches
 // every channel of that adapter, `adapter:model` exactly one; unmatched channels sort after all entries.

package/dist/graph/graph.d.ts

@@ -1,6 +1,26 @@
 import { type RunGraph, type Task, type TaskStatus } from "./schema.js";
 export declare function stateDirName(_repoRoot: string): string;
 export declare function graphPath(repoRoot: string): string;
+export interface CompileRefusalRecord {
+    refusedAt: string;
+    source: string;
+    error: string;
+}
+export declare function compileRefusalPath(repoRoot: string): string;
+export declare function readCompileRefusal(repoRoot: string): CompileRefusalRecord | undefined;
+export declare function saveCompileRefusal(repoRoot: string, record: CompileRefusalRecord): void;
+export declare function clearCompileRefusal(repoRoot: string): void;
+export interface OnDiskSpecHash {
+    path: string;
+    hash: string;
+}
+/**
+ * Re-hash the exact single source file recorded by CLI compiles. Native and PRD record the source
+ * markdown; Spec Kit records its tasks.md. GSD combines several plan bodies and is deliberately not
+ * reconstructed here. A missing file is the one fail-open case: the refusal record is the fail-closed
+ * evidence for failed recompiles, while moved/deleted source files need not strand a compiled graph.
+ */
+export declare function onDiskSpecHash(_repoRoot: string, graph: RunGraph): OnDiskSpecHash | undefined;
 export declare function graphDefinitionHash(g: RunGraph): string;
 export declare function taskContentDigest(task: Pick<Task, "goal" | "files" | "acceptance">): string;
 export declare function tickmarkrDir(repoRoot: string): string;

package/dist/graph/graph.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { validateGraph } from "./schema.js";
 export function stateDirName(_repoRoot) {
     return ".tickmarkr";
@@ -8,6 +8,71 @@ export function stateDirName(_repoRoot) {
 export function graphPath(repoRoot) {
     return join(repoRoot, stateDirName(repoRoot), "graph.json");
 }
+export function compileRefusalPath(repoRoot) {
+    return join(repoRoot, stateDirName(repoRoot), "compile-refusal.json");
+}
+export function readCompileRefusal(repoRoot) {
+    const path = compileRefusalPath(repoRoot);
+    if (!existsSync(path))
+        return undefined;
+    let value;
+    try {
+        value = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`compile refusal record at ${path} is unreadable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (typeof value !== "object" || value === null
+        || typeof value.refusedAt !== "string"
+        || typeof value.source !== "string"
+        || typeof value.error !== "string") {
+        throw new Error(`compile refusal record at ${path} is malformed`);
+    }
+    return value;
+}
+export function saveCompileRefusal(repoRoot, record) {
+    tickmarkrDir(repoRoot);
+    const path = compileRefusalPath(repoRoot);
+    const tmp = `${path}.${process.pid}.tmp`;
+    try {
+        writeFileSync(tmp, JSON.stringify(record, null, 2) + "\n");
+        renameSync(tmp, path);
+    }
+    catch (error) {
+        rmSync(tmp, { force: true });
+        throw error;
+    }
+}
+export function clearCompileRefusal(repoRoot) {
+    rmSync(compileRefusalPath(repoRoot), { force: true });
+}
+/**
+ * Re-hash the exact single source file recorded by CLI compiles. Native and PRD record the source
+ * markdown; Spec Kit records its tasks.md. GSD combines several plan bodies and is deliberately not
+ * reconstructed here. A missing file is the one fail-open case: the refusal record is the fail-closed
+ * evidence for failed recompiles, while moved/deleted source files need not strand a compiled graph.
+ */
+export function onDiskSpecHash(_repoRoot, graph) {
+    if (graph.spec.source === "gsd")
+        return undefined;
+    if (graph.spec.paths.length !== 1)
+        return undefined;
+    const recorded = graph.spec.paths[0];
+    // CLI compilation records an absolute source. Relative paths belong to legacy/programmatic
+    // graphs whose resolution context is unknowable here, so preserve their prior fail-open behavior.
+    if (!isAbsolute(recorded))
+        return undefined;
+    const path = recorded;
+    try {
+        const content = readFileSync(path);
+        return { path, hash: createHash("sha256").update(content).digest("hex") };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new Error(`cannot verify compiled spec hash from ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 // T3 (Sol #2 / Fable F2): ONE canonical engagement identity over COMPILED TASK DEFINITIONS only.
 // status/evidence are runtime-mutated (the daemon flips status, accumulates evidence every attempt) so
 // they are excluded — the identity survives a status flip or evidence growth but changes the instant a

package/dist/route/preference.d.ts

@@ -5,7 +5,9 @@ export interface Disallowed {
     entry: string;
 }
 export type PreferenceRole = "worker" | "judge" | "review" | "consult";
-export declare function routingModelProvider(model: string, fallback?: string): string;
+/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
+export declare function modelProvider(model: string, fallback?: string): string;
+export declare const routingModelProvider: typeof modelProvider;
 export declare const modelRouteIdentity: (model: string, fallback?: string) => string;
 export declare const channelRouteIdentity: (key: string, fallback?: string) => string;
 export declare function routingEntrySeatLines(cfg: TickmarkrConfig): string[];

package/dist/route/preference.js

@@ -2,10 +2,8 @@ import { channelKey, channelsFromConfig } from "../adapters/types.js";
 import { validateGraph } from "../graph/schema.js";
 import { route, RoutingError } from "./router.js";
 const PREFERENCE_ROLES = ["worker", "judge", "review", "consult"];
-// Keep routing retries on the same identity review diversity uses: the served provider plus the
-// unprefixed model id. Gate review owns the original modelProvider policy; this dependency-leaf copy
-// avoids importing gates back into route/run and must move with that helper when the scope permits.
-export function routingModelProvider(model, fallback = "unknown") {
+/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
+export function modelProvider(model, fallback = "unknown") {
     const id = model.toLowerCase();
     const prefix = id.includes("/") ? id.slice(0, id.indexOf("/")) : "";
     if (prefix === "openai" || prefix === "openai-codex" || /^(?:gpt|o\d)/.test(id))
@@ -22,6 +20,8 @@ export function routingModelProvider(model, fallback = "unknown") {
         return "moonshot";
     return fallback;
 }
+// Router naming remains explicit while sharing the review gate's exact function object.
+export const routingModelProvider = modelProvider;
 export const modelRouteIdentity = (model, fallback = "unknown") => `${routingModelProvider(model, fallback)}/${model.slice(model.lastIndexOf("/") + 1).toLowerCase()}`;
 export const channelRouteIdentity = (key, fallback = "unknown") => {
     const i = key.indexOf(":");

package/dist/run/consult.js

@@ -63,6 +63,7 @@ function excludedProviderFromDossier(d, adapter) {
     try {
         const events = JSON.parse(d.journalTail);
         const assignment = [...events].reverse().find((event) => event.event === "task-dispatch"
+            && event.taskId === d.taskId
             && event.data?.assignment?.adapter === adapter
             && typeof event.data.assignment.model === "string")?.data?.assignment;
         if (typeof assignment?.model !== "string")

package/dist/run/daemon.d.ts

@@ -117,6 +117,11 @@ export declare const WORKER_NUDGE_MESSAGE = "tickmarkr liveness check: if the ta
 /** Test seam — shrink the nudge gate and grace without minute-long sleeps. */
 export declare function setNudgeTimingForTests(silentMs: number, graceMs: number): void;
 export declare function resetNudgeTimingForTests(): void;
+export declare const WORKER_STARTUP_WINDOW_MS = 60000;
+export declare const WORKER_STARTUP_WINDOW_BYTES: number;
+/** Test seam — exercises both sides of the startup boundary without a production-length fixture. */
+export declare function setWorkerStartupWindowMsForTests(ms: number): void;
+export declare function resetWorkerStartupWindowMsForTests(): void;
 /** Test seam — shrink the quota-banner silence gate without minute-long sleeps. */
 export declare function setQuotaBannerSilentMsForTests(ms: number): void;
 export declare function resetQuotaBannerSilentMsForTests(): void;