tickmarkr 2.4.2 → 2.5.0

package/dist/drivers/herdr.d.ts

@@ -1,5 +1,5 @@
 import { type JournalEvent } from "../run/journal.js";
-import { type ExecutorDriver, type NotifyOpts, type PanesToCloseOpts, type Slot, type SlotOpts } from "./types.js";
+import { type ExecutorDriver, type FocusTarget, type FocusResult, type NotifyOpts, type PanesToCloseOpts, type Slot, type SlotOpts } from "./types.js";
 export declare const TRAILER_SAFE_FLOOR_COLS = 108;
 export declare const TRAILER_WIDTH_MARGIN = 2;
 export declare const DELIVERY_ATTEMPTS = 3;
@@ -69,6 +69,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     private ws;
     private callerPane;
     private watches;
+    private watchTokens;
     constructor(bin?: string, workersPerTab?: number, time?: HerdrTimeSource, journal?: DriverJournal | undefined);
     private appendDispatchRetry;
     private appendPaneClose;
@@ -126,9 +127,13 @@ export declare class HerdrDriver implements ExecutorDriver {
     notify(msg: string, opts?: NotifyOpts): Promise<void>;
     close(slot: Slot): Promise<void>;
     private closeGrouped;
-    private ownedWatchPanes;
+    private watchPanes;
+    /** Name collisions never confer repository ownership. Unknown boards stay protected. */
+    private retireWatch;
+    focus(target: FocusTarget): Promise<FocusResult>;
     private watchSlot;
     private discardSplit;
+    /** Only this repository's matching run may replace its acknowledged board. */
     narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
     reconcile(desired: Set<string>, runId: string, opts?: PanesToCloseOpts): Promise<void>;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;

package/dist/drivers/herdr.js

@@ -6,7 +6,7 @@ import { declaredInputBoxForWorkerName, matchesEmptyInputBox, matchesInputBox, m
 import { consumePaneLaunchIntent, PANE_IDENTITY_ENV, paneIdentityLine } from "../brand.js";
 import { createWorktree, sh } from "../run/git.js";
 import { Journal } from "../run/journal.js";
-import { readSupervision } from "../run/supervision.js";
+import { readSupervision, readWatchBoard, reserveWatchBoard, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
 import { herdrSealShellPrefix } from "./subprocess.js";
 import { canonicalizeLegacyName, formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 // VIS-09 P43-03: adopted safety floor from 43-MEASUREMENT.md (narrowest safe 53 → floor 108).
@@ -103,6 +103,7 @@ export function boardSplitPlan(_callerCols) {
  *  `role:"other", taskId:"<the whole name>"` for any unrecognised string, so keying on taskId alone
  *  makes EVERY one-off pane its own "task" and gives it a group tab. `watch` is excluded for the same
  *  reason in the other direction — its taskId is the literal "run", which is a board, not a task. */
+const shortTitle = (text) => [...text].slice(0, 20).join("");
 const TASK_TAB_ROLES = new Set(["worker", "judge", "review", "consult"]);
 export function taskGroupOf(name) {
     const { role, taskId } = canonicalizeLegacyName(name, "");
@@ -123,10 +124,10 @@ export function taskGroupOf(name) {
 export function tabLabelFor(name) {
     const { role, taskId, attempt } = canonicalizeLegacyName(name, "");
     if (!TASK_TAB_ROLES.has(role) || !taskId.trim())
-        return name;
+        return shortTitle(name);
     if (role !== "worker")
-        return `${role.toUpperCase()} ${taskId}`;
-    return attempt > 0 ? `${taskId}↻${attempt}` : taskId;
+        return shortTitle(`${role.toUpperCase()} ${taskId}`);
+    return shortTitle(attempt > 0 ? `${taskId}↻${attempt}` : taskId);
 }
 /** Gate panes ride with the task they belong to and never consume the tab cap; everything else does.
  *  Scoped to the three GATE roles deliberately — an earlier cut of this said "not a worker", which let
@@ -168,6 +169,7 @@ export class HerdrDriver {
     ws = process.env.HERDR_WORKSPACE_ID;
     callerPane = process.env.HERDR_PANE_ID;
     watches = new Map();
+    watchTokens = new WeakMap();
     constructor(bin = "herdr", workersPerTab = 3, time = SYSTEM_TIME, journal) {
         this.bin = bin;
         this.workersPerTab = workersPerTab;
@@ -469,7 +471,7 @@ export class HerdrDriver {
         // the worktree — that root pane IS the worker pane. The old one-shot `agent start … -- bash` verb
         // (which named a fresh bash pane) was removed; 0.7.5's `agent start` only ATTACHES to a DETECTED
         // agent CLI, so tickmarkr names the bash pane itself via `pane rename` and types the worker command in.
-        const t = await this.herdr(`tab create --label ${shq(label)} --no-focus --workspace ${shq(this.ws)} --cwd ${shq(cwd)}`);
+        const t = await this.herdr(`tab create --label ${shq(shortTitle(label))} --no-focus --workspace ${shq(this.ws)} --cwd ${shq(cwd)}`);
         if (t.code !== 0)
             throw new Error(`herdr tab create failed (exit ${t.code}, refusing untargeted placement): ${t.stderr || t.stdout}`);
         let res;
@@ -597,7 +599,7 @@ export class HerdrDriver {
         const label = !token ? entry.label
             : entry.label === token ? `${token}${glyph}`
                 : `${entry.label} · ${token}${glyph}`;
-        const cmd = `tab rename ${shq(entry.tabId)} ${shq(label)}`;
+        const cmd = `tab rename ${shq(entry.tabId)} ${shq(shortTitle(label))}`;
         const ok = async () => (await this.herdr(cmd)).code === 0;
         if (await ok() || await ok())
             return;
@@ -1113,12 +1115,10 @@ export class HerdrDriver {
         await this.herdr(`notification show ${shq(msg)} --sound ${opts?.tier === "attention" ? "request" : opts?.sound ?? "request"}`);
     }
     async close(slot) {
-        if (this.watches.get(slot.name)?.id === slot.id) {
+        if (parseOwnedName(slot.name)?.role === "watch") {
+            await this.retireWatch(slot);
             this.watches.delete(slot.name);
-            const pane = await this.namedPaneId(slot.name);
-            if (pane)
-                await this.herdr(`pane close ${shq(pane)}`);
-            return; // run-end reconcile may already have reaped it; never close a compacted stale id
+            return;
         }
         if (slot.group && this.groups.has(slot.group)) {
             return this.serial(() => this.closeGrouped(slot));
@@ -1158,29 +1158,63 @@ export class HerdrDriver {
                 this.groups.delete(slot.group); // group dies when all generations gone
         }
     }
-    // Every surviving tickmarkr-owned board in this workspace — a PRIOR run's and one already wearing
-    // this run's own name alike. Both are retired before a new board opens (narrator): what a pane this
-    // process did not create is actually RUNNING cannot be read back, and the pre-v1.94 implementation
-    // launched a bare `tickmarkr status --watch`, which follows the newest journal.
-    async ownedWatchPanes() {
+    async watchPanes(name) {
         if (!this.ws)
             throw new Error("herdr watch placement requires HERDR_WORKSPACE_ID — refusing unseeded pane");
         const list = await this.herdr("pane list");
         if (list.code !== 0)
             throw new Error(`herdr pane list failed: ${list.stderr || list.stdout}`);
+        const panes = JSON.parse(list.stdout).result?.panes;
+        if (!Array.isArray(panes))
+            throw new Error("herdr pane list returned no panes");
+        return panes.filter(p => p.workspace_id === this.ws && p.label === name);
+    }
+    /** Name collisions never confer repository ownership. Unknown boards stay protected. */
+    async retireWatch(slot) {
+        const runId = parseOwnedName(slot.name)?.runId;
+        const owner = runId ? readWatchBoard(slot.cwd, runId) : undefined;
+        const matches = await this.watchPanes(slot.name);
+        if (matches.length === 0)
+            throw new Error(`watch ${slot.name} closed without presence acknowledgement; cleanup unconfirmed`);
+        if (!owner || owner.driver !== this.id || owner.name !== slot.name || owner.workspace !== this.ws ||
+            (this.watchTokens.has(slot) && this.watchTokens.get(slot) !== owner.token) ||
+            owner.pane !== slot.id || matches.length !== 1 || matches[0]?.pane_id !== owner.pane) {
+            throw new Error(`watch ownership unknown or foreign for ${slot.name}; existing board protected`);
+        }
+        await stopWatchBoard(owner, this.time);
+        const verified = await this.watchPanes(slot.name);
+        if (verified.length !== 1 || verified[0]?.pane_id !== owner.pane)
+            throw new Error("watch target changed after acknowledgement; pane protected");
+        const closed = await this.herdr(`pane close ${shq(owner.pane)}`);
+        if (closed.code !== 0 || await this.paneStillOpen(owner.pane))
+            throw new Error(`watch ${slot.name} survived acknowledged close`);
+    }
+    async focus(target) {
+        const { slot, runId, taskId, attempt } = target;
+        if (slot.name !== formatOwnedName({ role: "worker", taskId, attempt, runId }) || !target.workspace || target.workspace !== this.ws) {
+            return { status: "foreign", reason: "Recorded run/task/attempt or workspace does not match this driver" };
+        }
+        const r = await this.herdr("pane list", slot.cwd);
+        if (r.code !== 0)
+            return { status: "unsupported", reason: "Cannot verify the live pane list" };
         let panes;
         try {
-            panes = JSON.parse(list.stdout).result?.panes;
+            panes = JSON.parse(r.stdout).result?.panes;
         }
         catch {
-            throw new Error(`herdr pane list returned unparseable JSON: ${list.stdout}`);
+            return { status: "unsupported", reason: "Unreadable pane list" };
         }
         if (!Array.isArray(panes))
-            throw new Error(`herdr pane list returned no panes: ${list.stdout}`);
-        return panes.filter((p) => {
-            const owned = typeof p.label === "string" ? parseOwnedName(p.label) : null;
-            return p.workspace_id === this.ws && typeof p.pane_id === "string" && owned?.role === "watch" && owned.taskId === "run";
-        }).map((p) => p.pane_id);
+            return { status: "unsupported", reason: "Missing pane list" };
+        const named = panes.filter(p => p.label === slot.name && p.workspace_id === target.workspace);
+        if (!named.length)
+            return { status: panes.some(p => p.pane_id === slot.id) ? "foreign" : "closed", reason: "Recorded pane is no longer owned by this attempt; open task evidence" };
+        if (named.length !== 1 || named[0]?.pane_id !== slot.id || (slot.tabId && named[0]?.tab_id !== slot.tabId)) {
+            return { status: "foreign", reason: "Live pane identity differs from the recorded task attempt" };
+        }
+        const focused = await this.herdr(`pane focus ${shq(slot.id)}`, slot.cwd);
+        return focused.code === 0 ? { status: "focused", reason: `Verified ${slot.name} in ${target.workspace}` }
+            : { status: "unsupported", reason: focused.stderr || focused.stdout || "Host refused pane focus" };
     }
     // T2: the watch is a sibling of the daemon's own pane, never a separate tab — placed to the RIGHT
     // of it, always, whatever the terminal measures. Its durable owned name is how a
@@ -1243,38 +1277,34 @@ export class HerdrDriver {
         }
         throw new Error(orphan === null ? why : `${why} — and the split pane ${pane} survived its close (${orphan})`);
     }
-    // T6 narrator: the run's single live status surface, RUNNING THE COMMAND THIS CALL SUPPLIED. Only
-    // a board this driver instance itself opened is reused (this.watches); any other surviving board —
-    // a prior run's, or one already carrying this run's canonical name after a resume — is retired and
-    // re-split, because adoption cannot restart or even read the process inside it and a pre-v1.94 pane
-    // is running the bare `tickmarkr status --watch`, which narrates the newest journal instead of this
-    // run. The retirement is VERIFIED gone before the replacement splits: reconcile is no backstop here
-    // (panesToClose skips role "watch" by design, types.ts:92), so an unverified close would leave two
-    // boards bound to different runs. Failures propagate — the daemon swallows.
+    /** Only this repository's matching run may replace its acknowledged board. */
     async narrator(cwd, command, runId) {
-        const name = runId ? formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId }) : `narrator-watch-${process.pid}`;
+        if (!this.ws)
+            throw new Error("herdr watch placement requires HERDR_WORKSPACE_ID");
+        if (!runId)
+            throw new Error("herdr narrator requires a run identity");
+        const name = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
         return this.serial(async () => {
+            const matches = await this.watchPanes(name);
             const cached = this.watches.get(name);
-            if (cached)
+            if (cached && matches.length === 1 && matches[0]?.pane_id === cached.id &&
+                readWatchBoard(cwd, runId)?.token === this.watchTokens.get(cached))
                 return cached;
-            const stale = await this.ownedWatchPanes();
-            for (const pane of stale)
-                await this.herdr(`pane close ${shq(pane)}`);
-            if (stale.length) {
-                const survived = (await this.ownedWatchPanes()).filter((p) => stale.includes(p));
-                if (survived.length)
-                    throw new Error(`herdr watch retire failed: ${survived.join(", ")} survived close — refusing a second board`);
-            }
-            const s = await this.watchSlot(cwd, name);
-            this.watches.set(name, s);
+            if (matches.length > 1)
+                throw new Error(`watch ownership ambiguous for ${name}; existing boards protected`);
+            if (matches.length === 1)
+                await this.retireWatch({ id: matches[0].pane_id, name, cwd });
+            const slot = await this.watchSlot(cwd, name);
+            const owner = reserveWatchBoard({ repo: cwd, runId, driver: this.id, workspace: this.ws, pane: slot.id, name });
+            this.watchTokens.set(slot, owner.token);
             try {
-                await this.deliverPersistentShellCommand(s, command);
+                await this.deliverPersistentShellCommand(slot, `${WATCH_OWNER_ENV}=${shq(owner.token)} ${command}`);
+                this.watches.set(name, slot);
+                return slot;
             }
-            catch (err) {
-                this.watches.delete(name);
-                throw err;
+            catch (error) {
+                throw new Error(`watch launch unconfirmed for ${name}; pane protected: ${String(error)}`);
             }
-            return s;
         });
     }
     // OBS-17 T2 / v1.22b T1: close THIS RUN'S OWN tickmarkr-owned panes that should not exist

package/dist/drivers/orca.d.ts

@@ -1,6 +1,6 @@
 import { type ShResult } from "../run/git.js";
 import { type JournalEvent } from "../run/journal.js";
-import { type ExecutorDriver, type NotifyOpts, type Slot, type SlotOpts } from "./types.js";
+import { type ExecutorDriver, type FocusTarget, type FocusResult, type NotifyOpts, type Slot, type SlotOpts } from "./types.js";
 /** The response families the ONE shared envelope parser serves. There is no second JSON seam. */
 export declare const ORCA_RESPONSE_FAMILIES: readonly ["status", "create", "list", "read", "send", "wait", "show", "close", "worktree-current", "worktree-set", "hooks-status"];
 export type OrcaFamily = (typeof ORCA_RESPONSE_FAMILIES)[number];
@@ -200,7 +200,8 @@ export declare class OrcaDriver implements ExecutorDriver {
     waitAgentStatus(slot: Slot, status: string, timeoutMs: number): Promise<boolean>;
     sendKey(slot: Slot, key: string): Promise<void>;
     nudge(slot: Slot, message: string): Promise<boolean>;
-    narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
+    narrator(_cwd: string, _command: string, runId?: string): Promise<Slot>;
+    focus(target: FocusTarget): Promise<FocusResult>;
     project(taskId: string, state: "in-progress" | "in-review" | "completed"): Promise<void>;
     private setWorkspaceStatus;
     notify(msg: string, opts?: NotifyOpts): Promise<void>;

package/dist/drivers/orca.js

@@ -997,12 +997,51 @@ export class OrcaDriver {
             return false;
         }
     }
-    async narrator(cwd, command, runId) {
+    async narrator(_cwd, _command, runId) {
         if (!runId)
             throw new OrcaError("create", "Orca narrator requires a run identity", "");
-        const slot = await this.slot(cwd, formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId }), { owned: { role: "watch", taskId: "run", attempt: 0, runId } });
-        await this.run(slot, command);
-        return slot;
+        // The recorded Orca API can create a tab but provides no right/no-focus
+        // placement receipt. Creating one would advertise a board we did not place.
+        throw new OrcaError("create", "Orca narrator placement unsupported: right/no-focus board placement is not available", "");
+    }
+    async focus(target) {
+        const { slot, runId, taskId, attempt } = target;
+        const cwd = canonicalWorktreePath(slot.cwd);
+        if (slot.name !== formatOwnedName({ role: "worker", taskId, attempt, runId })) {
+            return { status: "foreign", reason: "Recorded run/task/attempt ownership does not match" };
+        }
+        try {
+            const env = await this.listAll(cwd);
+            const rows = env.result.terminals;
+            const layouts = env.result.visualLayouts;
+            if (!Array.isArray(rows) || !Array.isArray(layouts))
+                return { status: "unsupported", reason: "Cannot verify Orca terminal ownership" };
+            const handles = [];
+            for (const layout of layouts) {
+                if (typeof layout !== "object" || layout === null)
+                    continue;
+                const lo = layout;
+                if (!sameWorktree(terminalWorktree(lo), cwd))
+                    continue;
+                const tabs = [];
+                collectTabs(lo.root, tabs);
+                for (const tab of tabs) {
+                    if (typeof tab === "object" && tab !== null && str(tab.title) === slot.name)
+                        collectPaneHandles(tab.panes, handles);
+                }
+            }
+            if (handles.length !== 1)
+                return { status: rows.length ? "foreign" : "closed", reason: "No unique owned terminal in the recorded worktree" };
+            const matches = rows.filter(row => typeof row === "object" && row !== null && str(row.handle) === handles[0] && sameWorktree(terminalWorktree(row), cwd));
+            if (matches.length !== 1)
+                return { status: "foreign", reason: "Terminal worktree ownership is unverified" };
+            if (matches[0].connected === false || matches[0].orphaned === true)
+                return { status: "closed", reason: "Recorded terminal is no longer running; open task evidence" };
+            return { status: "unsupported", reason: "Owned terminal verified; this Orca API has no focus operation. Open task evidence with Enter" };
+        }
+        catch (error) {
+            return { status: "unsupported", reason: `Cannot verify Orca focus target: ${String(error)}` };
+        }
     }
     async project(taskId, state) {
         const worktree = this.taskWorktrees.get(taskId);

package/dist/drivers/subprocess.d.ts

@@ -24,6 +24,7 @@ export declare class SubprocessDriver implements ExecutorDriver {
     waitAgentStatus(slot: Slot, status: string, timeoutMs: number): Promise<boolean>;
     status(_slot: Slot): Promise<string>;
     read(slot: Slot, lines: number): Promise<string>;
+    focus(): Promise<import("./types.js").FocusResult>;
     notify(msg: string, _opts?: NotifyOpts): Promise<void>;
     close(slot: Slot): Promise<void>;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;

package/dist/drivers/subprocess.js

@@ -107,6 +107,9 @@ export class SubprocessDriver {
     async read(slot, lines) {
         return this.state(slot).buf.split("\n").slice(-lines).join("\n");
     }
+    async focus() {
+        return { status: "unsupported", reason: "Subprocess workers have no visible pane; open task evidence with Enter" };
+    }
     async notify(msg, _opts) {
         if (_opts?.tier === "routine")
             return;

package/dist/drivers/types.d.ts

@@ -66,6 +66,18 @@ export declare function panesToClose(agents: FleetAgent[], desired: Set<string>,
     tabId?: string;
 }[];
 export declare function canonicalizeLegacyName(name: string, runId: string): OwnedName;
+export interface FocusTarget {
+    repo: string;
+    runId: string;
+    taskId: string;
+    attempt: number;
+    slot: Slot;
+    workspace?: string;
+}
+export type FocusResult = {
+    status: "focused" | "foreign" | "closed" | "unsupported";
+    reason: string;
+};
 export interface SlotPlacement {
     surface?: string;
     hostPlatform?: string;
@@ -76,6 +88,8 @@ export interface ExecutorDriver {
     /** The exact terminal read surface used for liveness evidence. */
     readSource?: string;
     /** Placement facts returned by drivers whose terminal host exposes them. */
+    /** Verify the recorded identity against the live host before any focus mutation. */
+    focus?(target: FocusTarget): Promise<FocusResult>;
     describe?(slot: Slot): SlotPlacement | Promise<SlotPlacement> | undefined;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
     run(slot: Slot, cmd: string): Promise<void>;

package/dist/gates/artifact-manifest.d.ts

@@ -23,6 +23,27 @@ export type CaptureArtifactManifest = {
     readonly artifacts: readonly CaptureArtifactManifestEntry[];
 };
 export declare const CAPTURE_PRODUCERS: readonly [{
+    readonly id: "screen-soak";
+    readonly provenance: {
+        readonly source: "tests/fixtures/screen-soak/soak.mjs";
+        readonly entrypoint: "sample";
+        readonly revision: "C6-four-hour-production-v1";
+    };
+}, {
+    readonly id: "screen-soak-archive";
+    readonly provenance: {
+        readonly source: "tests/fixtures/screen-soak/archive.mjs";
+        readonly entrypoint: "archiveRecord";
+        readonly revision: "C6-lossless-gzip-v1";
+    };
+}, {
+    readonly id: "cockpit-final-shell";
+    readonly provenance: {
+        readonly source: "src/tui/cockpit/capture.ts";
+        readonly entrypoint: "captureShellOutput";
+        readonly revision: "final-shell-v1";
+    };
+}, {
     readonly id: "cockpit-golden-frames";
     readonly provenance: {
         readonly source: "src/tui/cockpit/capture.ts";
@@ -40,6 +61,27 @@ export declare const CAPTURE_PRODUCERS: readonly [{
 export declare const CAPTURE_ARTIFACT_MANIFEST: {
     readonly version: 1;
     readonly producers: readonly [{
+        readonly id: "screen-soak";
+        readonly provenance: {
+            readonly source: "tests/fixtures/screen-soak/soak.mjs";
+            readonly entrypoint: "sample";
+            readonly revision: "C6-four-hour-production-v1";
+        };
+    }, {
+        readonly id: "screen-soak-archive";
+        readonly provenance: {
+            readonly source: "tests/fixtures/screen-soak/archive.mjs";
+            readonly entrypoint: "archiveRecord";
+            readonly revision: "C6-lossless-gzip-v1";
+        };
+    }, {
+        readonly id: "cockpit-final-shell";
+        readonly provenance: {
+            readonly source: "src/tui/cockpit/capture.ts";
+            readonly entrypoint: "captureShellOutput";
+            readonly revision: "final-shell-v1";
+        };
+    }, {
         readonly id: "cockpit-golden-frames";
         readonly provenance: {
             readonly source: "src/tui/cockpit/capture.ts";
@@ -62,6 +104,14 @@ export declare const CAPTURE_ARTIFACT_MANIFEST: {
         path: string;
         producer: string;
         provenance: CaptureProducerProvenance;
+    } | {
+        path: string;
+        producer: string;
+        provenance: CaptureProducerProvenance;
+    } | {
+        path: string;
+        producer: string;
+        provenance: CaptureProducerProvenance;
     })[];
 };
 /** Compatibility name for the pre-manifest gate API; now derived from one manifest. */

package/dist/gates/artifact-manifest.js

@@ -13,7 +13,19 @@ const COLOUR_PROVENANCE = {
     entrypoint: "regenerateColourFrames",
     revision: "colour-frame-v1",
 };
+const SHELL_PROVENANCE = {
+    source: "src/tui/cockpit/capture.ts", entrypoint: "captureShellOutput", revision: "final-shell-v1",
+};
+const SOAK_PROVENANCE = {
+    source: "tests/fixtures/screen-soak/soak.mjs", entrypoint: "sample", revision: "C6-four-hour-production-v1",
+};
+const SOAK_ARCHIVE_PROVENANCE = {
+    source: "tests/fixtures/screen-soak/archive.mjs", entrypoint: "archiveRecord", revision: "C6-lossless-gzip-v1",
+};
 export const CAPTURE_PRODUCERS = [
+    { id: "screen-soak", provenance: SOAK_PROVENANCE },
+    { id: "screen-soak-archive", provenance: SOAK_ARCHIVE_PROVENANCE },
+    { id: "cockpit-final-shell", provenance: SHELL_PROVENANCE },
     { id: "cockpit-golden-frames", provenance: GOLDEN_PROVENANCE },
     { id: "cockpit-colour-frames", provenance: COLOUR_PROVENANCE },
 ];
@@ -49,6 +61,17 @@ export const CAPTURE_ARTIFACT_MANIFEST = {
     version: 1,
     producers: CAPTURE_PRODUCERS,
     artifacts: [
+        // Exact measured artifacts only. Neighbouring harnesses, notes and unknown
+        // records remain logic; duration evidence never grants a directory exemption.
+        ...["static", "growth", "cutover-static", "cutover-growth", "final-static", "final-growth", "retry-static", "retry-growth"].flatMap(attempt => ["build.json", "metadata.json", "samples.jsonl", "last-frame.ansi", "journal.jsonl.gz", "result.json.gz"].map(file => ({
+            path: `tests/fixtures/screen-soak/records/${attempt}/${file}`,
+            producer: file.endsWith(".gz") ? "screen-soak-archive" : "screen-soak",
+            provenance: provenanceCopy(file.endsWith(".gz") ? SOAK_ARCHIVE_PROVENANCE : SOAK_PROVENANCE),
+        }))),
+        ...["home", "run", "evidence"].flatMap(view => ["120x40", "80x24"].map(size => ({
+            path: `tests/fixtures/cockpit/final/${view}.${size}.txt`,
+            producer: "cockpit-final-shell", provenance: provenanceCopy(SHELL_PROVENANCE),
+        }))),
         ...goldenFrameNames.map((fixture) => ({
             path: `tests/fixtures/cockpit/frames/${fixture}`,
             producer: "cockpit-golden-frames",

package/dist/plan/scope.d.ts

@@ -1,12 +1,14 @@
 import type { WorkerAdapter } from "../adapters/types.js";
 import type { TickmarkrConfig } from "../config/config.js";
 import type { ExecutorDriver } from "../drivers/types.js";
+export declare const MAX_SCOPE_ATTEMPTS = 3;
 export declare function clarificationGate(intent: string): string[];
 export interface ScopeOptions {
     cfg: TickmarkrConfig;
     adapters: WorkerAdapter[];
     driver?: ExecutorDriver;
     force?: boolean;
+    candidate?: ScopeCandidate;
 }
 export interface ScopeResult {
     specFile: string;
@@ -14,4 +16,27 @@ export interface ScopeResult {
     attempts: number;
 }
 export declare function specPathForIntent(intentFile: string): string;
+export interface ScopeCandidate {
+    adapter: string;
+    model: string;
+}
+export interface ScopePreview {
+    intentFile: string;
+    specFile: string;
+    specExists: boolean;
+    cached: boolean;
+    candidate?: ScopeCandidate;
+    authoringBudget: number;
+    probeCalls: number;
+}
+/**
+ * R11/R45 (C10): local-only disclosure — intent/clarification checks and a candidate read off the
+ * doctor cache, never a fresh probe or a model turn. `readDoctor` and `discoverChannels`/`route` are
+ * pure reads over that cache, so this never touches an adapter.
+ */
+export declare function previewScope(intentFile: string, repoRoot: string, options: {
+    cfg: TickmarkrConfig;
+    adapters: WorkerAdapter[];
+}): ScopePreview;
+export declare function formatScopePreview(preview: ScopePreview): string;
 export declare function scopeIntent(intentFile: string, repoRoot: string, options: ScopeOptions): Promise<ScopeResult>;