tickmarkr 2.5.4 → 2.5.6

package/dist/cli/commands/fleet.js

@@ -5,13 +5,13 @@ import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, modelAuthE
 import { catalogModelAdvisory, catalogTierRanking, declaredModelWindow, fleetUnclassifiedModels } from "../../adapters/model-lints.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, readClaudeAliasIdentity } from "../../adapters/claude-code.js";
-import { fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, overlayBytesLoadError, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, unifiedYamlDiff, } from "../../config/config.js";
-import { projectFleetWhy, renderFleetWhy } from "../../config/fleet-why.js";
+import { fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, loadConfigWithMode, overlayBytesLoadError, readOverlayFile, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, TIER_RANK, unifiedYamlDiff, } from "../../config/config.js";
+import { exclusionReason, projectFleetWhy, renderFleetWhy } from "../../config/fleet-why.js";
 import { SHAPES, TIERS } from "../../graph/schema.js";
 import { doctor } from "./doctor.js";
 import { candidateRow, costSignal, shapeCandidates } from "./fleet-picker.js";
 import { route } from "../../route/router.js";
-import { disallowedBy } from "../../route/preference.js";
+import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, entryMatchesChannel, exclusionCollector } from "../../route/preference.js";
 import { resolveRunMode } from "../../run/daemon.js";
 import { loadRoutingProfile } from "../../run/journal.js";
 const initialFetch = globalThis.fetch;
@@ -202,10 +202,17 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const previewChannels = discoverChannels({ ...cfg, routing: routingScopeBlind }, adapters, health);
     const universe = adapters
         .filter((adapter) => health[adapter.id]?.installed)
-        .map((adapter) => ({
-        adapter: adapter.id,
-        models: [...new Set(previewChannels.filter((c) => c.adapter === adapter.id).map((c) => c.model))],
-    }));
+        .map((adapter) => {
+        const served = previewChannels.filter((c) => c.adapter === adapter.id);
+        // LEG2-T3 round 2 finding 3: the recorded identity per channel, so the editable membership
+        // matches allow/deny entries with the same authority the collector and the browser use
+        const identities = Object.fromEntries(served.flatMap((c) => (c.identity ? [[c.model, c.identity]] : [])));
+        return {
+            adapter: adapter.id,
+            models: [...new Set(served.map((c) => c.model))],
+            ...(Object.keys(identities).length ? { identities } : {}),
+        };
+    });
     const initial = fleetEditableFromConfig(cfg, universe);
     const editable = structuredClone(initial);
     // OBS-508: the same catalog evidence doctor's drift overlay prints now rides each unclassified
@@ -250,9 +257,14 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         || a.model.localeCompare(b.model));
     // OBS-508 follow-through: the browser renders the metadata the assembler always had — catalog
     // ctx/price evidence and doctor's model-probe wall clock — as columns instead of dropping them.
+    // OBS-972/FL-1: the same alias→identity doctor recorded (modelAuth.identity, falling back to
+    // the coarser per-adapter modelIdentities map registry.ts/preference.ts already read for
+    // routing exclusion) — a floating alias's resolved concrete model id.
+    const resolvedModelIdentity = (adapter, model) => health[adapter]?.modelAuth?.[model]?.identity ?? health[adapter]?.modelIdentities?.[model];
     const rowEvidence = (adapter, model, evidence) => {
         const probed = health[adapter]?.modelAuth?.[model];
         const contextWindow = evidence?.contextWindow ?? declaredModelWindow(cfg, adapter, model);
+        const identity = resolvedModelIdentity(adapter, model);
         const out = {
             ...(contextWindow !== undefined ? { contextWindow } : {}),
             ...(evidence?.outputWindow !== undefined ? { outputWindow: evidence.outputWindow } : {}),
@@ -262,6 +274,8 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             // OBS-519: doctor already recorded the failed verdict — a rate-limited/unauthed model must
             // not render identically to a healthy row on the surface that edits its fleet membership.
             ...(probed?.authed === false ? { unauthed: probed.reason ?? "probe failed" } : {}),
+            // the browser decides deny coverage itself, over the STAGED policy (LEG2-T3 finding 1)
+            ...(identity !== undefined ? { identity } : {}),
         };
         return Object.keys(out).length > 0 ? out : undefined;
     };
@@ -306,24 +320,44 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     ]));
     const channels = discoverChannels(cfg, adapters, health);
     const profile = loadRoutingProfile(cwd, cfg, { preview: true });
+    const stagedEditable = (map, deny) => ({
+        ...structuredClone(initial),
+        denyAdapters: deny.adapters,
+        denyModels: deny.models,
+        // OBS-1046: the allow complement is staged beside the deny lists, never folded into them
+        allowOut: deny.allowOut ?? initial.allowOut,
+        denyWorkersAdapters: deny.workersAdapters,
+        denyWorkersModels: deny.workersModels,
+        map,
+    });
+    const candidateMemo = new Map();
     const previewCfg = (mode, map, deny) => {
-        // mirror the writer: only the adapters/models scopes are fleet-editable; workers deny survives
-        const nextDeny = { ...cfg.routing.deny };
-        if (deny.adapters.length)
-            nextDeny.adapters = deny.adapters;
-        else
-            delete nextDeny.adapters;
-        if (deny.models.length)
-            nextDeny.models = deny.models;
-        else
-            delete nextDeny.models;
-        const routing = {
-            ...routingScopeBlind,
-            map,
-            floors: modeCfgs[mode].cfg.routing.floors,
-            ...(Object.keys(nextDeny).length ? { deny: nextDeny } : {}),
-        };
-        return { ...cfg, routing };
+        const key = JSON.stringify([mode, map, deny]);
+        const hit = candidateMemo.get(key);
+        if (hit)
+            return hit;
+        let preview;
+        try {
+            const bytes = renderFleetOverlayWrite(currentRepoOverlayText(cwd), {
+                initial,
+                edited: stagedEditable(map, deny),
+                universe,
+                ...(mode !== rm.mode.mode ? { mode } : {}),
+            });
+            preview = { ok: true, cfg: loadConfigWithMode(cwd, { globalDir, repoOverlayText: bytes }).cfg };
+        }
+        catch (error) {
+            preview = { ok: false, error: error.message.replace(/\s+/g, " ").trim() };
+        }
+        if (candidateMemo.size > 32)
+            candidateMemo.clear();
+        candidateMemo.set(key, preview);
+        return preview;
+    };
+    const previewUnavailable = (error) => `preview unavailable (${error}) — the staged overlay does not load, so w would be refused`;
+    const stagedRouting = (deny) => {
+        const preview = previewCfg(rm.mode.mode, editable.map, deny);
+        return preview.ok ? { ok: true, routing: preview.cfg.routing } : preview;
     };
     // route() never deny-filters its pool — that contract lives in discoverChannels — so every
     // preview call rebuilds the pool the staged deny would discover
@@ -333,7 +367,10 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         let subs = 0;
         let apiN = 0;
         let apiUsd = 0;
-        const cfgPreview = previewCfg(mode, map, deny);
+        const preview = previewCfg(mode, map, deny);
+        if (!preview.ok)
+            return `  mix: ${previewUnavailable(preview.error)}`;
+        const cfgPreview = preview.cfg;
         const pool = previewPool(cfgPreview);
         for (const shape of SHAPES) {
             try {
@@ -393,7 +430,15 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             : { declaredAt: "routing.mode" };
     };
     const projectedShapeRows = (mode, map, deny) => {
-        const cfgPreview = previewCfg(mode, map, deny);
+        const preview = previewCfg(mode, map, deny);
+        if (!preview.ok) {
+            return projectFleetWhy(SHAPES.map((shape) => ({
+                id: shape,
+                effective: previewUnavailable(preview.error),
+                ...whyDeclaration(shape, mode, map, false),
+            })), { repoRoot: cwd, globalDir });
+        }
+        const cfgPreview = preview.cfg;
         const pool = previewPool(cfgPreview);
         const values = SHAPES.map((shape) => {
             try {
@@ -433,13 +478,13 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const unauthedClis = adapters
         .filter((adapter) => health[adapter.id]?.installed && health[adapter.id]?.authed === false)
         .map((adapter) => adapter.id);
-    const unauthedModelCount = modelAuthExclusions(cfg, adapters, health).length;
-    const excludedNoteFor = (deny) => {
+    const unauthedModels = modelAuthExclusions(cfg, adapters, health);
+    const unauthedModelCount = unauthedModels.length;
+    const excludedNoteFor = (cfgPreview) => {
         let stagedOut = 0;
         let denied = 0;
-        const stagedRouting = previewCfg(rm.mode.mode, {}, deny).routing;
         for (const channel of previewChannels) {
-            if (disallowedBy(channel, stagedRouting) === null)
+            if (disallowedBy(channel, cfgPreview.routing) === null)
                 continue;
             if (disallowedBy(channel, cfg.routing) === null)
                 stagedOut += 1;
@@ -459,14 +504,122 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             parts.push(`${unclassifiedRows.length} unclassified (never routed)`);
         return parts.length ? `not offered: ${parts.join(" · ")} — the models view explains each row` : undefined;
     };
+    // OBS-994/FL-1: the nine mechanisms outside the deny scopes that can keep a channel off a
+    // shape's candidate list each get a reason or an explicit "not manageable here" caption — a
+    // silent omission is indistinguishable from a bug (OBS-530's lesson, extended past deny/allow).
+    // allow and the unauthed probe already carry a reason through excludedNoteFor above; the rest
+    // are shape-scoped (a pin/pool/floor/prefer excludes only for THIS shape) and belong here.
+    const shapeExclusionCaptions = (shape, map, cfgPreview) => {
+        const pool = previewPool(cfgPreview);
+        const entry = map[shape];
+        const captions = [];
+        // 2. pin or pool — a closed candidate set declared for this shape; a channel outside it is
+        // not manageable from the models view, it is a Shapes-view declaration.
+        if (entry?.pin) {
+            captions.push(`pin: routing.map.${shape}.pin fixes this shape to ${entry.pin.via}:${entry.pin.model} — not manageable here, edit it in Shapes`);
+        }
+        else if (entry?.pool) {
+            const declared = new Set(entry.pool.channels);
+            const outside = pool.filter((c) => !declared.has(`${c.adapter}:${c.model}`));
+            if (outside.length) {
+                captions.push(`pool: ${outside.length} channel(s) outside routing.map.${shape}.pool's declared set — not manageable here, edit it in Shapes`);
+            }
+        }
+        // 3. floor — channels below this shape's minimum tier.
+        const floor = cfgPreview.routing.floors[shape];
+        if (floor) {
+            const belowFloor = pool.filter((c) => TIER_RANK[c.tier] < TIER_RANK[floor]);
+            if (belowFloor.length) {
+                captions.push(`floor: ${belowFloor.length} channel(s) below routing.floors.${shape} (${floor}) — not manageable here, edit the floor in Shapes`);
+            }
+        }
+        // 5. tombstones — the repo overlay's OWN null over this shape's map entry, masking a lower
+        // (global/default) layer's declaration rather than expressing a value of its own.
+        const repoRaw = readOverlayFile(repoOverlayPath(cwd));
+        const rawEntry = repoRaw.routing?.map?.[shape];
+        if (rawEntry === null) {
+            captions.push(`tombstone: routing.map.${shape}: null masks a lower layer's declaration — not manageable here, edit the repo overlay directly`);
+        }
+        else if (rawEntry && "pool" in rawEntry && rawEntry.pool === null) {
+            captions.push(`tombstone: routing.map.${shape}.pool: null masks a lower layer's pool — not manageable here, edit the repo overlay directly`);
+        }
+        else if (rawEntry && "pin" in rawEntry && rawEntry.pin === null) {
+            captions.push(`tombstone: routing.map.${shape}.pin: null masks a lower layer's pin — not manageable here, edit the repo overlay directly`);
+        }
+        // 6. explore/learned knobs — global routing settings, never a per-channel fleet toggle.
+        if (cfgPreview.routing.explore?.mode === "off") {
+            captions.push("explore: routing.explore.mode is off — a global knob, not manageable here");
+        }
+        if (cfgPreview.routing.learned === "off") {
+            captions.push("learned: routing.learned is off — a global knob, not manageable here");
+        }
+        // 7. task hint — a shape's prefer bias is authored in Shapes/spec, not per-channel in fleet.
+        if (entry?.prefer?.length) {
+            captions.push(`task hint: routing.map.${shape}.prefer ranks ${entry.prefer.join(", ")} — not manageable here, edit it in Shapes`);
+        }
+        // 8. deny∩prefer collision — a standing lint on this shape's declaration, never a fleet toggle.
+        for (const collision of denyPreferCollisions(cfgPreview, [shape])) {
+            captions.push(denyPreferCollisionLine(collision));
+        }
+        // 9. first-match provenance — the per-channel ledger below lists EVERY collector scope.
+        return captions;
+    };
+    // LEG2-T3 finding 1: each channel a mechanism touches on this shape gets its own ledger row
+    // naming every reason — collector scopes with their config paths (allow, flat and workers deny,
+    // all of them, never a first match), the unauthed probe, pin/pool/floor, the task hint and a
+    // deny∩prefer collision it is the target of — or that leaves the shape with no candidate at all.
+    const channelLedger = (shape, map, cfgPreview, offered) => {
+        const entry = map[shape];
+        const floor = cfgPreview.routing.floors[shape];
+        const collisions = denyPreferCollisions(cfgPreview, [shape]);
+        const discovered = new Set(previewChannels.map((c) => `${c.adapter}:${c.model}`));
+        // discovery already dropped a channel whose model probe failed — it still gets its own row
+        const unauthedRows = [
+            ...unauthedClis.map((adapter) => `${adapter} — CLI unauthed — re-probe with tickmarkr doctor`),
+            ...unauthedModels.filter(({ key }) => !discovered.has(key))
+                .map(({ key, reason }) => `${key.replace(":", "/")} — unauthed (${reason}) — re-probe with tickmarkr doctor`),
+        ];
+        return [...unauthedRows, ...previewChannels.flatMap((c) => {
+                const key = `${c.adapter}:${c.model}`;
+                const reasons = exclusionCollector(c, cfgPreview.routing, "worker").map(exclusionReason);
+                if (health[c.adapter]?.authed === false)
+                    reasons.push(`${c.adapter} CLI unauthed — re-probe with tickmarkr doctor`);
+                else if (health[c.adapter]?.modelAuth?.[c.model]?.authed === false)
+                    reasons.push("unauthed — re-probe with tickmarkr doctor");
+                if (entry?.pin && key !== `${entry.pin.via}:${entry.pin.model}`) {
+                    reasons.push(`not routing.map.${shape}.pin (${entry.pin.via}:${entry.pin.model}) — not manageable here`);
+                }
+                if (entry?.pool && !entry.pool.channels.includes(key)) {
+                    reasons.push(`outside routing.map.${shape}.pool — not manageable here`);
+                }
+                if (floor && TIER_RANK[c.tier] < TIER_RANK[floor]) {
+                    reasons.push(`below routing.floors.${shape} (${floor}) — not manageable here`);
+                }
+                if (entry?.prefer?.some((p) => entryMatchesChannel(p, c))) {
+                    reasons.push(`task hint: routing.map.${shape}.prefer names it — not manageable here`);
+                }
+                for (const collision of collisions) {
+                    const named = collision.detail.split(" > ").some((p) => entryMatchesChannel(p, c));
+                    if (named || offered.size === 0)
+                        reasons.push(denyPreferCollisionLine(collision));
+                }
+                // labelled like the models view's row (adapter/model), so a ledger row never reads as a candidate
+                return reasons.length ? [`${c.adapter}/${c.model} — ${reasons.join("; ")}`] : [];
+            })];
+    };
     const candidatesForShape = (shape, mode, map, deny) => {
-        const cfgPreview = previewCfg(mode, map, deny);
+        const preview = previewCfg(mode, map, deny);
+        if (!preview.ok)
+            return { rows: [], excludedNote: previewUnavailable(preview.error) };
+        const cfgPreview = preview.cfg;
         const rows = shapeCandidates(previewTask(shape), cfgPreview, previewPool(cfgPreview), profile).map((candidate) => ({
             id: `${candidate.assignment.adapter}:${candidate.assignment.model}`,
             label: candidateRow(candidate, cfg.pricing),
             pin: { via: candidate.assignment.adapter, model: candidate.assignment.model },
         }));
-        return { rows, excludedNote: excludedNoteFor(deny) };
+        const offered = new Set(rows.map((row) => row.id));
+        const notes = [excludedNoteFor(cfgPreview), ...shapeExclusionCaptions(shape, map, cfgPreview)].filter((note) => note !== undefined);
+        return { rows, excludedNote: notes.length ? notes.join("\n") : undefined, ledger: channelLedger(shape, map, cfgPreview, offered) };
     };
     const preferUniverse = [
         ...new Set(channels.flatMap((channel) => [
@@ -493,6 +646,10 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         const staged = structuredClone(initial);
         staged.denyAdapters = state.denyAdapters;
         staged.denyModels = state.denyModels;
+        staged.allowOut = state.allowOut ?? initial.allowOut;
+        // OBS-994/FL-1: the workers-only deny scope rides the same review/write funnel as the flat one.
+        staged.denyWorkersAdapters = state.denyWorkersAdapters;
+        staged.denyWorkersModels = state.denyWorkersModels;
         staged.map = state.map;
         const today = new Date().toISOString().slice(0, 10);
         for (const classification of state.classifications) {
@@ -545,6 +702,9 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         health,
         initialDenyAdapters: editable.denyAdapters,
         initialDenyModels: editable.denyModels,
+        initialAllowOut: editable.allowOut,
+        initialDenyWorkersAdapters: editable.denyWorkersAdapters,
+        initialDenyWorkersModels: editable.denyWorkersModels,
         modelGroups,
         initialMode: rm.mode.mode,
         modeOptions: ROUTING_MODES.map((mode) => ({ id: mode, gloss: MODE_GLOSS[mode] })),
@@ -560,6 +720,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         steeringOptionsFor,
         reviewOverlay,
         reloadGuard,
+        stagedRouting,
         entry: opts.entry,
         initialJudge,
         judgeSeats: seats,
@@ -607,6 +768,11 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     return {
         props,
         commit,
-        renderWhy: () => renderFleetWhy(projectedShapeRows(rm.mode.mode, editable.map, { adapters: editable.denyAdapters, models: editable.denyModels })),
+        renderWhy: () => renderFleetWhy(projectedShapeRows(rm.mode.mode, editable.map, {
+            adapters: editable.denyAdapters,
+            models: editable.denyModels,
+            workersAdapters: editable.denyWorkersAdapters ?? [],
+            workersModels: editable.denyWorkersModels ?? [],
+        })),
     };
 }

package/dist/cli/commands/init.js

@@ -1,6 +1,6 @@
 import { execFileSync } from "node:child_process";
-import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join, relative } from "node:path";
+import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { parseArgs } from "node:util";
@@ -9,10 +9,11 @@ import { allAdapters, formatDoctorAgeForInit, formatDoctorReport, initDoctorReus
 import { configTemplate, DEFAULT_CONFIG, globalConfigDir, loadConfig } from "../../config/config.js";
 import { LEGACY_PREFIX, specTemplate } from "../../compile/native.js";
 import { BANNER, kvRow, legend, rule, statusRow, title } from "../../brand.js";
-import { tickmarkrDir } from "../../graph/graph.js";
+import { stateDirName, tickmarkrDir } from "../../graph/graph.js";
 import { orcaHostDetected } from "../../drivers/index.js";
+import { WORKTREES_DIR } from "../../run/git.js";
 import { Journal } from "../../run/journal.js";
-import { runLockRunId, runStatusLine } from "../../run/lock.js";
+import { runLockOwner, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { doctor } from "./doctor.js";
 import { assembleFleetEditor } from "./fleet.js";
 const SCAFFOLD_SPEC = "tickmarkr.spec.md";
@@ -340,6 +341,191 @@ async function runInitWizard(cwd, input, output) {
         return null;
     return { overlay: result.overlay, installSkills: result.installSkills, installDocs: result.installDocs };
 }
+function realpathSafe(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        const parent = dirname(p);
+        if (parent === p)
+            return p;
+        return join(realpathSafe(parent), basename(p));
+    }
+}
+function isPathInside(parentDir, candidatePath) {
+    const resolvedParent = realpathSafe(resolve(parentDir));
+    const resolvedCandidate = realpathSafe(resolve(candidatePath));
+    const rel = relative(resolvedParent, resolvedCandidate);
+    return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+/**
+ * The ONLY way the --remove path runs git: GIT_DIR, GIT_WORK_TREE and GIT_COMMON_DIR are stripped so the repository acted on
+ * is always cwd's own, and LC_ALL=C keeps stderr parseable. Throws execFileSync's error (status, stderr) unchanged.
+ */
+function removeGit(cwd, args) {
+    const { GIT_DIR: _dir, GIT_WORK_TREE: _workTree, GIT_COMMON_DIR: _commonDir, ...env } = process.env;
+    return execFileSync("git", args, { cwd, env: { ...env, LC_ALL: "C" }, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}
+function isLinkedWorktree(cwd) {
+    try {
+        const gitDir = removeGit(cwd, ["rev-parse", "--git-dir"]).trim();
+        const gitCommonDir = removeGit(cwd, ["rev-parse", "--git-common-dir"]).trim();
+        return resolve(cwd, gitDir) !== resolve(cwd, gitCommonDir);
+    }
+    catch {
+        return false;
+    }
+}
+function checkLiveLock(cwd) {
+    const localOwner = runLockOwner(cwd);
+    if (localOwner?.live)
+        return localOwner;
+    try {
+        const gitDir = removeGit(cwd, ["rev-parse", "--git-dir"]).trim();
+        const gitCommonDir = removeGit(cwd, ["rev-parse", "--git-common-dir"]).trim();
+        if (resolve(cwd, gitDir) !== resolve(cwd, gitCommonDir)) {
+            const mainRepo = dirname(resolve(cwd, gitCommonDir));
+            const mainOwner = runLockOwner(mainRepo);
+            if (mainOwner?.live)
+                return mainOwner;
+        }
+    }
+    catch {
+        // not a git repo
+    }
+    return undefined;
+}
+/**
+ * Only git's discovery answer — exit 128, stderr `fatal: not a git repository (or any of the parent directories)` — means false.
+ * Every other failure (explicit bad GIT_DIR, invalid gitfile, permission, missing binary) refuses: unregistration could not be verified.
+ */
+function isGitRepo(cwd) {
+    try {
+        removeGit(cwd, ["rev-parse", "--is-inside-work-tree"]);
+        return true;
+    }
+    catch (err) {
+        const e = err;
+        const stderr = String(e.stderr ?? "").trim();
+        if (e.status === 128 && stderr.startsWith("fatal: not a git repository (or any of the parent directories)"))
+            return false;
+        throw new Error(`cannot remove: git repository probe failed: ${stderr || e.message || "unknown error"}`);
+    }
+}
+/** Runs git and throws `message` plus git's stderr on failure — a remove never proceeds past a failed step. */
+function git(cwd, args, message) {
+    try {
+        return removeGit(cwd, args);
+    }
+    catch (err) {
+        const stderr = String(err.stderr ?? "").trim();
+        throw new Error(stderr ? `${message}: ${stderr}` : message);
+    }
+}
+function registeredWorktrees(cwd, worktreesDir) {
+    const out = git(cwd, ["worktree", "list", "--porcelain"], "cannot remove: git worktree list failed");
+    return out
+        .split("\n")
+        .filter((line) => line.startsWith("worktree "))
+        .map((line) => line.slice("worktree ".length).trim())
+        .filter((wt) => isPathInside(worktreesDir, wt));
+}
+function handleRemove(cwd) {
+    const owner = checkLiveLock(cwd);
+    if (owner?.live) {
+        const holder = typeof owner.pid === "number" ? `live pid ${owner.pid}` : (owner.pid ?? "unreadable payload");
+        throw new Error(`cannot remove: graph.lock held by ${holder}`);
+    }
+    if (isLinkedWorktree(cwd)) {
+        throw new Error("cannot remove from inside a linked worktree");
+    }
+    const notes = [];
+    const stateDir = join(cwd, stateDirName(cwd));
+    const worktreesDir = join(stateDir, WORKTREES_DIR);
+    // 1. Unregister every git worktree under stateDir/WORKTREES_DIR, and prove it, before deleting anything
+    if (isGitRepo(cwd)) {
+        for (const wt of registeredWorktrees(cwd, worktreesDir)) {
+            // double --force: git refuses a locked worktree (present or already deleted) with a single one
+            git(cwd, ["worktree", "remove", "--force", "--force", wt], `cannot remove: failed to unregister worktree ${wt}`);
+        }
+        git(cwd, ["worktree", "prune"], "cannot remove: git worktree prune failed");
+        const left = registeredWorktrees(cwd, worktreesDir);
+        if (left.length > 0) {
+            throw new Error(`cannot remove: worktrees still registered: ${left.join(", ")}`);
+        }
+    }
+    // 2. Delete .tickmarkr state directory
+    if (existsSync(stateDir)) {
+        rmSync(stateDir, { recursive: true, force: true });
+        notes.push(`deleted state directory ${stateDir}`);
+    }
+    // 3. Delete shipped skill directories at every host location
+    const targetSkillDirs = [
+        join(cwd, ".agents", "skills"),
+        join(cwd, ".claude", "skills"),
+    ];
+    for (const dir of targetSkillDirs) {
+        for (const skill of AGENT_SKILLS) {
+            const skillPath = join(dir, skill);
+            if (existsSync(skillPath)) {
+                rmSync(skillPath, { recursive: true, force: true });
+                notes.push(`deleted skill ${skillPath}`);
+            }
+        }
+    }
+    // 4. Delete marker-bounded guidance block in AGENTS.md and CLAUDE.md leaving every byte outside identical
+    const marked = new RegExp(`<!-- (?:tickmarkr|${LEGACY_PREFIX}):agent-docs begin -->[\\s\\S]*?`
+        + `<!-- (?:tickmarkr|${LEGACY_PREFIX}):agent-docs end -->`);
+    for (const doc of ["AGENTS.md", "CLAUDE.md"]) {
+        const docPath = join(cwd, doc);
+        if (existsSync(docPath)) {
+            const current = readFileSync(docPath, "utf8");
+            const m = current.match(marked);
+            if (m && m.index !== undefined) {
+                const before = current.slice(0, m.index);
+                const after = current.slice(m.index + m[0].length);
+                writeFileSync(docPath, before + after);
+                notes.push(`removed guidance block from ${docPath}`);
+            }
+        }
+    }
+    // 5. Delete scaffold spec only while it still equals the shipped template
+    const specPath = join(cwd, SCAFFOLD_SPEC);
+    if (existsSync(specPath)) {
+        const currentSpec = readFileSync(specPath, "utf8");
+        if (currentSpec === specTemplate()) {
+            rmSync(specPath, { force: true });
+            notes.push(`deleted scaffold spec ${specPath}`);
+        }
+        else {
+            notes.push(`kept edited spec ${specPath}`);
+        }
+    }
+    // 6. Query and print remaining branches and preserved refs
+    let branches = [];
+    try {
+        const out = removeGit(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads/tickmarkr/"]);
+        branches = out.split("\n").map((b) => b.trim()).filter(Boolean);
+    }
+    catch {
+        // ignore
+    }
+    let preservedRefs = [];
+    try {
+        const out = removeGit(cwd, ["for-each-ref", "--format=%(refname)", "refs/tickmarkr/preserved/"]);
+        preservedRefs = out.split("\n").map((r) => r.trim()).filter(Boolean);
+    }
+    catch {
+        // ignore
+    }
+    for (const b of branches) {
+        notes.push(`left branch: ${b}`);
+    }
+    for (const r of preservedRefs) {
+        notes.push(`left ref: ${r}`);
+    }
+    return notes.join("\n");
+}
 export async function init(argv, cwd = process.cwd(), io = {}) {
     let bannerEmitted = false;
     const emitBanner = () => {
@@ -348,6 +534,8 @@ export async function init(argv, cwd = process.cwd(), io = {}) {
             process.stdout.write(BANNER);
         }
     };
+    // banner at START on the visual surface — every init path, not just the wizard, and never trailing the probe (operator report 2026-07-17)
+    emitBanner();
     const { values } = parseArgs({
         args: argv,
         options: {
@@ -357,13 +545,15 @@ export async function init(argv, cwd = process.cwd(), io = {}) {
             docs: { type: "boolean" },
             fresh: { type: "boolean" },
             yes: { type: "boolean" },
+            remove: { type: "boolean" },
         },
     });
-    // banner at START on the visual surface — every init path, not just the wizard, and never trailing the probe (operator report 2026-07-17)
-    emitBanner();
     if (packageName(cwd) === "tickmarkr") {
         throw new Error("OBS-584: tickmarkr init refuses to run inside the tickmarkr source repository");
     }
+    if (values.remove) {
+        return handleRemove(cwd);
+    }
     const gdir = values["global-dir"] ?? globalConfigDir();
     mkdirSync(gdir, { recursive: true });
     const notes = [];

package/dist/cli/commands/plan.js

@@ -7,7 +7,7 @@ import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
 import { classifyContextPath } from "../../compile/native.js";
 import { DEFAULT_CONFIG, effectiveReviewPolicy, overlayPreferShapes, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
-import { graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
+import { chainDepth, dispatchWaves, graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
 import { renderAcceptanceItem } from "../../graph/schema.js";
 import { resolveRunMode } from "../../run/daemon.js";
 import { disallowedBy, excludedChannels, exclusionLine, routingEntrySeatLines } from "../../route/preference.js";
@@ -364,11 +364,27 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             : "";
         return { line: `${channelKey(reviewer)}${rotationNote} — reviewPolicy full`, cost: seatCost(reviewer) };
     };
+    // OBS-1018: depth and wave come from the same functions the daemon admits by, so the plan shows the
+    // critical path the run will actually follow at this concurrency.
+    const depths = chainDepth(g);
+    const waves = dispatchWaves(g, cfg.concurrency);
+    const byId = new Map(g.tasks.map((t) => [t.id, t]));
+    const chainLine = (t) => {
+        const wave = waves.get(t.id);
+        // Map absence never implies status: a pending task stays wave-less when a dependency is
+        // running/gated/failed/human, so render the real status and name the blocking deps.
+        const tail = wave !== undefined
+            ? `wave ${wave} at concurrency ${cfg.concurrency}`
+            : t.status !== "pending"
+                ? `no wave (${t.status})`
+                : `no wave (pending; blocked by ${t.deps.filter((d) => byId.get(d)?.status !== "done").map((d) => `${d}:${byId.get(d)?.status ?? "missing"}`).join(", ")})`;
+        return `    chain: depth ${depths.get(t.id)} · ${tail}`;
+    };
     const routed = [];
     for (const t of g.tasks) {
         const refusals = [...(oracleRefusals.get(t.id) ?? []), ...(inputRefusals.get(t.id) ?? [])];
         if (refusals.length) {
-            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} !! pre-dispatch refusal — ${refusals.join("; ")}`);
+            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} !! pre-dispatch refusal — ${refusals.join("; ")}`, chainLine(t));
             continue;
         }
         try {
@@ -382,7 +398,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             const judge = judgeSeat(t);
             const review = reviewSeat(t, r.assignment);
             cost += est + judge.cost + review.cost;
-            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`, `    judge: ${judge.line}${judge.cost ? ` ~$${judge.cost.toFixed(2)}` : ""}`, `    review: ${review.line}${review.cost ? ` ~$${review.cost.toFixed(2)}` : ""}`);
+            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`, `    judge: ${judge.line}${judge.cost ? ` ~$${judge.cost.toFixed(2)}` : ""}`, `    review: ${review.line}${review.cost ? ` ~$${review.cost.toFixed(2)}` : ""}`, chainLine(t));
             const d = derivation(t.shape);
             if (d)
                 lines.push(d);
@@ -406,7 +422,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             if (!(e instanceof RoutingError))
                 throw e;
             const msg = `${e.message}${exclusionReason(e.message)}`;
-            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} !! ${msg}`);
+            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} !! ${msg}`, chainLine(t));
             const d = derivation(t.shape);
             if (d)
                 lines.push(d);

package/dist/cli/commands/resume.js

@@ -1,6 +1,6 @@
 import { parseArgs } from "node:util";
 import { loadConfig } from "../../config/config.js";
-import { parseDriverOverride, pickDriver } from "../../drivers/index.js";
+import { classifyHost, parseDriverOverride, pickDriver, preflightHostDriver } from "../../drivers/index.js";
 import { loadGraph } from "../../graph/graph.js";
 import { formatSummary, runDaemon } from "../../run/daemon.js";
 import { denyPreferCollisionLine, denyPreferCollisions } from "../../route/preference.js";
@@ -38,6 +38,8 @@ export async function resume(argv, cwd = process.cwd()) {
         throw new Error(collisions.map(denyPreferCollisionLine).join("; "));
     }
     await assertRefsWritable(cwd, "resume");
+    const host = classifyHost();
+    preflightHostDriver(cfg, driverOverride, host);
     const narrate = narrationSink(runId);
     const s = await runDaemon(cwd, {
         runId,
@@ -45,7 +47,7 @@ export async function resume(argv, cwd = process.cwd()) {
         graphChanged,
         retryFailed,
         // bound to the same sink the daemon gets, so a driver-journaled recovery reaches this rail too
-        driver: bindNarration(pickDriver(cfg, driverOverride), narrate),
+        driver: bindNarration(pickDriver(cfg, driverOverride, host), narrate),
         // v1.99 T2: the ONE narration sink — the quiet rail on a TTY, the raw journal formatter on a
         // pipe. A resumed run meets the same surface a fresh one does; printing the raw formatter here
         // would leave `resume` as the last place the old unfiltered dump survives. Bound to the run id