tickmarkr 2.6.0 → 2.6.1

package/dist/adapters/prompt.d.ts

@@ -1,6 +1,6 @@
 import { type Task } from "../graph/schema.js";
 import { type VerdictUnparseableCause } from "../gates/verdict-cause.js";
-import type { WorkerResult } from "./types.js";
+import { type WorkerResult } from "./types.js";
 export declare function buildTaskPrompt(task: Task, feedback?: string, nonce?: string): string;
 export declare function writePrompt(dir: string, task: Task, attempt: number, feedback?: string, nonce?: string): string;
 export declare function trailerPattern(nonce: string): string;
@@ -11,4 +11,5 @@ export type ClassifiedWorkerResult = WorkerResult & {
 };
 export declare function parseWorkerResult(raw: string, nonce: string): ClassifiedWorkerResult;
 export type DeadChannelReason = "auth-required" | "setup-required" | "provider-outage" | "timeout";
+export declare function classifyTransientCapacity(result: WorkerResult): RegExpExecArray | null;
 export declare function classifyDeadChannel(result: WorkerResult): DeadChannelReason | undefined;

package/dist/adapters/prompt.js

@@ -2,6 +2,7 @@ import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { classifyVerdictCause } from "../gates/verdict-cause.js";
+import { CAPACITY_RE } from "./types.js";
 // v1.87 T5: the scope rule states only what the runtime enforces, and no more. What it enforces:
 // `scope.allowDeviations` comes from the operator's config, is snapshotted and frozen when a gate
 // round starts (run-gates.ts `allowDeviations`), and is never written back — so a worker has no
@@ -133,6 +134,15 @@ const AUTH_RE = /not logged in|please (?:log ?in|sign in)|please run [^\n]{0,30}
 const SETUP_RE = /command not found|not recognized as an internal or external command|spawn \S+ ENOENT|missing required config|workspace trust (?:required|not granted)/i;
 const OUTAGE_RE = /unable to reach the model provider|cannot reach the model provider|model provider.{0,40}(?:unavailable|unreachable)|service (?:is )?temporarily unavailable|upstream connect error|overloaded_error/i;
 const TIMEOUT_RE = /\bETIMEDOUT\b|request timed out|connection timed out|deadline exceeded|timed out waiting for/i;
+// OBS-1161: transient capacity is the fourth classification beside quota and the typed dead-channel
+// reasons, and it obeys the same boundary rule: a parsed trailer — ok:true OR ok:false — is the worker
+// speaking, so a verdict that QUOTES the capacity phrase stays ordinary work evidence. The caller
+// hands in the chrome-filtered banner rows as `raw`, exactly as it does for classifyDeadChannel.
+export function classifyTransientCapacity(result) {
+    if (result.ok || (result.summary !== NO_TRAILER_SUMMARY && result.summary !== UNPARSEABLE_TRAILER_SUMMARY))
+        return null;
+    return CAPACITY_RE.exec(result.raw);
+}
 export function classifyDeadChannel(result) {
     // A parsed trailer — ok:true OR ok:false — is the worker speaking: genuine work outcomes walk
     // the normal gate/ladder path even when their transcript mentions auth/outage/timeout text.

package/dist/adapters/types.d.ts

@@ -210,5 +210,6 @@ export declare const PROMPT_ARGV_CEILING_LINUX = 120000;
 export declare const PROMPT_ARGV_CEILING_DEFAULT = 900000;
 export declare function promptArgvCeiling(platform?: string): number;
 export declare function promptFitsArgv(promptFile: string, platform?: string): boolean;
+export declare const CAPACITY_RE: RegExp;
 export declare const QUOTA_RE: RegExp;
 export declare const MODEL_ID_RE: RegExp;

package/dist/adapters/types.js

@@ -294,6 +294,16 @@ export function promptFitsArgv(promptFile, platform = process.platform) {
 // ZAI coding-plan exhaustion text: "Insufficient balance or no resource package. Please recharge."
 // Anchor the distinctive full phrase, not the two-word "insufficient balance" fragment — that fires
 // on ordinary billing/wallet task output the harness edits (research Pitfall 3, 2026-07-10).
+// OBS-1161: transient provider capacity ("Selected model is at capacity") is NOT quota — the seat
+// comes back within minutes, so it takes bounded same-seat backoff before a same-floor failover and
+// never permanent demotion. Kept apart from QUOTA_RE so permanent quota policy stays untouched, and
+// anchored on the full phrase (the Pitfall-3 lesson: a bare "capacity" fires on ordinary work text).
+// A banner is the CLI speaking, so the phrase must OPEN its row — after at most an error glyph
+// (codex paints "■ Selected model is at capacity. …") or an "error:" label. Anything else in front —
+// a `>` quote, a quotation mark, a sentence — is the transcript QUOTING it: work evidence, never capacity.
+// ponytail: row-start grammar, not per-adapter fixtures — the ceiling is a worker whose own output
+// opens a row with the bare phrase inside the banner tail; widen the glyph set only from a captured frame.
+export const CAPACITY_RE = /^[ \t■⚠✗✘×!]*(?:(?:stream )?error:[ \t]*)?(?:(?:selected |the )?model is (?:currently |temporarily )?at capacity|(?:provider|service|server) is (?:currently )?at capacity)/im;
 export const QUOTA_RE = /rate.?limit|quota|usage limit|out of credits|insufficient credit|insufficient balance or no resource|\b429\b/i;
 // v1.5 MODEL-01: charset gate for detected model ids (research Pitfall 4, verified 2026-07-10).
 // Ids come from CLI stdout / another program's JSON (models_cache.json) and are echoed into

package/dist/cli/commands/fleet.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { parseArgs } from "node:util";
-import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, modelAuthExclusions } from "../../adapters/registry.js";
+import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, modelAuthExclusions, PREFERENCE_ROLES } from "../../adapters/registry.js";
 import { catalogModelAdvisory, catalogTierRanking, declaredModelWindow, fleetUnclassifiedModels } from "../../adapters/model-lints.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, readClaudeAliasIdentity } from "../../adapters/claude-code.js";
@@ -11,6 +11,7 @@ import { SHAPES, TIERS } from "../../graph/schema.js";
 import { doctor } from "./doctor.js";
 import { candidateRow, costSignal, shapeCandidates } from "./fleet-picker.js";
 import { route } from "../../route/router.js";
+import { pickRole } from "../../route/role-pick.js";
 import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, entryMatchesChannel, exclusionCollector } from "../../route/preference.js";
 import { resolveRunMode } from "../../run/daemon.js";
 import { loadRoutingProfile } from "../../run/journal.js";
@@ -85,6 +86,8 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
     const { values } = parseArgs({
         args: argv,
         options: {
+            pick: { type: "string" },
+            "exclude-vendor": { type: "string", multiple: true },
             print: { type: "boolean" },
             why: { type: "boolean" },
             "global-dir": { type: "string" },
@@ -92,6 +95,28 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         },
     });
     const globalDir = values["global-dir"] ?? globalConfigDir();
+    if (values.pick !== undefined) {
+        const role = PREFERENCE_ROLES.find((role) => role === values.pick);
+        const refuse = (reason) => ({ out: `tickmarkr fleet --pick ${values.pick}: ${reason}`, code: 1 });
+        if (!role)
+            return refuse("unsupported-role — expected worker, judge, review or consult; no role prefer resolved");
+        if (values.print || values.why || values.fresh)
+            return refuse("incompatible options — --pick cannot use --print, --why or --fresh");
+        const { cfg } = resolveRunMode(cwd, { globalDir });
+        const { reuse, health } = initDoctorReuse(cwd, false);
+        const selection = pickRole(role, cfg, adapters, reuse && health ? health : {}, {
+            excludeVendors: new Set(values["exclude-vendor"] ?? []),
+        });
+        if (!selection.ok) {
+            return refuse(selection.reason === "missing-prefer" ? `${role}.prefer: missing-prefer`
+                : !reuse || !health ? `${role}.prefer: probe data missing or stale — run tickmarkr doctor first`
+                    : `${role}.prefer: ${selection.reason}`);
+        }
+        const { adapter, model, vendor, channel } = selection.channel;
+        return JSON.stringify({ role, adapter, model, vendor, channel });
+    }
+    if (values["exclude-vendor"]?.length)
+        return { out: "tickmarkr fleet: --exclude-vendor requires --pick <role>", code: 1 };
     const print = values.print ?? false;
     const why = values.why ?? false;
     const input = io.input ?? process.stdin;

package/dist/cli/commands/plan.js

@@ -7,10 +7,10 @@ import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
 import { classifyContextPath } from "../../compile/native.js";
 import { DEFAULT_CONFIG, effectiveReviewPolicy, overlayPreferShapes, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
-import { chainDepth, dispatchWaves, graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
+import { batteryPriority, chainDepth, dispatchWaves, graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
 import { filesGlob } from "../../graph/files-glob.js";
 import { renderAcceptanceItem } from "../../graph/schema.js";
-import { resolveRunMode } from "../../run/daemon.js";
+import { pendingDaemonApprovalActions, resolveRunMode } from "../../run/daemon.js";
 import { disallowedBy, excludedChannels, exclusionLine, routingEntrySeatLines } from "../../route/preference.js";
 import { decayWeight, HALF_LIFE_RUNS, staffLedEvidence } from "../../route/profile.js";
 import { route, RoutingError } from "../../route/router.js";
@@ -372,7 +372,11 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     // OBS-1018: depth and wave come from the same functions the daemon admits by, so the plan shows the
     // critical path the run will actually follow at this concurrency.
     const depths = chainDepth(g);
-    const waves = dispatchWaves(g, cfg.concurrency);
+    // OBS-1158: waves simulate the graph the daemon would admit on resume — the journal's replayed
+    // statuses (an approval releases its park to pending) and its pending recheck approvals ranked
+    // through the same seam the daemon admits by.
+    const projected = { ...g, tasks: g.tasks.map((t) => ({ ...t, status: taskStatuses.get(t.id) ?? t.status })) };
+    const waves = dispatchWaves(projected, cfg.concurrency, batteryPriority(pendingDaemonApprovalActions(matchingEvents ?? []).values()));
     const byId = new Map(g.tasks.map((t) => [t.id, t]));
     const chainLine = (t) => {
         const wave = waves.get(t.id);

package/dist/cli/commands/status.js

@@ -8,6 +8,7 @@ import { formatOwnedName, parseOwnedName, } from "../../drivers/types.js";
 import { blockedTasks, graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { projectActivity } from "../../run/activity.js";
+import { authorsNote, doneAuthors } from "../../run/operator-state.js";
 import { projectOperatorSummary } from "../../run/operator-summary.js";
 import { trackJournalRows } from "../../run/protocol.js";
 import { newestPark, permittedDecisionVerbs } from "./approve.js";
@@ -988,6 +989,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
     const comparable = record?.comparable ?? false;
     const rehashAt = record?.rehashAt;
     const assignments = new Map();
+    const authorsByTask = new Map();
     const contexts = new Map();
     // v1.53 T5: this run is dead — a newer run replaced it
     const supersededBy = [...events].reverse()
@@ -1000,6 +1002,11 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
                     assignments.set(e.taskId, `${a.adapter}:${a.model}`);
                 }
             }
+            if (e.event === "task-done" && e.taskId) {
+                const authors = doneAuthors(e.data);
+                if (authors)
+                    authorsByTask.set(e.taskId, authors);
+            }
             if (e.event === "context-sample" && e.taskId && typeof e.data.tokens === "number" && Number.isFinite(e.data.tokens)) {
                 contexts.set(e.taskId, e.data.tokens); // last write wins
             }
@@ -1106,12 +1113,14 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
         const label = isStarved ? " starved" : phrase ? ` ${phrase}` : "";
         const channel = journalRowsOnly ? folded?.actor ?? "-" : assignments.get(t.id) ?? "-";
         const ctx = contexts.get(t.id);
-        const assignCol = ctx !== undefined ? `${channel}${divider}ctx ${ctx}` : channel;
+        // Merged authors are their own fact beside the last dispatch: a carry-only seat authored nothing.
+        const authors = authorsNote(authorsByTask.get(t.id), channel);
+        const assignCol = [channel, ctx !== undefined ? `ctx ${ctx}` : "", authors ?? ""].filter(Boolean).join(divider);
         const gates = comparable
             ? gateSnapshot(t, events, rehashAt)
             : { states: defaultGateStates(t), priorGraph: false };
         const pane = panes.get(t.id);
-        return { t, st, merged, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, livePhase, pane, summary, ...gates };
+        return { t, st, merged, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, authors, livePhase, pane, summary, ...gates };
     });
     if (!unicode) {
         // Keep the machine task-title columns intact; projection details occupy their own line.
@@ -1215,7 +1224,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
     }).join("");
     const gateHeader = GATE_NAMES.map((gate) => fitCells(gate.slice(0, 2), 3)).join("");
     const noteFor = (cell) => {
-        const { t, st, merged, failureKind, redTier, states, priorGraph, isStarved, phrase, ctx, livePhase, pane } = cell;
+        const { t, st, merged, failureKind, redTier, states, priorGraph, isStarved, phrase, ctx, livePhase, pane, authors } = cell;
         const effort = effortByTask.get(t.id);
         const blocking = graphTaskStatus(st, t.status) === "done" ? [] : dependents.get(t.id) ?? [];
         const failed = failedGates(states);
@@ -1242,6 +1251,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
             blocking.length ? `blocks ${blocking.join(", ")}` : "",
             pane ? `pane ${pane}` : "",
             ctx !== undefined ? `ctx ${ctx}` : "",
+            authors ?? "",
         ].filter(Boolean).join(" · ");
     };
     const staleWorker = (cell) => cell.livePhase?.phase === "worker"

package/dist/cli/help.d.ts

@@ -39,6 +39,8 @@ export declare const COMMAND_HELP: {
         usage: string;
         description: string;
         options: {
+            "--pick <role>": string;
+            "--exclude-vendor <vendor>": string;
             "--print": string;
             "--why": string;
             "--global-dir <path>": string;

package/dist/cli/help.js

@@ -30,6 +30,8 @@ export const COMMAND_HELP = {
     fleet: {
         usage: "fleet [options]", description: "Edit fleet configuration interactively, or print it for scripts.",
         options: {
+            "--pick <role>": "Resolve one role preference as JSON without launching a seat (review or consult; roles without prefer refuse).",
+            "--exclude-vendor <vendor>": "Exclude a vendor from --pick; repeat for multiple vendors.",
             "--print": "Print fleet configuration without opening the editor.",
             "--why": "Include routing eligibility explanations in printed output.",
             "--global-dir <path>": "Use this global configuration directory.",

package/dist/drivers/orca.js

@@ -246,7 +246,12 @@ export function provesCheckout(text, checkout) {
  * subshell inside it all start in the checkout and its exit status is the payload's (FX-N02).
  */
 export function checkoutPrefix(checkout) {
-    return `cd ${shq(checkout)} && printf '%s\\n' ${shq(checkoutProofLine(checkout))} && sh -c `;
+    // OBS-1168: printf BUILDS the marker from two arguments, so the typed command never carries
+    // `TICKMARKR_CHECKOUT ` verbatim. The shell's echo of the typed line is repainted and truncated in
+    // the scrollback, which used to leave an INCOMPLETE frame beside the complete printed one and made
+    // provesCheckout refuse a correct launch. The printed bytes are exactly checkoutProofLine(checkout).
+    const head = CHECKOUT_MARK.slice(0, CHECKOUT_MARK.indexOf("_"));
+    return `cd ${shq(checkout)} && printf '%s%s\\n' ${head} ${shq(checkoutProofLine(checkout).slice(head.length))} && sh -c `;
 }
 /** The command a terminal on the tracked worktree runs so that it executes INSIDE the checkout. */
 export function inCheckout(checkout, cmd) {

package/dist/gates/cache.d.ts

@@ -36,9 +36,11 @@ export interface VerificationIdentity {
     gate?: string;
     /** which verifier produced it: a battery gate row or an integration-tip row (own report, own forgiveness rule) */
     scope?: VerificationScope;
-    /** Checkout location is diagnostic metadata; equal trees share verdicts across worktrees. */
+    /** Checkout location is diagnostic metadata; build outputs additionally require an incarnation. */
     worktree?: string;
     tree: string;
+    /** Build success also promises local outputs, which die with the checkout. */
+    checkoutIncarnation?: string;
     command: string;
     baseline: string;
     environment: string;

package/dist/gates/cache.js

@@ -3,7 +3,7 @@ import { execSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
-import { describeCapacity, inventoryDependencyLinks, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
+import { checkoutIncarnation, describeCapacity, inventoryDependencyLinks, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
 import { shq } from "../adapters/types.js";
 export const DEFAULT_VERDICT_CACHE_BOUND = 128;
 let testCacheBound;
@@ -114,6 +114,9 @@ export async function computeVerificationIdentity(params) {
     const tree = params.tree ?? (await getWorktreeTree(params.worktree));
     if (!tree)
         return undefined;
+    const incarnation = params.gate === "build" ? checkoutIncarnation(params.worktree) : undefined;
+    if (params.gate === "build" && !incarnation)
+        return undefined;
     const baseline = baselineIdentity(params.baseline);
     const env = environmentFingerprint({
         worktree: params.worktree,
@@ -129,6 +132,7 @@ export async function computeVerificationIdentity(params) {
         scope: params.scope ?? "battery",
         worktree: realpathSync(params.worktree),
         tree,
+        ...(incarnation ? { checkoutIncarnation: incarnation } : {}),
         command: params.command,
         baseline,
         environment: env.fingerprint,
@@ -138,8 +142,10 @@ export async function computeVerificationIdentity(params) {
 export function verificationIdentityKey(id) {
     const cmdHash = createHash("sha256").update(id.command).digest("hex").slice(0, 16);
     const gate = id.gate ?? "gate";
-    // Checkout location is diagnostic only. Scope separates each verifier's evidence policy.
-    const workingTree = createHash("sha256").update(id.tree).digest("hex");
+    // Lint/test remain content-addressed. Builds also promise outputs in this physical checkout.
+    // Scope continues to separate each verifier's evidence policy.
+    const workingTree = createHash("sha256").update(id.tree)
+        .update(id.gate === "build" ? `\0checkout:${id.checkoutIncarnation ?? "unbound"}` : "").digest("hex");
     return `${id.scope ?? "battery"}-${gate}-${workingTree}-${cmdHash}-${id.baseline}-${id.environment}`;
 }
 export function formatReusedDetails(originalDetails, id) {
@@ -179,6 +185,7 @@ export function reusedIdentity(id) {
         gate: id.gate ?? "gate",
         scope: id.scope ?? "battery",
         tree: id.tree,
+        ...(id.checkoutIncarnation ? { checkoutIncarnation: id.checkoutIncarnation } : {}),
         ...(id.worktree ? { worktree: id.worktree } : {}),
         command: id.command,
         baseline: id.baseline,

package/dist/gates/llm.js

@@ -403,7 +403,10 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
                 // That seat was killed by its configured timeout, not an early launch reroute.
                 if (now - startedAt >= timeoutMs)
                     break;
-                if (reviewing && !firstLivenessObserved && now - startedAt >= REVIEW_FIRST_LIVENESS_MS) {
+                // OBS-1177: the beat is armed for an INTERACTIVE (pane) driver only. On the subprocess driver
+                // a headless `claude -p` buffers every byte until it exits, so 0 seat bytes at 30 s is not a
+                // dead launch; that seat keeps its full ceiling, which still bounds it (fail-closed by timeout).
+                if (reviewing && via.driver.interactive && !firstLivenessObserved && now - startedAt >= REVIEW_FIRST_LIVENESS_MS) {
                     firstLivenessObserved = true;
                     // RS-2: the beat reads seat-authored bytes ALONE. CPU evidence never holds a preamble-only
                     // capture open to the ceiling; a seat that has not written one byte of its own is re-routed.

package/dist/gates/review.js

@@ -8,7 +8,7 @@ import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { carryReviewFindings, observedReviewFingerprints, reviewFingerprintMatches, structuredFindings, UNIDENTIFIED } from "../run/journal.js";
 import { redactSecrets } from "../run/redact.js";
-import { marginalCostRank } from "../route/router.js";
+import { rankPreferredChannels, reviewPreferenceTieBreak } from "../route/role-pick.js";
 import { modelProvider } from "../route/preference.js";
 import { resolveStateDir } from "./cache.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, parseAnchoredComments, runLlmDetailed, verdictNonceLine } from "./llm.js";
@@ -227,13 +227,6 @@ export function isReviewClosureMismatch(v, priorIds) {
     const priors = priorIds instanceof Set ? priorIds : new Set(priorIds);
     return ids.some((id) => matchClosureId(id, priors) === undefined);
 }
-// v1.53 T2: same entry grammar as routing.map.prefer (router.ts preferIndex — router is out of this
-// module's dependency direction for a private fn, so the 3 lines live here too): `adapter` matches
-// every channel of that adapter, `adapter:model` exactly one; unmatched channels sort after all entries.
-function reviewPreferIndex(c, prefer) {
-    const i = prefer.findIndex((p) => p === c.adapter || p === channelKey(c));
-    return i === -1 ? prefer.length : i;
-}
 /**
  * RF-1 (OBS-922 add.2/3): the tier a reviewer must meet is the maximum of the author's tier, the
  * task-declared floor, a configured `review.floor` tier and, on a second round or a retry, the prior
@@ -290,7 +283,7 @@ excludeVendors = new Set(), authors = [channelKey(author)]) {
         return null;
     // RF-1: every caller inherits the author-tier floor — a reviewer is never seated below its author.
     const effectiveFloor = resolveReviewerFloor(author.tier, floor).floor;
-    const ranked = channels
+    const eligible = channels
         // Three independent axes: different vendor, different resolved provider identity (OBS-946: on initial pick
         // as well as failover, so an aggregator channel stamped "mixed" never seats the author's own provider),
         // and different base-model identity (ADDED TO the vendor rule, never replacing it). The diversity
@@ -300,8 +293,11 @@ excludeVendors = new Set(), authors = [channelKey(author)]) {
         && modelId(c.model) !== modelId(a.model))
         && !exclude.includes(channelKey(c))
         && !excludeVendors.has(c.vendor)
-        && TIER_RANK[c.tier] >= TIER_RANK[effectiveFloor])
-        .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b));
+        && TIER_RANK[c.tier] >= TIER_RANK[effectiveFloor]);
+    const ranked = rankPreferredChannels(eligible, prefer, {
+        includeUnpreferred: true,
+        tieBreak: reviewPreferenceTieBreak,
+    });
     const reviewer = [...ranked].sort((a, b) => Number(demoted.has(channelKey(a))) - Number(demoted.has(channelKey(b)))
         || history.lastIndexOf(channelKey(a)) - history.lastIndexOf(channelKey(b))
         || ranked.indexOf(a) - ranked.indexOf(b))[0] ?? null;

package/dist/gates/run-gates.d.ts

@@ -7,6 +7,7 @@ import { type GateVia } from "./llm.js";
 import { type PriorReviewer } from "./review.js";
 import type { GateResult } from "./types.js";
 import { type VerificationRetryCause } from "../run/recovery.js";
+import { type PreserveProducer } from "../run/git.js";
 import { type StructuredFinding } from "../run/journal.js";
 import { type VerificationScope } from "./cache.js";
 export type LoadProvider = () => number;
@@ -71,6 +72,9 @@ export interface GateContext {
     /** Explicit worker funding requires fresh red measurements, never a gate waiver. */
     cachedRedBypass?: "operator-rerun";
     carriedAuthors?: readonly string[];
+    /** The attempt whose worker last wrote the gated checkout; a dirty-tree refusal stamps it on the
+     * preserve commit and its row. Absent (standalone verify, gate-only restores) preserves as "unknown". */
+    producer?: PreserveProducer;
     reviewHistory?: string[];
     priorReviewers?: PriorReviewer[];
     artifactDir?: string;

package/dist/gates/run-gates.js

@@ -17,7 +17,7 @@ import { scopeGate } from "./scope.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "./test-manifest.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { failureDisposition } from "../run/recovery.js";
-import { dependencyLinkRefusal, preserveWorktree, shGit, resolvedCapacity, verificationProtocol } from "../run/git.js";
+import { dependencyLinkRefusal, preserveWorktree, producerFields, shGit, resolvedCapacity, verificationProtocol } from "../run/git.js";
 import { withJudgeInvocationEvidence } from "../run/journal.js";
 import { computeVerificationIdentity, verificationIdentityKey, formatReusedRow, getVerdictStore, isInfraResult, resolveStateDir, reusedIdentity, } from "./cache.js";
 const productionLoadProvider = () => loadavg()[0] ?? 0;
@@ -223,6 +223,7 @@ async function runVitestManifestGate(worktree, cmd, baseline, selected, artifact
         overallCeilingMs: effectiveCeilingMs(entry),
         artifactDir,
         evidence: retry.evidence,
+        retryBaseCommand: retry.retryBaseCommand, // OBS-1166: the un-narrowed command for a selected screen's stranded retry
     });
     const reportPath = outcome.reportPath;
     const evidence = { evidenceReceipt: outcome.evidenceReceipt, evidenceReceipts: outcome.evidenceReceipts };
@@ -482,7 +483,7 @@ export async function runGates(task, ctx) {
         let preservedRef;
         let preservationError;
         try {
-            preservedRef = await preserveWorktree(ctx.worktree);
+            preservedRef = await preserveWorktree(ctx.worktree, ctx.producer);
         }
         catch (error) {
             // Never masks the refusal, but never pretends a snapshot exists either — surfaced below.
@@ -537,6 +538,7 @@ export async function runGates(task, ctx) {
             dirtyWorktree: true,
             ref: preservedRef,
             preservedRef,
+            ...producerFields(ctx.producer),
             paths: dirtyPaths,
             files: dirtyPaths,
             path: primaryFile,
@@ -583,7 +585,7 @@ export async function runGates(task, ctx) {
         let preservedRef;
         let preservationError;
         try {
-            preservedRef = await preserveWorktree(ctx.worktree);
+            preservedRef = await preserveWorktree(ctx.worktree, ctx.producer);
         }
         catch (error) {
             preservationError = error instanceof Error ? error.message : String(error);
@@ -614,6 +616,7 @@ export async function runGates(task, ctx) {
                 dirtyAtRoundEnd: true,
                 ref: preservedRef,
                 preservedRef,
+                ...producerFields(ctx.producer),
                 paths: dirtyPaths,
                 files: dirtyPaths,
                 path: primaryFile,
@@ -677,7 +680,7 @@ export async function runGates(task, ctx) {
                     // other scripted test command keeps today's exit-code contract byte-identically.
                     const useManifest = g === "test" && commands.test !== undefined && isVitestTestCommand(commands.test, ctx.worktree);
                     r = useManifest
-                        ? await measure(g, () => runVitestManifestGate(ctx.worktree, commands.test, ctx.baseline, selected, ctx.artifactDir, { ...retryOptions(identity), evidence }))
+                        ? await measure(g, () => runVitestManifestGate(ctx.worktree, commands.test, ctx.baseline, selected, ctx.artifactDir, { ...retryOptions(identity), evidence, ...(selected ? { retryBaseCommand: ctx.commands.test } : {}) }))
                         : (await measure(g, () => compareToBaseline(ctx.worktree, commands, ctx.baseline, [g], { ...retryOptions(identity), evidence, ...(g === "build" ? { onReceipt: buildReceipt, taskBuildAttribution: beginBuild } : {}), ...(g === "test" && selected ? { selected } : {}) })))[0];
                 }
                 finally {

package/dist/gates/test-manifest.d.ts

@@ -1,5 +1,7 @@
 import { type GateEvidenceOptions, type BaselineFileDuration } from "./baseline.js";
 import type { GateEvidenceReceipt } from "../run/protocol.js";
+export declare const VITEST_CACHE_ENV = "TICKMARKR_VITEST_CACHE_DIR";
+export declare function worktreeVitestCache(cwd: string, inherited?: string): string;
 export declare function isVitestTestCommand(cmd: string, cwd: string): boolean;
 /** One identity for every path this module compares: repo-relative, forward-slash. `vitest list
  * --json` and `TestModule.moduleId` both hand back an absolute filesystem path already resolved
@@ -144,6 +146,13 @@ export declare function discoverTestManifest(cmd: string, cwd: string, opts: {
  * runner cannot list (a null compares nothing — it never manufactures a deficit). The suite is not
  * run here; the capture already ran it once. */
 export declare function manifestFileCount(cmd: string, cwd: string): Promise<number | null>;
+/** The stranded single-fork retry: positional filters are substring matches that OR with any filter
+ * the command already carries, and under a `projects` config the CLI `--exclude` never subtracts such a
+ * selection (OBS-1166: a selected screen's retry rediscovered the whole selection and refused). So the
+ * retry is built from the UN-narrowed base command, its own `--` rule, the stranded files as the only
+ * positional filters, and an `--exclude` of every completed file; the caller then requires discovery
+ * to prove the exact retry set before launch. */
+export declare function singleForkRetryCommand(base: string, cwd: string, stranded: readonly string[], completed: readonly string[]): string;
 /** One configured runner execution, and its own collection under the same arguments and environment.
  * The installed runner is trusted (R28 add.1 option B); the nonce catches stale artifacts, not forgery. */
 export declare function evaluateManifestedTest(cmd: string, cwd: string, opts: {
@@ -152,4 +161,7 @@ export declare function evaluateManifestedTest(cmd: string, cwd: string, opts: {
     overallCeilingMs?: number;
     artifactDir?: string;
     evidence?: GateEvidenceOptions;
+    /** OBS-1166: the configured command BEFORE a selected screen narrowed it, so a stranded retry's
+     * only positional filters are the stranded files. Absent (a full suite), `cmd` is that command. */
+    retryBaseCommand?: string;
 }): Promise<ManifestGateOutcome>;

package/dist/gates/test-manifest.js

@@ -1,11 +1,20 @@
 import { createHash, randomBytes } from "node:crypto";
-import { existsSync, mkdtempSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute, join, relative, sep } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { TEST_REPORTER_SOURCE } from "./test-reporter.js";
 import { shq } from "../adapters/types.js";
 import { beginGateEvidence, redactGateOutput } from "./baseline.js";
 import { FORK_CAP_ENV, ROUTING_ENV_SEAMS, SUITE_PARENT_ENV, shell, resolvedCapacity, verificationProtocol } from "../run/git.js";
+// Outside the shared dependency symlink and ignored by the shipped repository.
+export const VITEST_CACHE_ENV = "TICKMARKR_VITEST_CACHE_DIR";
+export function worktreeVitestCache(cwd, inherited) {
+    const local = resolve(cwd, ".vitest-cache");
+    const candidate = inherited ? resolve(cwd, inherited) : local;
+    const within = relative(local, candidate);
+    return within === "" || (!isAbsolute(within) && within !== ".." && !within.startsWith(`..${sep}`))
+        ? candidate : local;
+}
 /**
  * VL-1 (OBS-985 lineage): a test gate's completion must be the runner's OWN report, never a stdout
  * count. `fileCountDeficit` (baseline.ts) reads a summary LINE — a selected screen's smaller count
@@ -387,6 +396,7 @@ export function runManifestedTest(cmd, cwd, opts) {
  * verdict measured with `pretest` hooks is never compared to one without. */
 function manifestEnvironment(cwd) {
     const env = { ...process.env, PATH: `${join(cwd, "node_modules/.bin")}:${process.env.PATH ?? ""}`,
+        [VITEST_CACHE_ENV]: worktreeVitestCache(cwd),
         [FORK_CAP_ENV]: String(resolvedCapacity().forkCap), [SUITE_PARENT_ENV]: String(process.pid) };
     const verification = verificationProtocol(env, cwd);
     for (const key of ROUTING_ENV_SEAMS)
@@ -436,6 +446,9 @@ export async function manifestFileCount(cmd, cwd) {
     catch {
         return null;
     }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    } // OBS-1155: the listing directory is the capture's alone, listed or not
 }
 /** Vitest's forks pool awaits the parallel phase, then throws before the single-fork phase
  * on any rejected worker. Recover only that exact, fully accounted-for boundary. */
@@ -474,6 +487,16 @@ function strandedSingleForkFiles(files, nonce, run) {
         return;
     return single;
 }
+/** The stranded single-fork retry: positional filters are substring matches that OR with any filter
+ * the command already carries, and under a `projects` config the CLI `--exclude` never subtracts such a
+ * selection (OBS-1166: a selected screen's retry rediscovered the whole selection and refused). So the
+ * retry is built from the UN-narrowed base command, its own `--` rule, the stranded files as the only
+ * positional filters, and an `--exclude` of every completed file; the caller then requires discovery
+ * to prove the exact retry set before launch. */
+export function singleForkRetryCommand(base, cwd, stranded, completed) {
+    const excluded = completed.map(f => `--exclude=${shq(f.replace(/[\\*?[\]{}()!+@]/g, "\\$&"))}`).join(" ");
+    return `${base}${runnerInvocation(base, cwd).separator} ${stranded.map(f => shq(join(cwd, f))).join(" ")} ${excluded}`;
+}
 /** One configured runner execution, and its own collection under the same arguments and environment.
  * The installed runner is trusted (R28 add.1 option B); the nonce catches stale artifacts, not forgery. */
 export async function evaluateManifestedTest(cmd, cwd, opts) {
@@ -518,10 +541,7 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
             recovery = { firstNonce: nonce, firstReportPath: reportPath, retryNonce, files: stranded };
             nonce = retryNonce;
             reportPath = join(dir, `test-manifest-report-${nonce}.json`);
-            // Positional filters are substring matches (and OR with existing filters). Exclude every
-            // completed file as well, then require discovery to prove the exact retry set before launch.
-            const excluded = files.filter(f => !stranded.includes(f)).map(f => `--exclude=${shq(f.replace(/[\\*?[\]{}()!+@]/g, "\\$&"))}`).join(" ");
-            const retryCommand = `${cmd}${invocation.separator} ${stranded.map(f => shq(join(cwd, f))).join(" ")} ${excluded}`;
+            const retryCommand = singleForkRetryCommand(opts.retryBaseCommand ?? cmd, cwd, stranded, files.filter(f => !stranded.includes(f)));
             const listed = await discoverTestManifest(retryCommand, cwd, { dir, nonce, env,
                 overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } });
             evidenceReceipts.push(...listed.evidenceReceipts);

package/dist/graph/graph.d.ts

@@ -36,8 +36,12 @@ export declare function addEvidence(g: RunGraph, id: string, patch: {
     gateResults?: unknown[];
 }): RunGraph;
 export declare function chainDepth(g: RunGraph): Map<string, number>;
-export declare function readyTasks(g: RunGraph): Task[];
-export declare function dispatchWaves(g: RunGraph, concurrency: number): Map<string, number>;
+export declare function readyTasks(g: RunGraph, prioritized?: ReadonlySet<string>): Task[];
+export declare function batteryPriority(actions: Iterable<{
+    taskId: string;
+    authority: string;
+}>): Set<string>;
+export declare function dispatchWaves(g: RunGraph, concurrency: number, prioritized?: ReadonlySet<string>): Map<string, number>;
 export declare function isComplete(g: RunGraph): boolean;
 export declare function isStalled(g: RunGraph): boolean;
 export declare function closureReaches(g: RunGraph, taskId: string, pred: (t: Task) => boolean): boolean;

package/dist/graph/graph.js

@@ -191,21 +191,32 @@ export function chainDepth(g) {
 // OBS-1018: admission is critical-path order — deepest chain root first, ties in declaration order.
 // The daemon's dispatch loop slices this list unchanged. Stated limit: resume-restore of previously
 // in-flight attempts keeps its own precedence (src/run/daemon.ts); only fresh admission is ordered here.
-export function readyTasks(g) {
+// OBS-1158: `prioritized` names tasks holding a pending battery (recheck) approval. Among READY tasks
+// of equal depth an approved recheck precedes fresh work; deeper fresh work keeps its rank, and a
+// recheck that is not ready (dependency-blocked) is not admitted at all, so it gains nothing here.
+export function readyTasks(g, prioritized = NO_PRIORITY) {
     const done = new Set(g.tasks.filter((t) => t.status === "done").map((t) => t.id));
     const depth = chainDepth(g);
+    const rank = (t) => (prioritized.has(t.id) ? 1 : 0);
     return g.tasks
         .filter((t) => t.status === "pending" && t.deps.every((d) => done.has(d)))
-        .sort((a, b) => depth.get(b.id) - depth.get(a.id)); // Array#sort is stable: equal depths keep declaration order
+        .sort((a, b) => depth.get(b.id) - depth.get(a.id) || rank(b) - rank(a)); // Array#sort is stable: remaining ties keep declaration order
+}
+const NO_PRIORITY = new Set();
+// OBS-1158: the one seam plan and the daemon share for battery priority — journal approval actions
+// in (src/run/journal.ts pendingApprovalActions), the ids whose pending authority is `battery` out.
+// Waivers, worker-funding approvals and inert releases never qualify; a consumed approval is absent.
+export function batteryPriority(actions) {
+    return new Set([...actions].filter((a) => a.authority === "battery").map((a) => a.taskId));
 }
 // OBS-1018: the dispatch wave each pending task would enter at `concurrency` slots if every wave
 // took one tick — computed by draining readyTasks, so plan and daemon can never disagree on order.
 // Tasks already past pending carry no wave.
-export function dispatchWaves(g, concurrency) {
+export function dispatchWaves(g, concurrency, prioritized = NO_PRIORITY) {
     const waves = new Map();
     let sim = g;
     for (let wave = 1;; wave++) {
-        const batch = readyTasks(sim).slice(0, Math.max(1, concurrency));
+        const batch = readyTasks(sim, prioritized).slice(0, Math.max(1, concurrency));
         if (!batch.length)
             return waves;
         for (const t of batch) {

package/dist/route/role-pick.d.ts

@@ -0,0 +1,16 @@
+import { type AuthHealth, type BillingChannel, type WorkerAdapter } from "../adapters/types.js";
+import { type TickmarkrConfig } from "../config/config.js";
+import type { PreferenceRole } from "./preference.js";
+export { preferIndex, rankPreferredChannels, reviewPreferenceTieBreak } from "./router.js";
+export type RolePick = {
+    ok: true;
+    channel: BillingChannel;
+} | {
+    ok: false;
+    reason: "missing-prefer" | "no-eligible-preferred-channel";
+};
+/** Strict role selection: no task, author, pin, or default seat is invented. */
+export declare function pickRole(role: PreferenceRole, cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>, opts?: {
+    excludeVendors?: ReadonlySet<string>;
+    eligible?: (channel: BillingChannel) => boolean;
+}): RolePick;