tickmarkr 2.6.0 → 2.6.2

package/dist/cli/commands/status.js

@@ -8,10 +8,11 @@ import { formatOwnedName, parseOwnedName, } from "../../drivers/types.js";
 import { blockedTasks, graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { projectActivity } from "../../run/activity.js";
+import { authorsNote, doneAuthors } from "../../run/operator-state.js";
 import { projectOperatorSummary } from "../../run/operator-summary.js";
 import { trackJournalRows } from "../../run/protocol.js";
 import { newestPark, permittedDecisionVerbs } from "./approve.js";
-import { Journal, formatJournalNarration, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, } from "../../run/journal.js";
+import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, } from "../../run/journal.js";
 import { isPidLive, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
@@ -166,7 +167,7 @@ export const decisionEventsFromJournal = (events, runId, stateDir = ".tickmarkr"
                 ...base,
                 type: "human-decision-required",
                 tier: "decision",
-                approvalCommand: `tickmarkr approve ${runId} ${event.taskId}`,
+                approvalCommand: `tickmarkr approve ${runId} ${event.taskId} --park ${bindingToken({ line: physicalLine(events, index), ts: event.ts })}`,
                 ...(typeof event.data.kind === "string" ? { kind: event.data.kind } : {}),
                 ...(typeof event.data.reason === "string" ? { reason: event.data.reason } : {}),
             }];
@@ -840,18 +841,6 @@ const statusEngagement = (events, loadedHash) => {
     }
     return { comparable: true };
 };
-// The journal's own reader rule (src/run/journal.ts readJsonl), applied to bytes already in hand:
-// skip blanks, drop a line that will not parse (a torn trailing write after a crash), keep the rest.
-const parseJournalSnapshot = (raw) => raw.split("\n").flatMap((line) => {
-    if (!line.trim())
-        return [];
-    try {
-        return [JSON.parse(line)];
-    }
-    catch {
-        return [];
-    }
-});
 // runLockOwner is the single lock payload/liveness reader. Its current path helper also initializes
 // .tickmarkr metadata; an engine-written lock necessarily passed through that initializer already, so
 // status avoids invoking it in stripped reader-purity fixtures where no engine lock can exist.
@@ -891,7 +880,7 @@ const readRunRecord = (cwd, graph, namedRunId) => {
     if (!runId)
         return undefined;
     const raw = readRunJournalRaw(cwd, runId, lockedRunId === runId);
-    const events = parseJournalSnapshot(raw);
+    const events = parseJournalText(raw);
     // The resume comparator is the fail-closed baseline; a matching graph-rehash is the daemon's
     // append-only audit that authorizes this status replay after stop-amend-resume.
     const engagement = statusEngagement(events, graphDefinitionHash(graph));
@@ -917,7 +906,8 @@ const recordTaskRows = (record, graph, isDaemonAlive) => record.comparable && re
 const recordProjection = (record, graph, isDaemonAlive) => {
     const rows = record ? recordTaskRows(record, graph, isDaemonAlive) : new Map();
     const events = record?.comparable ? record.events : [];
-    const activity = projectActivity(record?.runId ?? "", trackJournalRows(record?.runId ?? "", events.map((raw, sourceIndex) => ({ raw, sourceIndex }))), graph.tasks);
+    // OBS-1178: a refused or unsound decision released nothing, so the activity fold never reads it.
+    const activity = projectActivity(record?.runId ?? "", trackJournalRows(record?.runId ?? "", effectiveEvents(events).map((raw, sourceIndex) => ({ raw, sourceIndex }))), graph.tasks);
     const tasks = graph.tasks.map(task => {
         const row = rows.get(task.id);
         const evidence = events.filter(event => event.taskId === task.id);
@@ -988,6 +978,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
     const comparable = record?.comparable ?? false;
     const rehashAt = record?.rehashAt;
     const assignments = new Map();
+    const authorsByTask = new Map();
     const contexts = new Map();
     // v1.53 T5: this run is dead — a newer run replaced it
     const supersededBy = [...events].reverse()
@@ -1000,6 +991,11 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
                     assignments.set(e.taskId, `${a.adapter}:${a.model}`);
                 }
             }
+            if (e.event === "task-done" && e.taskId) {
+                const authors = doneAuthors(e.data);
+                if (authors)
+                    authorsByTask.set(e.taskId, authors);
+            }
             if (e.event === "context-sample" && e.taskId && typeof e.data.tokens === "number" && Number.isFinite(e.data.tokens)) {
                 contexts.set(e.taskId, e.data.tokens); // last write wins
             }
@@ -1061,12 +1057,28 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
     // OBS-738: recovery facts stay on the journal's two established reducers. The prefix fold keeps an
     // older journal equally readable by asking upheldFeedbackByTask what was active at that exact
     // restore boundary; current resume-restore rows additionally carry the same task for narration.
+    // OBS-1178: both folds read decisions through the one decision fold over the whole journal.
+    const decided = effectiveEvents(events);
     const preservedRefs = preservedRefsByTask(events);
-    const restoredUpheldFeedback = new Set(events.flatMap((event, index) => event.event === "resume-restore" && event.taskId
-        && upheldFeedbackByTask(events.slice(0, index)).has(event.taskId)
+    const restoredUpheldFeedback = new Set(decided.flatMap((event, index) => event.event === "resume-restore" && event.taskId
+        && upheldFeedbackByTask(decided.slice(0, index)).has(event.taskId)
         ? [event.taskId]
         : []));
+    // OBS-1178: a failed task's newest task-failed row is the token its recheck binds to. Only an
+    // effective decision consumes it — a refused or unsound recheck leaves the task failed and the token shown.
+    const failureTokens = new Map();
+    decided.forEach((event, index) => {
+        if (!event.taskId || !["task-dispatch", "task-done", "task-failed", "task-human", "task-approved"].includes(event.event))
+            return;
+        if (event.event === "task-failed")
+            failureTokens.set(event.taskId, bindingToken({ line: physicalLine(decided, index), ts: event.ts }));
+        else
+            failureTokens.delete(event.taskId);
+    });
     const recoveryLinesForTask = (taskId) => [
+        ...(failureTokens.has(taskId) && runId
+            ? [`failed — ${taskId} — failure ${failureTokens.get(taskId)} — re-gate landed work with \`tickmarkr approve ${runId} ${taskId} --recheck --park ${failureTokens.get(taskId)}\``]
+            : []),
         ...(preservedRefs.get(taskId) ?? []).flatMap(({ ref, diffCommand }) => [
             `preserved worktree — ${taskId} — ${ref}`,
             `  ${diffCommand}`,
@@ -1106,12 +1118,14 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
         const label = isStarved ? " starved" : phrase ? ` ${phrase}` : "";
         const channel = journalRowsOnly ? folded?.actor ?? "-" : assignments.get(t.id) ?? "-";
         const ctx = contexts.get(t.id);
-        const assignCol = ctx !== undefined ? `${channel}${divider}ctx ${ctx}` : channel;
+        // Merged authors are their own fact beside the last dispatch: a carry-only seat authored nothing.
+        const authors = authorsNote(authorsByTask.get(t.id), channel);
+        const assignCol = [channel, ctx !== undefined ? `ctx ${ctx}` : "", authors ?? ""].filter(Boolean).join(divider);
         const gates = comparable
             ? gateSnapshot(t, events, rehashAt)
             : { states: defaultGateStates(t), priorGraph: false };
         const pane = panes.get(t.id);
-        return { t, st, merged, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, livePhase, pane, summary, ...gates };
+        return { t, st, merged, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, authors, livePhase, pane, summary, ...gates };
     });
     if (!unicode) {
         // Keep the machine task-title columns intact; projection details occupy their own line.
@@ -1215,7 +1229,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
     }).join("");
     const gateHeader = GATE_NAMES.map((gate) => fitCells(gate.slice(0, 2), 3)).join("");
     const noteFor = (cell) => {
-        const { t, st, merged, failureKind, redTier, states, priorGraph, isStarved, phrase, ctx, livePhase, pane } = cell;
+        const { t, st, merged, failureKind, redTier, states, priorGraph, isStarved, phrase, ctx, livePhase, pane, authors } = cell;
         const effort = effortByTask.get(t.id);
         const blocking = graphTaskStatus(st, t.status) === "done" ? [] : dependents.get(t.id) ?? [];
         const failed = failedGates(states);
@@ -1242,6 +1256,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
             blocking.length ? `blocks ${blocking.join(", ")}` : "",
             pane ? `pane ${pane}` : "",
             ctx !== undefined ? `ctx ${ctx}` : "",
+            authors ?? "",
         ].filter(Boolean).join(" · ");
     };
     const staleWorker = (cell) => cell.livePhase?.phase === "worker"
@@ -1491,7 +1506,7 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
             decisionRunId = runId;
             journalCursor = 0;
         }
-        const journalEvents = parseJournalSnapshot(readRunJournalRaw(cwd, runId, lockedRunId === runId));
+        const journalEvents = parseJournalText(readRunJournalRaw(cwd, runId, lockedRunId === runId));
         if (journalEvents.length < journalCursor)
             journalCursor = 0;
         const fresh = decisionEventsFromJournal(journalEvents, runId, stateDirName(cwd))

package/dist/cli/help.d.ts

@@ -39,6 +39,8 @@ export declare const COMMAND_HELP: {
         usage: string;
         description: string;
         options: {
+            "--pick <role>": string;
+            "--exclude-vendor <vendor>": string;
             "--print": string;
             "--why": string;
             "--global-dir <path>": string;
@@ -161,6 +163,8 @@ export declare const COMMAND_HELP: {
         usage: string;
         description: string;
         options: {
+            "--park <line>@<ts>": string;
+            "--gate <gate>": string;
             "--files <glob,\u2026>": string;
             "--by <name>": string;
             "--reason <text>": string;

package/dist/cli/help.js

@@ -30,6 +30,8 @@ export const COMMAND_HELP = {
     fleet: {
         usage: "fleet [options]", description: "Edit fleet configuration interactively, or print it for scripts.",
         options: {
+            "--pick <role>": "Resolve one role preference as JSON without launching a seat (review or consult; roles without prefer refuse).",
+            "--exclude-vendor <vendor>": "Exclude a vendor from --pick; repeat for multiple vendors.",
             "--print": "Print fleet configuration without opening the editor.",
             "--why": "Include routing eligibility explanations in printed output.",
             "--global-dir <path>": "Use this global configuration directory.",
@@ -129,14 +131,21 @@ export const COMMAND_HELP = {
     approve: {
         usage: "approve <run-id> <task-id> [options]", description: "Append a validated park decision. A running owner may enact it; a closed run requires a separate resume. Decisions cannot be undone.",
         options: {
+            "--park <line>@<ts>": "Bind the decision to the park token status prints (a failed task's recheck binds its failure token); refused once a newer park opens.",
+            "--gate <gate>": "Bind a waive to the park's failed gate; refused when the park failed another gate.",
             "--files <glob,…>": "Extend files[] for a scope-request park with comma-separated repository-relative globs; required for scope approval.",
             "--by <name>": "Name the actor (default: current OS user).",
             "--reason <text>": "Record the decision reason.",
             "--waive": "Waive only the identified failed gate.",
             "--uphold": "Uphold a review failure and fund a fixed attempt.",
             "--recheck": "Request rechecking an infra or failed-gate park; satisfies no gate.",
-            "--review-rounds <N>": "Set a positive integer review-round ceiling with the decision.",
-        }, examples: ["approve run-example T1 --by operator --reason 'ready to proceed'", "approve run-example T1 --recheck --reason 'infra recovered'"],
+            "--review-rounds <N>": "Set a positive integer review-round ceiling that binds only this approval engagement; a later approval without --review-rounds restores the built-in default.",
+        }, examples: [
+            "approve run-example T1 --park 42@2026-09-26T08:00:00.000Z --by operator --reason 'ready to proceed'",
+            "approve run-example T1 --waive --park 42@2026-09-26T08:00:00.000Z --gate review",
+            "approve run-example T1 --recheck --park 42@2026-09-26T08:00:00.000Z --reason 'infra recovered'",
+            "approve run-example T3 --recheck --park 57@2026-09-26T08:05:00.000Z --reason 'failed task: re-gate its landed commits'",
+        ],
     },
     beat: {
         usage: "beat <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> [options]",

package/dist/config/config.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { type Effort } from "../graph/schema.js";
 declare const TierEnum: z.ZodEnum<{
     cheap: "cheap";
     mid: "mid";
@@ -41,6 +42,7 @@ export declare const MapEntrySchema: z.ZodObject<{
     escalate: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type MapEntry = z.infer<typeof MapEntrySchema>;
+export declare const EFFORT_ADAPTERS: readonly ["claude-code", "codex"];
 export declare const TierEntrySchema: z.ZodObject<{
     vendor: z.ZodNullable<z.ZodString>;
     channel: z.ZodEnum<{
@@ -58,6 +60,11 @@ export declare const TierEntrySchema: z.ZodObject<{
             sub: "sub";
             api: "api";
         }>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
     }, z.core.$strip>>>;
     windows: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
 }, z.core.$strip>;
@@ -274,6 +281,11 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
                 sub: "sub";
                 api: "api";
             }>>;
+            effort: z.ZodOptional<z.ZodEnum<{
+                low: "low";
+                medium: "medium";
+                high: "high";
+            }>>;
         }, z.core.$strip>>>;
         windows: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
     }, z.core.$strip>>;
@@ -383,6 +395,12 @@ export declare function loadConfigWithMode(repoRoot: string, opts?: {
     cfg: TickmarkrConfig;
     mode: ModeResolution;
 };
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
+ *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
+ *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited. */
+export declare function lowerLayerModelOverrides(opts?: {
+    globalDir?: string;
+}): Record<string, Record<string, Record<string, unknown>>>;
 export declare function loadConfig(repoRoot: string, opts?: {
     globalDir?: string;
 }): TickmarkrConfig;
@@ -416,6 +434,8 @@ export type FleetEditable = Partial<Record<DenyScopeKey, string[]>> & {
     denyModels: string[];
     allowOut?: string[];
     tiers: Record<string, Record<string, FleetTierAssignment | null>>;
+    /** OBS-1182: tiers.<adapter>.modelOverrides.<model>.effort — absent = CLI default; present only when one is set */
+    efforts?: Record<string, Record<string, Effort>>;
     map: Record<string, MapEntry>;
     floors: Record<string, Tier>;
 };

package/dist/config/config.js

@@ -2,11 +2,11 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
-import { Document, parse } from "yaml";
+import { Document, isScalar, parse } from "yaml";
 import { z } from "zod";
 import { CITED_MODEL_WINDOWS } from "../adapters/model-windows.js";
 import { stateDirName } from "../graph/graph.js";
-import { SHAPES, TIERS } from "../graph/schema.js";
+import { EFFORTS, SHAPES, TIERS } from "../graph/schema.js";
 const TierEnum = z.enum(TIERS, {
     error: (iss) => `Invalid option: expected one of "cheap"|"mid"|"frontier" (got ${JSON.stringify(iss.input)})`,
 });
@@ -51,21 +51,32 @@ export const MapEntrySchema = z.object({
     escalate: z.boolean().optional(),
 });
 const DeclaredVendorSchema = z.string().trim().min(1, "vendor must be nonempty");
-const ModelOverrideSchema = z
+// OBS-1182: effort is launch metadata only these CLIs accept (claude --effort, codex -c
+// model_reasoning_effort=). Every other adapter's override refuses the key outright, so config
+// load and the emitted JSON schema both reject an effort that could never be launched.
+export const EFFORT_ADAPTERS = ["claude-code", "codex"];
+const EffortEnum = z.enum(EFFORTS, {
+    error: (iss) => `Invalid effort: expected one of "low"|"medium"|"high" (got ${JSON.stringify(iss.input)})`,
+});
+const NoEffort = z.never({
+    error: () => `effort is launch metadata only ${EFFORT_ADAPTERS.join(" and ")} accept — this adapter's CLI takes no effort level`,
+});
+const modelOverrideSchema = (effort) => z
     .object({
     vendor: DeclaredVendorSchema.optional(),
     channel: z.enum(["sub", "api"]).optional(),
+    effort: effort.optional(),
 })
-    .refine((override) => override.vendor !== undefined || override.channel !== undefined, {
-    message: "a model override must declare vendor, channel, or both",
+    .refine((override) => override.vendor !== undefined || override.channel !== undefined || override.effort !== undefined, {
+    message: "a model override must declare vendor, channel, effort, or a combination",
 });
-export const TierEntrySchema = z.object({
+const tierEntrySchema = (effort) => z.object({
     vendor: DeclaredVendorSchema.nullable(),
     channel: z.enum(["sub", "api"]),
     models: z.record(z.string(), TierEnum),
     // T19: keep model values scalar for existing consumers. Optional sibling metadata resolves before
     // parent metadata in channelsFromConfig; neither provider prefixes nor adapter ids manufacture it.
-    modelOverrides: z.record(z.string(), ModelOverrideSchema).optional(),
+    modelOverrides: z.record(z.string(), modelOverrideSchema(effort)).optional(),
     // v1.47 T3: optional per-model context-window sizes (tokens). Absent block ⇒ no doctor column, no plan lint.
     windows: z.record(z.string(), z.number().int().positive()).optional(),
 }).superRefine((entry, ctx) => {
@@ -81,6 +92,13 @@ export const TierEntrySchema = z.object({
         });
     }
 });
+export const TierEntrySchema = tierEntrySchema(EffortEnum);
+// Per-adapter object + catchall rather than a record, so the emitted JSON schema carries the same
+// adapter restriction as the loader; typed as the record every consumer already reads.
+// ponytail: catchall parses the EFFORT_ADAPTERS keys first — the seed table already lists them first.
+const TiersSchema = z
+    .object(Object.fromEntries(EFFORT_ADAPTERS.map((id) => [id, TierEntrySchema.optional()])))
+    .catchall(tierEntrySchema(NoEffort));
 // v1.10 FLEET-06: optional routing.allow/deny fleet preference; absent blocks ⇒ byte-identical routing/discovery.
 // deny wins on conflict; presence of allow (even {} / empty arrays) activates allowlist (fail-closed).
 const PrefBlockSchema = z.object({
@@ -372,7 +390,7 @@ export const TickmarkrConfigSchema = z.object({
         allow: PrefBlockSchema.optional(),
         deny: DenyBlockSchema.optional(),
     }),
-    tiers: z.record(z.string(), TierEntrySchema),
+    tiers: TiersSchema,
     pricing: z.record(z.string(), z.number()),
     // v1.20 REC-02: optional detailed price table for cost estimation. Distinct from `pricing` above
     // (the coarse per-task tier estimate `tickmarkr plan` shows) — this one drives the usage/cost report.
@@ -798,6 +816,15 @@ export function loadConfigWithMode(repoRoot, opts = {}) {
     assertSeededModelWindows();
     return { cfg: r.data, mode: resolveRoutingMode(r.data, [globalCfg, repoCfg]) };
 }
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
+ *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
+ *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited. */
+export function lowerLayerModelOverrides(opts = {}) {
+    const isMap = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    const merged = deepMerge(structuredClone(DEFAULT_CONFIG), readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml")));
+    const tiers = isMap(merged) && isMap(merged.tiers) ? merged.tiers : {};
+    return Object.fromEntries(Object.entries(tiers).map(([adapter, entry]) => [adapter, Object.fromEntries(Object.entries(isMap(entry) && isMap(entry.modelOverrides) ? entry.modelOverrides : {}).filter(([, o]) => isMap(o)))]));
+}
 export function loadConfig(repoRoot, opts = {}) {
     return loadConfigWithMode(repoRoot, opts).cfg;
 }
@@ -959,10 +986,14 @@ export function universeCovers(universe, entry) {
 // Absent universe ⇒ deny arrays verbatim and no allowOut, so non-UI callers stay byte-identical.
 export function fleetEditableFromConfig(cfg, universe) {
     const tiers = {};
+    const efforts = {};
     for (const [adapter, entry] of Object.entries(cfg.tiers)) {
         tiers[adapter] = {};
         for (const [model, tier] of Object.entries(entry.models)) {
             tiers[adapter][model] = { tier };
+            const effort = entry.modelOverrides?.[model]?.effort;
+            if (effort)
+                (efforts[adapter] ??= {})[model] = effort;
         }
     }
     // every enumerated deny scope rides verbatim (sorted) under its own key
@@ -991,6 +1022,7 @@ export function fleetEditableFromConfig(cfg, universe) {
         ...denyLists,
         ...(allowOut !== undefined ? { allowOut } : {}),
         tiers,
+        ...(Object.keys(efforts).length ? { efforts } : {}),
         map: structuredClone(cfg.routing.map),
         floors: { ...cfg.routing.floors },
     };
@@ -1037,6 +1069,13 @@ export function formatFleetPrint(repoRoot, opts = {}) {
     for (const [adapter, entry] of Object.entries(effective.tiers)) {
         for (const model of Object.keys(entry.models))
             annotate(["tiers", adapter, "models", model]);
+        // OBS-1182: the effort value prints in place; its note names the layer that set it and the edit
+        for (const [model, override] of Object.entries(entry.modelOverrides ?? {})) {
+            const path = ["tiers", adapter, "modelOverrides", model, "effort"];
+            const node = doc.getIn(path, true);
+            if (override.effort && isScalar(node))
+                node.comment = ` ${fleetKeyLayer(repoRoot, path.join("."), opts)} — fleet e edits`;
+        }
     }
     return String(doc);
 }

package/dist/config/fleet-overlay.d.ts

@@ -20,6 +20,7 @@ export type FleetOverlayWrite = {
         };
     };
     universe?: FleetUniverseRow[];
+    lowerOverrides?: Record<string, Record<string, Record<string, unknown>>>;
 };
 export type FleetFirstTouch = {
     vendor: string;

package/dist/config/fleet-overlay.js

@@ -360,6 +360,62 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 setScalarPreservingComment(doc, path, after.tier, unpackFleetProvenance(after.provenance).provenance);
         }
     }
+    // OBS-1182: effort lands in tiers.<adapter>.modelOverrides.<model>.effort — the scalar tier and
+    // every sibling override key (vendor, channel) keep their bytes.
+    const efforts = (e) => e.efforts ?? {};
+    for (const adapter of new Set([...Object.keys(efforts(initial)), ...Object.keys(efforts(edited))])) {
+        for (const model of new Set([...Object.keys(efforts(initial)[adapter] ?? {}), ...Object.keys(efforts(edited)[adapter] ?? {})])) {
+            const after = efforts(edited)[adapter]?.[model];
+            if (efforts(initial)[adapter]?.[model] === after)
+                continue;
+            const override = ["tiers", adapter, "modelOverrides", model];
+            if (after !== undefined) {
+                // Setting beneath a tombstone (the override, or modelOverrides above it) lifts it, and
+                // deepMerge would restore what it masked: re-mask each lower-layer key it covered — sibling
+                // models, then this override's vendor/channel (unknown lower ⇒ both, blind).
+                // ponytail: tiers.<adapter> itself tombstoned is unreachable here — its models, and so a tier, are masked too.
+                const tombstoned = (depth) => {
+                    const node = doc.getIn(override.slice(0, depth), true);
+                    return node !== undefined && !isMap(node);
+                };
+                const lowerModels = write.lowerOverrides?.[adapter] ?? {};
+                const remask = [];
+                if (tombstoned(3))
+                    for (const other of Object.keys(lowerModels))
+                        if (other !== model)
+                            remask.push([...override.slice(0, 3), other]);
+                if (tombstoned(3) || tombstoned(4)) {
+                    for (const key of write.lowerOverrides ? Object.keys(lowerModels[model] ?? {}) : ["vendor", "channel"]) {
+                        if (key !== "effort")
+                            remask.push([...override, key]);
+                    }
+                }
+                setScalarPreservingComment(doc, [...override, "effort"], after);
+                for (const path of remask)
+                    setScalarPreservingComment(doc, path, null);
+                continue;
+            }
+            // Clearing means no effort in the MERGED config: drop the repo key, then mask an effort the
+            // lower layers still declare (unknown lower ⇒ a repo that never held the key inherited it).
+            const held = doc.getIn([...override, "effort"]) !== undefined;
+            deleteAt(doc, [...override, "effort"]);
+            const lower = write.lowerOverrides?.[adapter]?.[model];
+            const maskEffort = write.lowerOverrides ? lower?.effort !== undefined : !held;
+            const repoNode = doc.getIn(override, true);
+            const { effort: _masked, ...rest } = { ...lower, ...(isMap(repoNode) ? repoNode.toJSON() : {}) };
+            if (Object.values(rest).some((v) => v !== null && v !== undefined)) {
+                if (maskEffort)
+                    setScalarPreservingComment(doc, [...override, "effort"], null);
+            }
+            else if (maskEffort || (isMap(repoNode) && repoNode.items.length > 0)) {
+                // Tombstone-only siblings must still suppress lower metadata when effort is cleared,
+                // even without inherited effort. Their merged {} would fail the nonempty refinement.
+                setScalarPreservingComment(doc, override, null);
+            }
+            for (const depth of [4, 3, 2, 1])
+                deleteEmptyMap(doc, override.slice(0, depth));
+        }
+    }
     if (write.mode !== undefined) {
         setScalarPreservingComment(doc, ["routing", "mode"], write.mode);
     }

package/dist/drivers/orca.d.ts

@@ -123,12 +123,13 @@ export declare function mapAgentState(term: Record<string, unknown>, tuiIdle: bo
  * A retired record is replaced by a new reservation (CAS on the tombstone bytes) only once its pane
  * is proven gone. Everything else — a reservation or claim with no bound pane, a failed cleanup, a
  * record another driver holds with a live observer — refuses and keeps the record exactly as it is.
+ * One reservation or claim is HELD rather than in flight: its placer is this process after an
+ * indeterminate split receipt (OBS-1172). It is reconciled again on every call, never split over.
  */
 /** `placer` is the pid of the narrator that wrote the reservation: a reserved or claimed record is a
  *  normal intermediate state while that pid lives (another driver awaiting listing or bind) and a
  *  crash to recover only once it is dead. */
 type BoardRecord = WatchBoardOwner & {
-    retired?: true;
     runtimeId?: string;
     placer?: number;
 };
@@ -198,6 +199,16 @@ export declare class OrcaDriver implements ExecutorDriver {
     /** Explicit runtime probe. Also T3's doctor probe. */
     probeRuntime(cwd?: string): Promise<string>;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
+    /**
+     * OBS-1109: bind THIS instance to a terminal an earlier daemon created for an OWNED slot, so a
+     * resumed daemon can read the interrupted attempt's pane. Binding needs ownership evidence, never
+     * a title or handle alone: exactly one tab on the tracked worktree carries the FULL journaled owned
+     * title, it resolves to exactly one terminal, and that terminal's scrollback proves the exact task
+     * checkout `slot.cwd` (the frame only tickmarkr's own create command prints). Zero, ambiguous or
+     * foreign candidates leave the slot unbound: the throw is the caller's decline. The journaled
+     * nonce is then checked by the caller against the trailer this binding reads.
+     */
+    adopt(slot: Slot): Promise<Slot>;
     /** Where to invoke the CLI for this slot's calls (see OrcaSlotState.dir). */
     private cliCwd;
     private state;
@@ -290,6 +301,15 @@ export declare class OrcaDriver implements ExecutorDriver {
     sendKey(slot: Slot, key: string): Promise<void>;
     nudge(slot: Slot, message: string): Promise<boolean>;
     narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
+    /** OBS-1172: what an indeterminate split left behind, reconciled from the owner record and Orca's
+     *  terminal table — never from the receipt that did not arrive. The reservation's token reaches no
+     *  process but the split's own command, so a claim proves that split started a board; the owned
+     *  record (this driver, the watch title) is ours by that same token. The claimant must be live (pid
+     *  and arm presence), and it must name the terminal it runs in — a listed pane in the launching tab.
+     *  A claim that names none proves a board started, not WHICH pane hosts it: a sole neighbouring pane
+     *  (row titles are shell-controlled, never ownership keys) is not adopted, so the claim stays held.
+     *  No claim and no such pane: the split started nothing the table shows. Anything else is held. */
+    private settleIndeterminate;
     private boardPath;
     /** A recorded pane (a receipt's handle bound to the split envelope's runtime, never a guess) is
      *  gone when that runtime no longer lists it, or when a handle-bound close receipt names it.
@@ -303,6 +323,11 @@ export declare class OrcaDriver implements ExecutorDriver {
      *  handle-bound close (timeout keeps the tombstone and the pane); a dead one never acknowledges,
      *  so it is only asked. */
     private retireAndClose;
+    /** Stop a retired board's observer before its pane is closed. A live observer acknowledges on
+     *  injected time; a dead one never can, so it is only asked. OBS-1131: an acknowledgement timeout
+     *  is not proof of death — while the pid lives the owned pane stays protected — but a pid that died
+     *  during the wait is, and its pane is closed instead of leaked. */
+    private stopObserver;
     /** WB-1 seam: the daemon reports this board lost. "Lost" can be a stale beat or missing presence
      *  under a still-live owner pid, so it is not proof of a dead observer — retirement keeps close's
      *  acknowledgement discipline (Leg-2 T9 P1). */