tickmarkr 2.6.1 → 2.6.2

package/dist/cli/commands/approve.js

@@ -5,7 +5,7 @@ import { loadConfig } from "../../config/config.js";
 import { integrationBranch } from "../../run/merge.js";
 import { separabilityErrors, surfaceErrors, taskBudgetErrors } from "../../compile/collateral.js";
 import { GATE_NAMES } from "../../graph/schema.js";
-import { applyScopeAmendments, engagementComparable, engagementReleased, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
+import { applyScopeAmendments, bindingToken, engagementComparable, engagementReleased, failedGateBeforePark, parseBindingToken, physicalLine, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
 export const APPROVAL_DISPOSITIONS = ["dispatch", "waive-gate", "re-dispatch", "fund-fixed-attempt", "fresh-budget"];
 /**
  * What each disposition's release actually buys — the clause every operator-facing sentence about
@@ -56,9 +56,9 @@ sourceIndexes) {
         const kind = typeof e.data.kind === "string" ? e.data.kind : undefined;
         const reason = typeof e.data.reason === "string" ? e.data.reason : undefined;
         return {
-            index: i, line: (sourceIndexes?.[i] ?? i) + 1, ts: typeof e.ts === "string" ? e.ts : undefined, kind, reason,
+            index: i, line: sourceIndexes?.[i] === undefined ? physicalLine(events, i) : sourceIndexes[i] + 1, ts: typeof e.ts === "string" ? e.ts : undefined, kind, reason,
             approveCommand: typeof e.data.approveCommand === "string" ? e.data.approveCommand : undefined,
-            failedGate: failedGateForNewestPark(events, taskId, i), tombstone: isTombstonePark(kind, reason),
+            failedGate: failedGateBeforePark(events, taskId, i), tombstone: isTombstonePark(kind, reason),
         };
     }
     return undefined;
@@ -71,6 +71,17 @@ export function readJournalEvents(journal) {
         sourceIndexes: tracked.map((row) => row.sourceIndex),
     };
 }
+/** OBS-1178: the token a park is decided by — what status, park notices and the cockpit print. */
+export const parkToken = (park) => park.ts === undefined ? undefined : bindingToken({ line: park.line, ts: park.ts });
+/** OBS-1178: the newest task-failed row for a task — the failure a failed-task recheck binds to. */
+export function newestFailure(events, taskId, sourceIndexes) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.event === "task-failed" && e.taskId === taskId && typeof e.ts === "string")
+            return { line: sourceIndexes?.[i] === undefined ? physicalLine(events, i) : sourceIndexes[i] + 1, ts: e.ts };
+    }
+    return undefined;
+}
 /**
  * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra →
  * approve or recheck; review gate-fail → waive/uphold/recheck; other gate-fail → waive/recheck; a
@@ -137,13 +148,17 @@ export function approvalEnactment(token, run) {
 }
 /** The production command registered in COMMANDS; its returned bytes are what the CLI prints. */
 export async function approve(argv, cwd = process.cwd()) {
-    const { runId, taskId, by, reason, waive, uphold, recheck, reviewRoundCeiling, files } = parseArgs(argv);
+    const { runId, taskId, by, reason, waive, uphold, recheck, reviewRoundCeiling, files, park: namedPark, gate: namedGate } = parseArgs(argv);
     const decisions = [waive, uphold, recheck].filter(Boolean).length;
     if (decisions > 1)
         throw new Error("--waive, --uphold and --recheck are different decisions — pass one");
+    // OBS-1178: the decision binds at COMMAND time — to the named --park, else to the park (or, for a
+    // failed task's recheck, the failure) open now — and is revalidated under serialization below. A
+    // decision queued behind another approval can therefore never land on a park that opened meanwhile.
+    // Journal.open throws `no journal for <runId> at <dir>` on an unknown run — that IS the refusal.
+    const bound = namedPark ?? openDecision(Journal.open(cwd, runId), taskId);
     const serialization = await acquireApprovalSerialization(cwd, runId);
     try {
-        // Journal.open throws `no journal for <runId> at <dir>` on an unknown run — that IS the refusal.
         const journal = Journal.open(cwd, runId);
         const status = journal.replayStatuses().get(taskId);
         if (status === undefined) {
@@ -153,13 +168,17 @@ export async function approve(argv, cwd = process.cwd()) {
         // integration base owns verified-able work; --recheck re-gates that tree with no worker. Any other
         // verb on a failed task, or a recheck over nothing landed, is refused naming why.
         if (status === "failed" && recheck) {
+            if (namedGate !== undefined)
+                throw new Error(`--gate names a parked failed gate; task ${taskId} is failed — bind its recheck with --park <failure token>`);
+            const { events: failedEvents, sourceIndexes: failedIndexes } = readJournalEvents(journal);
+            const failure = requireBound(runId, taskId, bound, newestFailure(failedEvents, taskId, failedIndexes), "failure");
             const ahead = failedTaskCommitsAhead(cwd, journal, runId, taskId);
             if (ahead.count === 0) {
                 throw new Error(`task ${taskId} is failed and ${ahead.ref} carries no commits ahead of ${ahead.base} — nothing to re-gate; use resume --retry-failed to fund a worker`);
             }
             journal.append("task-approved", taskId, {
                 by, ...(reason ? { reason } : {}), via: "cli", release: RECHECK_RELEASE,
-                recheckedRef: ahead.ref, commitsAhead: ahead.count,
+                recheckedRef: ahead.ref, commitsAhead: ahead.count, failure,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
             return disposition(cwd, runId, "re-dispatch", `re-checking failed ${taskId} in ${runId} — by ${by}; ${ahead.count} commit(s) on ${ahead.ref} ahead of ${ahead.base}; no worker funded`, serialization.contended);
@@ -178,6 +197,10 @@ export async function approve(argv, cwd = process.cwd()) {
         const infraPark = park?.kind === "infra" || park?.kind === "diff-cap";
         const authoringRunnerPark = park?.kind === "authoring" && isToolGate(park.failedGate);
         const failedGate = gateFailPark || authoringRunnerPark ? park?.failedGate : undefined;
+        const parkBinding = requireBound(runId, taskId, bound, park?.ts === undefined ? undefined : { line: park.line, ts: park.ts }, "park");
+        if (namedGate !== undefined && namedGate !== park?.failedGate) {
+            throw new Error(`refusing mismatched gate for ${taskId}: --gate ${namedGate} but park ${bindingToken(parkBinding)} failed ${park?.failedGate ?? "no gate"} — nothing appended`);
+        }
         if ((park?.kind === "scope-request" && !decisions) || files !== undefined) {
             if (park?.kind !== "scope-request")
                 throw new Error("--files requires a scope-request park");
@@ -209,7 +232,7 @@ export async function approve(argv, cwd = process.cwd()) {
                     + `remedy: close the run, split the task in its spec, recompile, then \`tickmarkr resume ${runId} --graph-changed\``);
             }
             journal.append("task-approved", taskId, {
-                by, ...(reason ? { reason } : {}), via: "cli", release: "scope-request",
+                by, ...(reason ? { reason } : {}), via: "cli", release: "scope-request", park: parkBinding,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }), // OBS-1083
                 amendment: { from, to: graphDefinitionHash(amended), beforeFiles: task.files, files: amendedFiles, parkLine: park.line, definition: taskDefinitionFingerprint(task) },
             });
@@ -234,6 +257,7 @@ export async function approve(argv, cwd = process.cwd()) {
                 via: "cli",
                 release: REVIEW_UPHELD_RELEASE,
                 gate: "review",
+                park: parkBinding,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
             return disposition(cwd, runId, "fund-fixed-attempt", `upheld the reviewer for ${taskId} in ${runId} — by ${by}`, serialization.contended);
@@ -247,6 +271,7 @@ export async function approve(argv, cwd = process.cwd()) {
                 ...(reason ? { reason } : {}),
                 via: "cli",
                 release: RECHECK_RELEASE,
+                park: parkBinding,
                 // OBS-1084: failedGate names the runner report for every recheck. Authoring rechecks additionally
                 // carry gate so their durable release row identifies the red tool gate that made recheck admissible.
                 ...(failedGate ? { failedGate } : {}),
@@ -265,6 +290,7 @@ export async function approve(argv, cwd = process.cwd()) {
                 via: "cli",
                 release: GATE_SATISFIED_RELEASE,
                 gate: failedGate,
+                park: parkBinding,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
             return disposition(cwd, runId, "waive-gate", `waived failed gate ${failedGate} for ${taskId} in ${runId} — by ${by}`, serialization.contended);
@@ -292,6 +318,7 @@ export async function approve(argv, cwd = process.cwd()) {
             via: "cli",
             ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             ...(capPark ? { release: ATTEMPT_CAP_RELEASE } : {}),
+            park: parkBinding,
         });
         const token = capPark ? "fresh-budget" : "dispatch";
         return disposition(cwd, runId, token, `approved ${taskId} in ${runId} — by ${by}`, serialization.contended);
@@ -300,6 +327,23 @@ export async function approve(argv, cwd = process.cwd()) {
         serialization.release();
     }
 }
+/** The row a decision on this task answers right now: its newest failure when failed, else its newest park. */
+function openDecision(journal, taskId) {
+    const { events, sourceIndexes } = readJournalEvents(journal);
+    if (journal.replayStatuses().get(taskId) === "failed")
+        return newestFailure(events, taskId, sourceIndexes);
+    const park = newestPark(events, taskId, sourceIndexes);
+    return park?.ts === undefined ? undefined : { line: park.line, ts: park.ts };
+}
+/** OBS-1178: under serialization, the decision's command-time binding must still name the open row. */
+function requireBound(runId, taskId, bound, open, what) {
+    if (open === undefined)
+        throw new Error(`task ${taskId} has no ${what} row with a timestamp to bind this decision to — refusing an unbound release`);
+    if (bound === undefined || bound.line !== open.line || bound.ts !== open.ts) {
+        throw new Error(`refusing stale decision for ${taskId}: bound to ${bound === undefined ? "no open row" : `${what} ${bindingToken(bound)}`} but the open ${what} is ${bindingToken(open)} — read \`tickmarkr status ${runId}\` and decide the open ${what}; nothing appended`);
+    }
+    return open;
+}
 /**
  * OBS-1022: what a failed task has landed. A preserved snapshot is authoritative only when it contains
  * the current task-branch tip; an older preservation can remain in the journal after a later retry has
@@ -365,12 +409,14 @@ function disposition(cwd, runId, token, message, contended) {
     };
     return `${out}\nTICKMARKR_APPROVAL ${JSON.stringify(record)}`;
 }
-const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--files <glob,…>] [--waive|--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
+const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--park <line>@<ts>] [--gate <gate>] [--files <glob,…>] [--waive|--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
 // hand-parsed argv — no CLI framework (house style). Positionals are runId then taskId; decision,
 // ceiling, actor and reason are flags. Throws usage on missing positionals (mirrors resume.ts/unlock.ts).
 function parseArgs(argv) {
     const positionals = [];
     let files;
+    let park;
+    let gate;
     let by;
     let reason;
     let waive = false;
@@ -388,6 +434,17 @@ function parseArgs(argv) {
                 throw new Error("--files requires non-empty repository-relative globs");
             }
         }
+        else if (a === "--park") {
+            const value = argv[++i];
+            park = value === undefined ? undefined : parseBindingToken(value);
+            if (!park)
+                throw new Error("--park requires the <line>@<ts> token `tickmarkr status` prints for the park");
+        }
+        else if (a === "--gate") {
+            gate = argv[++i];
+            if (!gate || !GATE_NAMES.includes(gate))
+                throw new Error(`--gate requires one of ${GATE_NAMES.join(", ")}`);
+        }
         else if (a === "--by") {
             by = argv[++i];
             if (!by)
@@ -424,19 +481,5 @@ function parseArgs(argv) {
     if (!runId || !taskId) {
         throw new Error(USAGE);
     }
-    return { runId, taskId, by: by ?? userInfo().username, reason, waive, uphold, recheck, reviewRoundCeiling, files };
-}
-function failedGateForNewestPark(events, taskId, lastHumanIndex) {
-    for (let i = lastHumanIndex - 1; i >= 0; i -= 1) {
-        const event = events[i];
-        if (event.taskId !== taskId)
-            continue;
-        if (event.event === "task-approved" || event.event === "task-human" || event.event === "task-dispatch")
-            return undefined;
-        if (event.event === "gate-result" && event.data.pass === false
-            && typeof event.data.gate === "string" && GATE_NAMES.includes(event.data.gate)) {
-            return event.data.gate;
-        }
-    }
-    return undefined;
+    return { runId, taskId, by: by ?? userInfo().username, reason, waive, uphold, recheck, reviewRoundCeiling, files, park, gate };
 }

package/dist/cli/commands/compile.js

@@ -2,8 +2,9 @@ import { isAbsolute, join } from "node:path";
 import { parseArgs } from "node:util";
 import { collateralLints, sourceScopeFindings, sourceScopeLints, } from "../../compile/collateral.js";
 import { CompileError } from "../../compile/common.js";
+import { readDoctor } from "../../adapters/registry.js";
 import { loadConfig } from "../../config/config.js";
-import { denyPreferCollisionLine, denyPreferCollisions } from "../../route/preference.js";
+import { deadPoolEntries, deadPoolEntryLine, denyPreferCollisionLine, denyPreferCollisions } from "../../route/preference.js";
 import { compileSource } from "../../compile/index.js";
 import { retiredLiteralErrors } from "../../compile/retired-literals.js";
 import { clearCompileRefusal, saveCompileRefusal, saveGraph, stateDirName } from "../../graph/graph.js";
@@ -88,11 +89,20 @@ export async function compile(argv, cwd = process.cwd(), harnessFrom = process.a
         // that uses it; plan already said so, compile now refuses the seal before any state write so a dry
         // run reaches the same refusal. Pool only: a partial deny leaves live members, and pin/prefer
         // collisions on the default map stay doctor's and resume's business. Scoped to the graph's shapes.
-        const deadPools = denyPreferCollisions(loadConfig(cwd), g.tasks.map((task) => task.shape))
+        // OBS-1143: aliases are judged by doctor's CACHED identity — compile never spends a probe.
+        const routingCfg = loadConfig(cwd);
+        const shapes = g.tasks.map((task) => task.shape);
+        const health = readDoctor(cwd);
+        const deadPools = denyPreferCollisions(routingCfg, shapes, health)
             .filter((collision) => collision.kind === "pool");
         if (deadPools.length > 0) {
             throw new CompileError(`${src} routes a task shape to a fully denied pool:\n${deadPools.map((collision) => `  - ${denyPreferCollisionLine(collision)}`).join("\n")}${diagnostics}`);
         }
+        // OBS-1144: a partial deny compiles, as the router routes it — but each skipped entry is named.
+        const skippedPoolEntries = deadPoolEntries(routingCfg, shapes, health).map(deadPoolEntryLine);
+        const poolNotes = skippedPoolEntries.length
+            ? `\npool notes:\n${skippedPoolEntries.map((line) => `  ! ${line}`).join("\n")}`
+            : "";
         // One bounded read supplies both cross-run surfaces: unresolved findings below and merge facts for
         // the ancestry check. Neither fact mutates the compiled graph; status and every readiness predicate
         // remain the source compiler's answer.
@@ -121,7 +131,7 @@ export async function compile(argv, cwd = process.cwd(), harnessFrom = process.a
         const mergeHistory = mergedPending.length
             ? `\nmerge history:\n${mergedPending.map((line) => `  ${line}`).join("\n")}`
             : "";
-        return `${harnessLine(resolveHarness(harnessFrom))}\n${summary}${diagnostics}${priorFindings}${mergeHistory}`;
+        return `${harnessLine(resolveHarness(harnessFrom))}\n${summary}${diagnostics}${poolNotes}${priorFindings}${mergeHistory}`;
     }
     catch (error) {
         // A dry run is a pure validation query. A real authoring refusal records the negative result

package/dist/cli/commands/doctor.d.ts

@@ -162,6 +162,7 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
         modelOverrides?: Record<string, {
             vendor?: string | undefined;
             channel?: "sub" | "api" | undefined;
+            effort?: "low" | "medium" | "high" | undefined;
         }> | undefined;
         windows?: Record<string, number> | undefined;
     }>;
@@ -286,6 +287,7 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
         modelOverrides?: Record<string, {
             vendor?: string | undefined;
             channel?: "sub" | "api" | undefined;
+            effort?: "low" | "medium" | "high" | undefined;
         }> | undefined;
         windows?: Record<string, number> | undefined;
     }>;

package/dist/cli/commands/doctor.js

@@ -14,10 +14,11 @@ import { loadConfig, overlayPreferShapes } from "../../config/config.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
 import { ORCA_FIXTURE_VERSION, parseEnvelope, resolveOrcaCliBinary } from "../../drivers/orca.js";
 import { kimi, probeKimiDoctorTurn } from "../../adapters/kimi.js";
-import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
+import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, observedSeat, preferRanks } from "../../route/preference.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, LIVEBENCH_TABLE_DATE, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { sh } from "../../run/git.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
+import { readReviewNoVerdictHistory, reviewNoVerdictRows } from "../../run/journal.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
  *  concatenation and publishes no index, so the release listing is the only enumerable surface. */
 export const LIVEBENCH_RELEASES_URL = "https://api.github.com/repos/LiveBench/livebench.github.io/contents/public";
@@ -670,6 +671,13 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             rows.push(alignedStatusRow("warn", demotion.reviewer, `${demotion.count} review seat${demotion.count === 1 ? "" : "s"} demoted · cause ${causes}`));
         }
     }
+    // OBS-1052(3): measured, never inferred — an unreadable journal renders unknown, not a clean zero.
+    const noVerdictRows = reviewNoVerdictRows(readReviewNoVerdictHistory(cwd));
+    if (noVerdictRows.length) {
+        rows.push(legend("review no-verdict history:"));
+        for (const row of noVerdictRows)
+            rows.push(alignedStatusRow(row.verdict, row.channel, row.value));
+    }
     if (existsSync(graphPath(cwd))) {
         try {
             const graph = loadGraph(cwd);
@@ -780,7 +788,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     const excluded = excludedChannels(cfg, adapters, health);
     if (excluded.length)
         lintRows.push(attentionRow(exclusionLine(excluded)));
-    lintRows.push(...denyPreferCollisions(cfg).map((c) => attentionRow(denyPreferCollisionLine(c))));
+    lintRows.push(...denyPreferCollisions(cfg, undefined, health).map((c) => attentionRow(denyPreferCollisionLine(c))));
     const aliasExcluded = modelAliasExclusions(cfg, adapters, health);
     if (aliasExcluded.length)
         lintRows.push(attentionRow(modelAliasLine(aliasExcluded)));
@@ -857,7 +865,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
                     : v.authed
                         ? `${ok("authed")}${probed}`
                         : `${fail("unauthed:")} ${trunc(v.reason ?? "probe failed", 40)} (${dateOf(v.probedAt)})`;
-            const d = disallowedBy({ adapter: a.id, model: m }, cfg.routing);
+            const d = disallowedBy(observedSeat(health, a.id, m), cfg.routing);
             const denied = d?.by === "deny" ? d.entry : "—";
             const pref = preferRanks({ adapter: a.id, model: m }, cfg).map((p) => `${p.shape}#${p.rank}`).join(",") || "—";
             const window = declaredModelWindow(cfg, a.id, m);

package/dist/cli/commands/fleet.js

@@ -5,16 +5,16 @@ import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, modelAuthE
 import { catalogModelAdvisory, catalogTierRanking, declaredModelWindow, fleetUnclassifiedModels } from "../../adapters/model-lints.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, readClaudeAliasIdentity } from "../../adapters/claude-code.js";
-import { fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, DENY_SCOPES, initialDenyPropOf, loadConfigWithMode, overlayBytesLoadError, readOverlayFile, stagedDenyKeyOf, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, TIER_RANK, unifiedYamlDiff, } from "../../config/config.js";
+import { fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, DENY_SCOPES, initialDenyPropOf, loadConfigWithMode, lowerLayerModelOverrides, overlayBytesLoadError, readOverlayFile, stagedDenyKeyOf, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, TIER_RANK, unifiedYamlDiff, } from "../../config/config.js";
 import { exclusionReason, projectFleetWhy, renderFleetWhy } from "../../config/fleet-why.js";
 import { SHAPES, TIERS } from "../../graph/schema.js";
 import { doctor } from "./doctor.js";
 import { candidateRow, costSignal, shapeCandidates } from "./fleet-picker.js";
 import { route } from "../../route/router.js";
 import { pickRole } from "../../route/role-pick.js";
-import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, entryMatchesChannel, exclusionCollector } from "../../route/preference.js";
+import { deadPoolEntries, deadPoolEntryLine, denyPreferCollisionLine, denyPreferCollisions, disallowedBy, entryMatchesChannel, exclusionCollector } from "../../route/preference.js";
 import { resolveRunMode } from "../../run/daemon.js";
-import { loadRoutingProfile } from "../../run/journal.js";
+import { loadRoutingProfile, readReviewNoVerdictHistory, reviewNoVerdictRows } from "../../run/journal.js";
 const initialFetch = globalThis.fetch;
 const NON_TTY_MSG = "tickmarkr fleet: interactive fleet editor requires a TTY — use `tickmarkr fleet --print` for non-interactive output";
 const QUIT = "fleet: quit without writing";
@@ -581,7 +581,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             captions.push(`task hint: routing.map.${shape}.prefer ranks ${entry.prefer.join(", ")} — not manageable here, edit it in Shapes`);
         }
         // 8. deny∩prefer collision — a standing lint on this shape's declaration, never a fleet toggle.
-        for (const collision of denyPreferCollisions(cfgPreview, [shape])) {
+        for (const collision of denyPreferCollisions(cfgPreview, [shape], health)) {
             captions.push(denyPreferCollisionLine(collision));
         }
         // 9. first-match provenance — the per-channel ledger below lists EVERY collector scope.
@@ -594,7 +594,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const channelLedger = (shape, map, cfgPreview, offered) => {
         const entry = map[shape];
         const floor = cfgPreview.routing.floors[shape];
-        const collisions = denyPreferCollisions(cfgPreview, [shape]);
+        const collisions = denyPreferCollisions(cfgPreview, [shape], health);
         const discovered = new Set(previewChannels.map((c) => `${c.adapter}:${c.model}`));
         // T2 review (D-225): discovery already dropped a channel whose model probe failed — it is
         // rebuilt as a structured channel from its adapter's own declaration and walks the SAME
@@ -616,7 +616,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         // never greys beside itself; its pin/pool/floor/prefer captions stay in excludedNote
         const ledgerChannels = [...previewChannels.map((c) => ({ ...c, authReason: undefined })), ...failedProbes, ...unauthedCliChannels]
             .filter((c) => !offered.has(`${c.adapter}:${c.model}`));
-        return ledgerChannels.flatMap((c) => {
+        const lines = ledgerChannels.flatMap((c) => {
             const key = `${c.adapter}:${c.model}`;
             const reasons = exclusionCollector(c, cfgPreview.routing, "worker").map(exclusionReason);
             // OBS-1065: a greyed picker row carries its reach beside its reasons, like the models view
@@ -645,8 +645,19 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             if (c.authReason)
                 reasons.push(c.authReason);
             // labelled like the models view's row (adapter/model), so a ledger row never reads as a candidate
-            return reasons.length ? [`${c.adapter}/${c.model} — reach: ${reach} — ${reasons.join("; ")}`] : [];
+            return reasons.length ? [{ key, line: `${c.adapter}/${c.model} — reach: ${reach} — ${reasons.join("; ")}` }] : [];
         });
+        // OBS-1145 add.1: every carried pool member the picker does not offer leads the ledger in chain
+        // order — one no reason above names still gets its own row — so the picker renders its ordinal
+        // and Space can drop it; a chain member with no row is hidden AND irremovable
+        const carried = entry?.pool?.channels.filter((key) => !offered.has(key)) ?? [];
+        const named = new Set(lines.map((row) => row.key));
+        const unnamed = carried.filter((key) => !named.has(key)).map((key) => ({
+            key,
+            line: `${key.replace(":", "/")} — ${discovered.has(key) ? `not offered for ${shape}` : "not served by an installed adapter"} — carried in routing.map.${shape}.pool`,
+        }));
+        const order = (key) => (carried.includes(key) ? carried.indexOf(key) : carried.length);
+        return [...lines, ...unnamed].sort((a, b) => order(a.key) - order(b.key)).map((row) => row.line);
     };
     const candidatesForShape = (shape, mode, map, deny) => {
         const preview = previewCfg(mode, map, deny);
@@ -677,6 +688,10 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         review: cfg.review.prefer?.slice(),
         consult: cfg.consult.prefer?.slice(),
     };
+    // OBS-1052(3): shown on the Steering view beside review.prefer; the pickers above stay untouched.
+    const reviewAdvisories = reviewNoVerdictRows(readReviewNoVerdictHistory(cwd))
+        .filter((row) => row.verdict === "warn")
+        .map((row) => `review history: ${row.channel} — ${row.value}`);
     const steeringOptionsFor = (which, current) => {
         const discovered = which === "review" ? [...reviewAdapters, ...seats] : seats;
         return [...discovered, ...current.filter((entry) => !discovered.includes(entry))];
@@ -685,6 +700,9 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     // discovered seats universe plus a keep-default row, and a write is staged only on a real change.
     const initialJudge = `${cfg.judge.adapter}:${cfg.judge.model}`;
     let pendingWrite = null;
+    // OBS-1182: the layers under the repo overlay, read raw, so clearing an effort masks an inherited
+    // one even when those layers only validate beside repo fields.
+    const lowerOverrides = lowerLayerModelOverrides({ globalDir });
     const reviewOverlay = (state) => {
         const staged = structuredClone(initial);
         // OBS-994/FL-1, OBS-1099 add.1: every schema-enumerated deny scope rides the same review/write funnel
@@ -692,6 +710,12 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             staged[scope.key] = state[scope.key];
         staged.allowOut = state.allowOut ?? initial.allowOut;
         staged.map = state.map;
+        // OBS-1182: staged efforts replace the loaded ones; none staged anywhere ⇒ no key, as loaded
+        const efforts = Object.fromEntries(Object.entries(state.efforts ?? {}).filter(([, models]) => Object.keys(models).length));
+        if (Object.keys(efforts).length)
+            staged.efforts = efforts;
+        else
+            delete staged.efforts;
         const today = new Date().toISOString().slice(0, 10);
         for (const classification of state.classifications) {
             staged.tiers[classification.adapter] ??= {};
@@ -717,6 +741,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             initial,
             edited: staged,
             universe,
+            lowerOverrides,
             ...(modeChanged ? { mode: state.selectedMode } : {}),
             ...(judgeChanged && judgeSeat ? { judge: judgeSeat } : {}),
             steering: { initial: initialSteering, edited: state.steering },
@@ -727,12 +752,23 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             return { kind: "empty" };
         }
         pendingWrite = write;
+        // OBS-1144: the review names every dead pool entry the written config carries, with its reason and
+        // what still routes — before y. Unloadable bytes carry no notes: the reload guard refuses them anyway.
+        let poolNotes = [];
+        try {
+            const written = loadConfigWithMode(cwd, { globalDir, repoOverlayText: after }).cfg;
+            poolNotes = deadPoolEntries(written, undefined, health).map(deadPoolEntryLine);
+        }
+        catch {
+            poolNotes = [];
+        }
         return {
             kind: "diff",
             before,
             after,
             diff: unifiedYamlDiff(before, after, path),
             path,
+            ...(poolNotes.length ? { notes: poolNotes } : {}),
         };
     };
     const reloadGuard = io.reloadGuard
@@ -743,6 +779,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         health,
         ...Object.fromEntries(DENY_SCOPES.map((scope) => [initialDenyPropOf(scope), editable[scope.key] ?? []])),
         initialAllowOut: editable.allowOut,
+        initialEfforts: editable.efforts,
         modelGroups,
         initialMode: rm.mode.mode,
         modeOptions: ROUTING_MODES.map((mode) => ({ id: mode, gloss: MODE_GLOSS[mode] })),
@@ -756,6 +793,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         ],
         initialSteering,
         steeringOptionsFor,
+        reviewAdvisories,
         reviewOverlay,
         reloadGuard,
         stagedRouting,

package/dist/cli/commands/report.js

@@ -11,7 +11,7 @@ import { estimateCosts } from "../../report/cost.js";
 import { assignmentChannel, buildOperatorRecord, formatChannelMoney, formatChannelTokens, formatTokenUsage as fields, totalTokens as total, } from "../../report/operator-record.js";
 import { cellsOf, cellSummary } from "../../route/profile.js";
 import { Journal, loadRoutingProfile } from "../../run/journal.js";
-import { formatTipProof, runEndTipProof } from "../../run/daemon.js";
+import { baselineProvenanceOf, fingerprintsOf, forgivenFingerprints, forgivenGateRow, formatBaselineProvenance, formatFingerprints, formatForgiven, formatTipProof, runEndTipProof, } from "../../run/daemon.js";
 import { deriveRunCockpitData } from "../../tui/cockpit/derive.js";
 const n = (x) => x.toLocaleString("en-US"); // explicit locale — CI/darwin flake guard
 const EM = "—";
@@ -170,6 +170,10 @@ const VERIFICATION_READING = {
     failed: "FAILED — the run did not verify its own tip",
     absent: "absent — no tip verification recorded: neither passed nor failed",
 };
+function forgivenLines(events) {
+    const forgiven = forgivenFingerprints(closedCycle(events));
+    return forgiven.length ? ["- **forgiven vs baseline:**", ...forgiven.map((f) => `  - ${formatForgiven(f)}`)] : [];
+}
 function verificationReading(runId, events) {
     const state = verificationOf(runId, events);
     const proof = runEndTipProof(closedCycle(events));
@@ -179,6 +183,16 @@ function verificationReading(runId, events) {
     }
     return VERIFICATION_READING[state];
 }
+// OBS-1123: a battery row that carried baseline reds names them apart from any red it introduced, so a
+// new regression can never read as forgiven. Rows without the structured fields render as before.
+const fingerprintClauses = (data) => {
+    const fresh = fingerprintsOf(data.freshFingerprints) ?? [];
+    const forgiven = fingerprintsOf(data.forgivenFingerprints);
+    if (!forgiven && !forgivenGateRow(data))
+        return "";
+    return `${fresh.length ? `; new red (not in baseline): ${formatFingerprints(fresh)}` : ""}`
+        + `; forgiven vs baseline: ${formatFingerprints(forgiven)} — ${formatBaselineProvenance(baselineProvenanceOf(data.baselineProvenance))}`;
+};
 // VIS-07 / REC-01: derived only from the run journal, telemetry, and local configuration.
 export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
     const runStart = events.find((e) => e.event === "run-start");
@@ -216,6 +230,8 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
         `- **failed:** ${count("failed")}`,
         `- **human:** ${count("human")}`,
         `- **verification:** ${verificationReading(runId, events)}`,
+        // OBS-1123: the same fold the run-end record states, over the same closed cycle as verification.
+        ...forgivenLines(events),
         "",
         "## Usage & efficiency",
         "",
@@ -280,7 +296,7 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
                 }
                 const resolved = gate === "review" && g.data.pass === true && Array.isArray(g.data.resolved)
                     ? g.data.resolved.filter((id) => typeof id === "string") : [];
-                lines.push(`  - ${gate}: ${pass} — ${firstLine(g.data.details)}${resolved.length ? `; resolved: ${resolved.join(", ")}` : ""}`);
+                lines.push(`  - ${gate}: ${pass} — ${firstLine(g.data.details)}${resolved.length ? `; resolved: ${resolved.join(", ")}` : ""}${fingerprintClauses(g.data)}`);
             }
             for (const row of leg2) {
                 const pass = row.data.pass === true ? "pass" : row.data.pass === false ? "fail" : EM;

package/dist/cli/commands/resume.js

@@ -1,4 +1,5 @@
 import { parseArgs } from "node:util";
+import { readDoctor } from "../../adapters/registry.js";
 import { loadConfig } from "../../config/config.js";
 import { classifyHost, parseDriverOverride, pickDriver, preflightHostDriver } from "../../drivers/index.js";
 import { loadGraph } from "../../graph/graph.js";
@@ -31,9 +32,10 @@ export async function resume(argv, cwd = process.cwd()) {
     // v1.87 T3 (OBS-162, twice-carried workaround): the preflight runs AFTER the graph is read and
     // sees only the shapes the resumed graph carries. A deny∩prefer collision on a shape no resumed
     // task uses is a config fact the run would never resolve — it must not refuse the only
-    // crash-recovery path. doctor still walks the whole map.
+    // crash-recovery path. doctor still walks the whole map. OBS-1143: aliases are judged by the
+    // identity doctor cached — the same one the daemon's discovery routes with.
     const graph = loadGraph(cwd);
-    const collisions = denyPreferCollisions(cfg, graph.tasks.map((t) => t.shape));
+    const collisions = denyPreferCollisions(cfg, graph.tasks.map((t) => t.shape), readDoctor(cwd));
     if (collisions.length) {
         throw new Error(collisions.map(denyPreferCollisionLine).join("; "));
     }

package/dist/cli/commands/status.js

@@ -12,7 +12,7 @@ import { authorsNote, doneAuthors } from "../../run/operator-state.js";
 import { projectOperatorSummary } from "../../run/operator-summary.js";
 import { trackJournalRows } from "../../run/protocol.js";
 import { newestPark, permittedDecisionVerbs } from "./approve.js";
-import { Journal, formatJournalNarration, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, } from "../../run/journal.js";
+import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, } from "../../run/journal.js";
 import { isPidLive, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
@@ -167,7 +167,7 @@ export const decisionEventsFromJournal = (events, runId, stateDir = ".tickmarkr"
                 ...base,
                 type: "human-decision-required",
                 tier: "decision",
-                approvalCommand: `tickmarkr approve ${runId} ${event.taskId}`,
+                approvalCommand: `tickmarkr approve ${runId} ${event.taskId} --park ${bindingToken({ line: physicalLine(events, index), ts: event.ts })}`,
                 ...(typeof event.data.kind === "string" ? { kind: event.data.kind } : {}),
                 ...(typeof event.data.reason === "string" ? { reason: event.data.reason } : {}),
             }];
@@ -841,18 +841,6 @@ const statusEngagement = (events, loadedHash) => {
     }
     return { comparable: true };
 };
-// The journal's own reader rule (src/run/journal.ts readJsonl), applied to bytes already in hand:
-// skip blanks, drop a line that will not parse (a torn trailing write after a crash), keep the rest.
-const parseJournalSnapshot = (raw) => raw.split("\n").flatMap((line) => {
-    if (!line.trim())
-        return [];
-    try {
-        return [JSON.parse(line)];
-    }
-    catch {
-        return [];
-    }
-});
 // runLockOwner is the single lock payload/liveness reader. Its current path helper also initializes
 // .tickmarkr metadata; an engine-written lock necessarily passed through that initializer already, so
 // status avoids invoking it in stripped reader-purity fixtures where no engine lock can exist.
@@ -892,7 +880,7 @@ const readRunRecord = (cwd, graph, namedRunId) => {
     if (!runId)
         return undefined;
     const raw = readRunJournalRaw(cwd, runId, lockedRunId === runId);
-    const events = parseJournalSnapshot(raw);
+    const events = parseJournalText(raw);
     // The resume comparator is the fail-closed baseline; a matching graph-rehash is the daemon's
     // append-only audit that authorizes this status replay after stop-amend-resume.
     const engagement = statusEngagement(events, graphDefinitionHash(graph));
@@ -918,7 +906,8 @@ const recordTaskRows = (record, graph, isDaemonAlive) => record.comparable && re
 const recordProjection = (record, graph, isDaemonAlive) => {
     const rows = record ? recordTaskRows(record, graph, isDaemonAlive) : new Map();
     const events = record?.comparable ? record.events : [];
-    const activity = projectActivity(record?.runId ?? "", trackJournalRows(record?.runId ?? "", events.map((raw, sourceIndex) => ({ raw, sourceIndex }))), graph.tasks);
+    // OBS-1178: a refused or unsound decision released nothing, so the activity fold never reads it.
+    const activity = projectActivity(record?.runId ?? "", trackJournalRows(record?.runId ?? "", effectiveEvents(events).map((raw, sourceIndex) => ({ raw, sourceIndex }))), graph.tasks);
     const tasks = graph.tasks.map(task => {
         const row = rows.get(task.id);
         const evidence = events.filter(event => event.taskId === task.id);
@@ -1068,12 +1057,28 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
     // OBS-738: recovery facts stay on the journal's two established reducers. The prefix fold keeps an
     // older journal equally readable by asking upheldFeedbackByTask what was active at that exact
     // restore boundary; current resume-restore rows additionally carry the same task for narration.
+    // OBS-1178: both folds read decisions through the one decision fold over the whole journal.
+    const decided = effectiveEvents(events);
     const preservedRefs = preservedRefsByTask(events);
-    const restoredUpheldFeedback = new Set(events.flatMap((event, index) => event.event === "resume-restore" && event.taskId
-        && upheldFeedbackByTask(events.slice(0, index)).has(event.taskId)
+    const restoredUpheldFeedback = new Set(decided.flatMap((event, index) => event.event === "resume-restore" && event.taskId
+        && upheldFeedbackByTask(decided.slice(0, index)).has(event.taskId)
         ? [event.taskId]
         : []));
+    // OBS-1178: a failed task's newest task-failed row is the token its recheck binds to. Only an
+    // effective decision consumes it — a refused or unsound recheck leaves the task failed and the token shown.
+    const failureTokens = new Map();
+    decided.forEach((event, index) => {
+        if (!event.taskId || !["task-dispatch", "task-done", "task-failed", "task-human", "task-approved"].includes(event.event))
+            return;
+        if (event.event === "task-failed")
+            failureTokens.set(event.taskId, bindingToken({ line: physicalLine(decided, index), ts: event.ts }));
+        else
+            failureTokens.delete(event.taskId);
+    });
     const recoveryLinesForTask = (taskId) => [
+        ...(failureTokens.has(taskId) && runId
+            ? [`failed — ${taskId} — failure ${failureTokens.get(taskId)} — re-gate landed work with \`tickmarkr approve ${runId} ${taskId} --recheck --park ${failureTokens.get(taskId)}\``]
+            : []),
         ...(preservedRefs.get(taskId) ?? []).flatMap(({ ref, diffCommand }) => [
             `preserved worktree — ${taskId} — ${ref}`,
             `  ${diffCommand}`,
@@ -1501,7 +1506,7 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
             decisionRunId = runId;
             journalCursor = 0;
         }
-        const journalEvents = parseJournalSnapshot(readRunJournalRaw(cwd, runId, lockedRunId === runId));
+        const journalEvents = parseJournalText(readRunJournalRaw(cwd, runId, lockedRunId === runId));
         if (journalEvents.length < journalCursor)
             journalCursor = 0;
         const fresh = decisionEventsFromJournal(journalEvents, runId, stateDirName(cwd))