tickmarkr 2.6.1 → 2.6.3

package/README.md

@@ -134,7 +134,7 @@ tickmarkr status <runId> --oneline # compact snapshot, then exit
 tickmarkr status <runId> --watch # TTY: Run cockpit; non-TTY: line output
 tickmarkr status <runId> --watch --plain # preserved line/ANSI fallback, including on a TTY
 tickmarkr resume <runId>       # continue an engagement from the local execution log
-tickmarkr approve <runId> <taskId>   # append permission for a non-gate park; see below
+tickmarkr approve <runId> <taskId> --park <line>@<ts>   # decide the park status printed; see below
 tickmarkr report <runId>       # cost/quality report
 tickmarkr report <runId> --md > feature.record.md # explicit file write beside your spec
 tickmarkr profile              # show the learned routing profile
@@ -189,14 +189,27 @@ graph says “not comparable” and supplies no borrowed denominator. Historical
 does not establish current completion.
 
 The CLI twin for the same decision is
-`tickmarkr approve <runId> T2 --by operator --reason 'ready to proceed'`, followed by the
-receipt check and explicit resume above. Other parks have different permitted decisions:
+`tickmarkr approve <runId> T2 --park <line>@<ts> --by operator --reason 'ready to proceed'`,
+followed by the receipt check and explicit resume above. Every decision is bound to one park:
+status, the park notice and the Run confirmation print its `<line>@<ts>` token (the park row's
+physical journal line and timestamp), and `--park` names it — without `--park` the park open
+when the command starts is bound. A waive is also bound to that park's failed gate, named
+explicitly with `--gate` (`tickmarkr approve <runId> T2 --waive --park <line>@<ts> --gate review`).
+A decision queued behind another approval is revalidated under serialization, and the daemon
+revalidates it again before enactment: once a newer park opens, a stale token, an unbound row or a
+mismatched gate is refused (the daemon journals `approval-refused`) and never waives the newer gate.
+A failed task's recheck keeps working with its own bound token: status prints
+`failed — T3 — failure <line>@<ts>`, and
+`tickmarkr approve <runId> T3 --recheck --park <line>@<ts>` re-gates its landed commits with no
+worker. Other parks have different permitted decisions:
 
 | Park | Decision and effect |
 |---|---|
 | Human gate / other non-gate park | Plain approve records permission to dispatch. |
 | Attempt cap | Plain approve grants a fresh attempt budget; prior routing exclusions remain. |
 | Infrastructure | Plain approve or `--recheck`; recheck reruns the declared battery and satisfies no gate. |
+| Stall with a recorded `reapFailure` (the worker's process census was unreadable or had survivors) | `--recheck` bound to that park's token re-verifies the parked attempt's owned census: only an explicitly recorded empty survivors array (`[]`) releases its harvested commits to the declared battery, with no worker; a missing, unreadable or surviving census re-parks the stall (new token, still approve/recheck). Plain approve dispatches a worker. |
+| Ordinary stall (no `reapFailure`) | Plain approve only — it dispatches a worker; `--recheck` refuses. |
 | Failed review gate | `--waive` satisfies only that identified gate; `--uphold` funds one fixed attempt carrying findings; `--recheck` reruns the battery. |
 | Other failed gate | `--waive` or `--recheck`; plain approve refuses. |
 | Tombstone / gate failure without identifying evidence | Diagnostic only; no invented decision. |

package/dist/adapters/catalog-remote.js

@@ -91,49 +91,78 @@ export function readCachedCatalog(repoRoot, opts = {}) {
         };
     }
 }
-function providerModels(modelsDev, preferred) {
-    const providers = record(modelsDev);
-    if (!providers)
-        return [];
-    const entries = Object.entries(providers);
-    const preferredEntries = preferred
-        ? entries.filter(([key, value]) => key === preferred || record(value)?.id === preferred)
-        : [];
-    // Price is provider-specific. A provider-qualified query must never borrow an identically named
-    // model from another provider, where subscription and metered costs can differ materially.
-    // D-OBS-11 follow-up: that rule presumes the hinted provider EXISTS in the catalog. A hint that
-    // matches nothing (kimi's "moonshot" vs the catalog's "moonshotai"/"kimi-for-coding"; cursor has
-    // no provider at all) used to ZERO the search space and blanket-uncover the whole adapter.
-    // Fail open to the full scan instead — advisory evidence with a visible models.dev id beats none.
-    const selected = preferred && preferredEntries.length > 0 ? preferredEntries : entries;
-    return selected.flatMap(([providerKey, provider]) => {
-        const models = record(record(provider)?.models);
-        return models ? [{ providerKey, models }] : [];
-    });
+// OBS-1148: a model maker's own models.dev provider keys, in tie-break order. Reseller rows (bothub,
+// agentrouter, greenpt …) carry another price or none, and JSON key order moved the pick on a plain
+// cache refresh. ponytail: hand-kept list; a maker missing here only loses its tie to key order.
+const FIRST_PARTY_PROVIDERS = ["anthropic", "openai", "google", "xai", "zai", "zhipuai", "alibaba", "moonshotai", "deepseek", "mistral"];
+// OBS-1147: effort/mode tokens CLIs append to a model id (`-high`, `-thinking`, `-max-effort`) — the
+// union of Fleet's own variant set (model-lints.ts) and LiveBench's. NEVER `preview`: a preview is
+// its own client-side identity; only a LiveBench row may carry it as residue (OBS-1149).
+const EFFORT_MODE_TOKENS = new Set(["max", "xhigh", "high", "medium", "low", "minimal", "none", "thinking", "auto", "effort", "fast"]);
+/** Exact canonical id: case and the `.`/`:`/`_` separators only — version digits are never touched. */
+const canonicalModelId = (id) => id.trim().toLowerCase().replace(/[.:_]+/g, "-");
+/** `c-thinking-high` → [`c-thinking`, `c`]: longest base first, so a real `-thinking` model outranks `c`. */
+function effortBases(id) {
+    const tokens = id.split("-");
+    const bases = [];
+    while (tokens.length > 1 && EFFORT_MODE_TOKENS.has(tokens[tokens.length - 1])) {
+        tokens.pop();
+        bases.push(tokens.join("-"));
+    }
+    return bases;
 }
+const codeUnitOrder = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
 function findModelsDevModel(catalog, provider, modelId) {
-    // CLI namespaces prefix their catalog ids (kimi-code/k3 vs catalog key k3; omp's openai/gpt-4):
-    // after exact key/id misses, retry with the bare segment after the last "/". Deterministic
-    // provider order; first hit wins — acceptable for advisory evidence, never routing.
-    const bare = modelId.includes("/") ? modelId.slice(modelId.lastIndexOf("/") + 1) : undefined;
-    for (const { providerKey, models } of providerModels(catalog.modelsDev, provider)) {
-        const direct = record(models[modelId]);
-        if (direct)
-            return { providerKey, models, recordId: modelId, model: direct };
-        for (const [recordId, value] of Object.entries(models)) {
-            const candidate = record(value);
-            if (candidate?.id === modelId)
-                return { providerKey, models, recordId, model: candidate };
-        }
-    }
-    if (bare) {
-        for (const { providerKey, models } of providerModels(catalog.modelsDev, provider)) {
-            const direct = record(models[bare]);
-            if (direct)
-                return { providerKey, models, recordId: bare, model: direct };
+    const providers = Object.entries(record(catalog.modelsDev) ?? {});
+    const named = (name) => name
+        ? providers.filter(([key, value]) => key === name || record(value)?.id === name).map(([key]) => key)
+        : [];
+    // Price is provider-specific: a provider-qualified query never borrows an identically named model
+    // from another provider, where subscription and metered costs differ materially. The CLI's own
+    // namespace (`zai-coding-plan/glm-5.2`, `google/…`) is the most explicit qualification and outranks
+    // the tier vendor hint. D-OBS-11 follow-up: a qualifier naming NO catalog provider (kimi's "moonshot"
+    // vs "moonshotai"; cursor has none) fails open to the full scan rather than blanket-uncovering the
+    // adapter — advisory evidence with a visible models.dev id beats none.
+    const slash = modelId.indexOf("/");
+    const namespace = slash > 0 ? named(modelId.slice(0, slash)) : [];
+    const scope = namespace.length > 0 ? namespace : named(provider);
+    // Full id, then (inside its own namespace) the rest, then the bare segment after the last "/"
+    // (kimi-code/k3 vs catalog key k3); only after every exact canonical miss, the effort-stripped bases.
+    const exact = [...new Set([
+            modelId,
+            ...(namespace.length > 0 ? [modelId.slice(slash + 1)] : []),
+            ...(slash >= 0 ? [modelId.slice(modelId.lastIndexOf("/") + 1)] : []),
+        ].map(canonicalModelId))];
+    const candidates = [...new Set([...exact, ...exact.flatMap(effortBases)])];
+    // One pass, then a total order: candidate, first-party rank, provider key, record key — never JSON key order.
+    const firstParty = (key) => {
+        const rank = FIRST_PARTY_PROVIDERS.indexOf(key);
+        return rank < 0 ? FIRST_PARTY_PROVIDERS.length : rank;
+    };
+    let best;
+    let bestCandidate = candidates.length;
+    for (const [providerKey, value] of providers) {
+        if (scope.length > 0 && !scope.includes(providerKey))
+            continue;
+        for (const [recordId, raw] of Object.entries(record(record(value)?.models) ?? {})) {
+            const model = record(raw);
+            if (!model)
+                continue;
+            const candidate = Math.min(...[recordId, model.id]
+                .flatMap((id) => (typeof id === "string" ? [candidates.indexOf(canonicalModelId(id))] : []))
+                .filter((i) => i >= 0));
+            if (!Number.isFinite(candidate))
+                continue;
+            if (best && (candidate - bestCandidate
+                || firstParty(providerKey) - firstParty(best.providerKey)
+                || codeUnitOrder(providerKey, best.providerKey)
+                || codeUnitOrder(recordId, best.recordId)) >= 0)
+                continue;
+            best = { providerKey, recordId, model, matchedId: candidates[candidate] };
+            bestCandidate = candidate;
         }
     }
-    return undefined;
+    return best;
 }
 function artificialAnalysisRows(value) {
     if (Array.isArray(value))
@@ -232,8 +261,14 @@ function assertUsableLiveBench(rows, categories) {
 // `-thinking-auto-medium-effort`); the highest effort is the model at its best. Rank by
 // hyphen-delimited token so `xhigh` never reads as `high`.
 const LIVEBENCH_EFFORT_RANK = { max: 5, xhigh: 4, high: 3, medium: 2, low: 1 };
-const LIVEBENCH_VARIANT_RE = /^-(?:max|xhigh|high|medium|low|thinking|auto|effort|fast)(?:-(?:max|xhigh|high|medium|low|thinking|auto|effort|fast))*$/;
-const liveBenchEffortRank = (residue) => residue.split("-").reduce((rank, token) => Math.max(rank, LIVEBENCH_EFFORT_RANK[token] ?? 0), 0);
+// OBS-1149: LiveBench benchmarks some models only as their preview (`gemini-3.1-pro-preview-high`),
+// so on THIS side `preview` is residue too. Every residue token must be a word: `.2` never is.
+const isLiveBenchVariant = (residue) => residue.startsWith("-") && residue.slice(1).split("-").every((token) => token === "preview" || EFFORT_MODE_TOKENS.has(token));
+/** A GA row always outranks a preview row of the same model; effort ranks within each. */
+const liveBenchEffortRank = (residue) => {
+    const tokens = residue.split("-");
+    return (tokens.includes("preview") ? 0 : 10) + tokens.reduce((rank, token) => Math.max(rank, LIVEBENCH_EFFORT_RANK[token] ?? 0), 0);
+};
 const liveBenchCategoryMean = (row, tasks) => {
     const scores = (Array.isArray(tasks) ? tasks : [])
         .map((task) => (typeof task === "string" ? finite(row[task]) : undefined))
@@ -255,13 +290,17 @@ function liveBenchIndex(value, identities) {
             continue;
         // Bare startsWith is a false-positive machine: `glm-5` would claim `glm-5.2`. The residue after
         // the fleet id must be empty or an effort suffix.
-        const residue = wanted.map((identity) => model.startsWith(identity) ? model.slice(identity.length) : undefined)
-            .find((rest) => rest === "" || LIVEBENCH_VARIANT_RE.test(rest ?? ""));
-        if (residue === undefined)
+        const residues = wanted.map((identity) => model.startsWith(identity) ? model.slice(identity.length) : undefined);
+        const identity = residues.findIndex((rest) => rest === "" || isLiveBenchVariant(rest ?? ""));
+        if (identity < 0)
             continue;
-        const rank = liveBenchEffortRank(residue);
-        if (!best || rank > best.rank)
-            best = { row, rank };
+        // Identities are listed most-specific first (the client's `gpt-5.6-high` before its stripped base
+        // `gpt-5.6`): a row reached through an earlier identity always beats one reached only through a
+        // later one, so a client's exact `-high` row is never outranked by a sibling `-low` row whose
+        // residue happens to carry an effort token. Effort rank only orders rows of the SAME identity.
+        const rank = liveBenchEffortRank(residues[identity] ?? "");
+        if (!best || identity < best.identity || (identity === best.identity && rank > best.rank))
+            best = { row, identity, rank };
     }
     if (!best)
         return undefined;
@@ -293,10 +332,13 @@ export function resolveCatalogModel(catalog, query) {
         modelId,
         query.model,
         ...[modelId, query.model].flatMap((identity) => identity.includes("/") ? [identity.slice(identity.lastIndexOf("/") + 1)] : []),
+        // OBS-1147/1082: the exact base an effort variant resolved to (`gemini-3-pro-high` → `gemini-3-pro`).
+        match.matchedId,
         ...(typeof model.name === "string" ? [model.name] : []),
     ];
     const intelligence = artificialAnalysisIndex(catalog.artificialAnalysis, [
         modelId,
+        match.matchedId,
         ...(typeof model.name === "string" ? [model.name] : []),
     ], query.provider);
     const liveBench = liveBenchIndex(catalog.liveBench, identities);

package/dist/adapters/claude-code.js

@@ -210,6 +210,9 @@ export function probeVersion(bin) {
         note: "auth assumed; verified at dispatch (failover on auth/quota errors)",
     };
 }
+// OBS-1182: an absent effort renders nothing, so the CLI keeps its own default. Every builder places
+// it right after --model's value and before another flag, never before the prompt positional.
+const claudeEffortFlag = (effort) => (effort ? ` --effort ${shq(effort)}` : "");
 export const claudeCode = {
     id: "claude-code",
     vendor: "anthropic",
@@ -218,7 +221,7 @@ export const claudeCode = {
     channels: (cfg) => channelsFromConfig("claude-code", cfg),
     // v1.65 T3: every flag the command builders below hardcode — doctor checks `claude --help` still
     // lists each (all present on claude 2.x, verified 2026-07-22). Advisory only, never routing.
-    hardcodedFlags: { binary: "claude", flags: ["-p", "--model", "--permission-mode", "--strict-mcp-config", "--mcp-config", "--output-format", "-r", "--prompt-suggestions", "--settings"] },
+    hardcodedFlags: { binary: "claude", flags: ["-p", "--model", "--permission-mode", "--strict-mcp-config", "--mcp-config", "--output-format", "-r", "--prompt-suggestions", "--settings", "--effort"] },
     // --strict-mcp-config --mcp-config '{"mcpServers":{}}': pin the MCP surface to empty so fresh-worktree
     // workers/gates don't load project .mcp.json servers (herdr scrapes dialogs as idle — v1.4 incident,
     // memory tickmarkr-worker-mcp-dialog-stall). Live-verified 2026-07-10 on claude 2.1.205 (operator check):
@@ -230,7 +233,7 @@ export const claudeCode = {
     // flag must always follow the value, never the prompt.
     // The empty -p argument selects print mode while stdin carries the prompt, keeping its nonce out
     // of process argv. The redirect path is shell-quoted independently from the model.
-    headlessCommand: (promptFile, model) => `claude -p '' --model ${shq(model)} --permission-mode bypassPermissions --strict-mcp-config --mcp-config '{"mcpServers":{}}' --output-format text < ${shq(promptFile)}`,
+    headlessCommand: (promptFile, model, effort) => `claude -p '' --model ${shq(model)}${claudeEffortFlag(effort)} --permission-mode bypassPermissions --strict-mcp-config --mcp-config '{"mcpServers":{}}' --output-format text < ${shq(promptFile)}`,
     // HYG-03 / OBS-137: the residual first-entry dialog is workspace trust, not MCP config loading.
     // Claude's only store is global last-writer-wins ~/.claude.json, so tickmarkr still does not seed it;
     // the daemon safely answers only the exact adapter-declared dialog once per slot.
@@ -250,16 +253,16 @@ export const claudeCode = {
     // OBS-931: the same ONE-argv-string hazard as codex (OBS-930) — over promptArgvCeiling() the TUI
     // launch would E2BIG on Linux, so it returns null → worker-mode-fallback → the headless form.
     // resumeCommand keeps the shape: its contract returns a string (composer delivery is 2.4.3 work).
-    interactiveCommand: (promptFile, model) => promptFitsArgv(promptFile)
-        ? `claude --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --settings '{"promptSuggestionEnabled":false}' --prompt-suggestions false --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`
+    interactiveCommand: (promptFile, model, effort) => promptFitsArgv(promptFile)
+        ? `claude --model ${shq(model)}${claudeEffortFlag(effort)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --settings '{"promptSuggestionEnabled":false}' --prompt-suggestions false --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`
         : null,
     trustDialog: CLAUDE_TRUST_DIALOG,
     inputBox: CLAUDE_INPUT_BOX,
     // A resumed attempt lands in the same painted editor, so it carries the same ghost-text suppression
     // and the same value-then-flag placement.
-    resumeCommand: (sessionId, promptFile, model) => `claude -r ${shq(sessionId)} --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --settings '{"promptSuggestionEnabled":false}' --prompt-suggestions false --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`,
+    resumeCommand: (sessionId, promptFile, model, effort) => `claude -r ${shq(sessionId)} --model ${shq(model)}${claudeEffortFlag(effort)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --settings '{"promptSuggestionEnabled":false}' --prompt-suggestions false --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`,
     invoke(task, _cwd, a, ctx) {
-        return { command: this.headlessCommand(ctx.promptFile, a.model) };
+        return { command: this.headlessCommand(ctx.promptFile, a.model, a.effort) };
     },
     parse: parseWorkerResult,
     collectUsage(cwd, sinceMs) {

package/dist/adapters/codex.js

@@ -89,6 +89,9 @@ const GITDIR_WRITABLE = `-c "sandbox_workspace_write.writable_roots=[\\"$(git re
 // -s/--sandbox workspace-write sandbox (deliberately NOT --dangerously-bypass-approvals-and-sandbox,
 // which would drop the sandbox). Listed by `codex --help` and `codex exec --help` (verified 2026-07-23).
 const CODEX_HOOK_TRUST = "--dangerously-bypass-hook-trust";
+// OBS-1182: config override, not a flag — codex has no --effort. Absent renders nothing (CLI default);
+// placed before --model so --model's value stays the last flag before the prompt, as it always was.
+const codexEffortFlag = (effort) => (effort ? ` -c ${shq(`model_reasoning_effort=${effort}`)}` : "");
 // v1.75 T2 / OBS-137: current Codex workspace-trust prompt (0.144.6). The exact heading
 // is distinct from normal agent output; Enter accepts the selected "Yes, continue" option.
 export const CODEX_TRUST_DIALOG = {
@@ -240,7 +243,7 @@ export const codex = {
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
     // MCP suppression built per dispatch (config can change between runs) — see codexMcpSuppressionFlags.
     // CODEX_HOOK_TRUST (OBS-125) clears the per-worktree "Hooks need review" gate while keeping the sandbox.
-    headlessCommand: (promptFile, model) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} - < ${shq(promptFile)}`,
+    headlessCommand: (promptFile, model, effort) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE}${codexEffortFlag(effort)} --model ${shq(model)} - < ${shq(promptFile)}`,
     // OBS-930: the visible pane runs the REAL TUI. Codex's TUI takes its prompt only as the [PROMPT]
     // positional (`codex --help`, 0.153.4 — no file/stdin form), so the launch inlines the file exactly
     // as the claude adapter does: the prompt is the LAST positional and every flag value is followed by
@@ -251,11 +254,11 @@ export const codex = {
     // autonomous approval policy (exec has no approvals to configure).
     // OBS-930 (Linux): the inlined prompt is ONE argv string and Linux caps one at 131072 bytes, so a
     // prompt over promptArgvCeiling() returns null → worker-mode-fallback → the headless form (types.ts).
-    interactiveCommand: (promptFile, model) => promptFitsArgv(promptFile)
-        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
+    interactiveCommand: (promptFile, model, effort) => promptFitsArgv(promptFile)
+        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
         : null,
     invoke(task, _cwd, a, ctx) {
-        return { command: this.headlessCommand(ctx.promptFile, a.model) };
+        return { command: this.headlessCommand(ctx.promptFile, a.model, a.effort) };
     },
     parse: parseWorkerResult,
     // v1.22 T5: seed [projects."<repoRoot>"] trust_level="trusted" so fresh worktrees never stall on

package/dist/adapters/prompt.d.ts

@@ -13,3 +13,4 @@ export declare function parseWorkerResult(raw: string, nonce: string): Classifie
 export type DeadChannelReason = "auth-required" | "setup-required" | "provider-outage" | "timeout";
 export declare function classifyTransientCapacity(result: WorkerResult): RegExpExecArray | null;
 export declare function classifyDeadChannel(result: WorkerResult): DeadChannelReason | undefined;
+export declare const BOOTSTRAP_FAILURE_RE: RegExp;

package/dist/adapters/prompt.js

@@ -68,8 +68,9 @@ function workerVerdictWitness(raw, nonce, positions) {
         return raw;
     return `{"nonce":${JSON.stringify(nonce)},"ok":false,`;
 }
-// v1.65 T1: the parse boundary's own no-trailer sentinel summaries. classifyDeadChannel keys on
-// these — a result carrying any other summary is a PARSED trailer, i.e. the worker speaking.
+// v1.65 T1: the parse boundary's own no-trailer sentinel summaries — display text only. OBS-1175:
+// classifiers key on the parser's `cause`, never on these: a PARSED trailer may carry either string
+// as its own summary, and it is still the worker speaking.
 export const NO_TRAILER_SUMMARY = "worker produced no TICKMARKR_RESULT trailer";
 export const UNPARSEABLE_TRAILER_SUMMARY = "unparseable TICKMARKR_RESULT trailer";
 // OBS-1062: every interactive TUI echoes the brief into the pane, and the brief carries the trailer
@@ -139,14 +140,12 @@ const TIMEOUT_RE = /\bETIMEDOUT\b|request timed out|connection timed out|deadlin
 // speaking, so a verdict that QUOTES the capacity phrase stays ordinary work evidence. The caller
 // hands in the chrome-filtered banner rows as `raw`, exactly as it does for classifyDeadChannel.
 export function classifyTransientCapacity(result) {
-    if (result.ok || (result.summary !== NO_TRAILER_SUMMARY && result.summary !== UNPARSEABLE_TRAILER_SUMMARY))
-        return null;
-    return CAPACITY_RE.exec(result.raw);
+    return unparsed(result) ? CAPACITY_RE.exec(result.raw) : null;
 }
 export function classifyDeadChannel(result) {
     // A parsed trailer — ok:true OR ok:false — is the worker speaking: genuine work outcomes walk
     // the normal gate/ladder path even when their transcript mentions auth/outage/timeout text.
-    if (result.ok || (result.summary !== NO_TRAILER_SUMMARY && result.summary !== UNPARSEABLE_TRAILER_SUMMARY))
+    if (!unparsed(result))
         return undefined;
     if (AUTH_RE.test(result.raw))
         return "auth-required";
@@ -158,3 +157,12 @@ export function classifyDeadChannel(result) {
         return "timeout";
     return undefined;
 }
+// OBS-1175: the one "no trailer was parsed" test every classifier here shares.
+function unparsed(result) {
+    return !result.ok && result.cause !== undefined;
+}
+// OBS-1169: a CLI that died in its own bootstrap (codex: "account/read failed during TUI bootstrap …
+// (code -32603)") never read the brief. Known bootstrap phrasing only — evidence solely inside the
+// startup prefix the daemon's StartupFailureDetector owns (before any tool frame or input box, in an
+// unsaturated read, inside the startup window); the same words in a worker's tool output are work.
+export const BOOTSTRAP_FAILURE_RE = /\b[\w/-]+ failed during TUI bootstrap\b/i;

package/dist/adapters/registry.js

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { modelLints, suggestOverlay } from "./model-lints.js";
 import { HerdrDriver } from "../drivers/herdr.js";
 import { tickmarkrDir, stateDirName } from "../graph/graph.js";
-import { disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../route/preference.js";
+import { disallowedBy, excludedChannels, exclusionLine, observedIdentity, observedSeat, preferRanks } from "../route/preference.js";
 import { sh } from "../run/git.js";
 import { FakeAdapter } from "./fake.js";
 import { parseWorkerResult } from "./prompt.js";
@@ -581,7 +581,7 @@ export function discoverChannels(cfg, adapters, health, role = "worker") {
         return a.channels(cfg)
             .filter((c) => !invalid.has(c.model) && modelAuthed(h, c.model, cfg.routing.allowUnverifiedModels) && (!s || s.includes(c.model)))
             .map((c) => {
-            const identity = h?.modelAuth?.[c.model]?.identity ?? h?.modelIdentities?.[c.model];
+            const identity = observedIdentity(health, a.id, c.model);
             return identity ? { ...c, identity } : c;
         });
     });
@@ -736,7 +736,7 @@ export function formatDoctorReport(cwd, cfg, health, adapters, opts = {}) {
         for (const m of models) {
             const v = h.modelAuth?.[m];
             const auth = !v ? "unknown" : v.authed ? "authed" : `unauthed: ${trunc(v.reason ?? "probe failed", 40)} (${dateOf(v.probedAt)})`;
-            const d = disallowedBy({ adapter: a.id, model: m }, cfg.routing);
+            const d = disallowedBy(observedSeat(health, a.id, m), cfg.routing);
             const denied = d?.by === "deny" ? d.entry : "—";
             const pref = preferRanks({ adapter: a.id, model: m }, cfg).map((p) => `${p.shape}#${p.rank}`).join(",") || "—";
             statusRows.push(`    ${m.padEnd(w)} ${classified[m].padEnd(8)} ${auth}  denied=${denied}  prefer=${pref}`);

package/dist/adapters/types.d.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import type { TickmarkrConfig, Tier } from "../config/config.js";
-import type { Task } from "../graph/schema.js";
+import type { Effort, Task } from "../graph/schema.js";
+import type { VerdictUnparseableCause } from "../gates/verdict-cause.js";
 export declare const TokenUsageSchema: z.ZodObject<{
     input: z.ZodNumber;
     output: z.ZodNumber;
@@ -15,6 +16,7 @@ export interface Assignment {
     model: string;
     channel: "sub" | "api";
     tier: Tier;
+    effort?: Effort;
 }
 export interface BillingChannel {
     adapter: string;
@@ -23,6 +25,7 @@ export interface BillingChannel {
     channel: "sub" | "api";
     tier: Tier;
     identity?: string;
+    effort?: Effort;
 }
 export declare const MODEL_PROBE_ERRORS: readonly ["EMFILE", "EAGAIN", "ENFILE", "ENOMEM", "ENOSPC"];
 export type ModelProbeError = typeof MODEL_PROBE_ERRORS[number];
@@ -53,6 +56,7 @@ export interface WorkerResult {
     summary: string;
     deviations: string[];
     raw: string;
+    cause?: VerdictUnparseableCause;
 }
 export type SeedBannerConfirmResult = {
     ok: true;
@@ -173,11 +177,11 @@ export interface WorkerAdapter {
     probeConcurrency?: number;
     probe(): Promise<AuthHealth>;
     channels(cfg: TickmarkrConfig): BillingChannel[];
-    headlessCommand(promptFile: string, model: string): string;
+    headlessCommand(promptFile: string, model: string, effort?: Effort): string;
     harnessBannerRows?: readonly string[];
-    interactiveCommand(promptFile: string, model: string): string | null;
+    interactiveCommand(promptFile: string, model: string, effort?: Effort): string | null;
     interactiveSeed?: InteractiveSeed;
-    resumeCommand?(sessionId: string, promptFile: string, model: string): string;
+    resumeCommand?(sessionId: string, promptFile: string, model: string, effort?: Effort): string;
     sessionIdFrom?(output: string): string | undefined;
     resumeUnknownContext?: boolean;
     invoke(task: Task, cwd: string, a: Assignment, ctx: {
@@ -201,6 +205,10 @@ export interface WorkerAdapter {
     };
 }
 export declare function channelsFromConfig(adapterId: string, cfg: TickmarkrConfig): BillingChannel[];
+export declare function configuredEffort(cfg: TickmarkrConfig, seat: {
+    adapter: string;
+    model: string;
+}): Effort | undefined;
 export declare function channelKey(c: {
     adapter: string;
     model: string;

package/dist/adapters/types.js

@@ -249,9 +249,15 @@ export function channelsFromConfig(adapterId, cfg) {
                 model,
                 channel: override?.channel ?? e.channel,
                 tier,
+                ...(override?.effort ? { effort: override.effort } : {}),
             }];
     });
 }
+// OBS-1182: a config-declared seat's launch effort (judge, consult pin) — the same modelOverrides
+// read channelsFromConfig makes for routed channels. Absent = the CLI's own default.
+export function configuredEffort(cfg, seat) {
+    return cfg.tiers[seat.adapter]?.modelOverrides?.[seat.model]?.effort;
+}
 export function channelKey(c) {
     return `${c.adapter}:${c.model}`;
 }

package/dist/cli/commands/approve.d.ts

@@ -1,4 +1,4 @@
-import { Journal, type JournalEvent } from "../../run/journal.js";
+import { Journal, type DecisionBinding, type JournalEvent } from "../../run/journal.js";
 export declare const APPROVAL_DISPOSITIONS: readonly ["dispatch", "waive-gate", "re-dispatch", "fund-fixed-attempt", "fresh-budget"];
 export type ApprovalDisposition = (typeof APPROVAL_DISPOSITIONS)[number];
 /**
@@ -26,6 +26,8 @@ export interface NewestPark {
     failedGate: string | undefined;
     /** A pre-dispatch human gate whose reason marks it permanent by design (see isTombstonePark). */
     tombstone: boolean;
+    /** OBS-1202: a stall park's recorded reap failure (task-human data.reapFailure) — its census is unproven. */
+    reapFailure?: string;
 }
 /**
  * There is no closed park kind for a declaration-shaped retirement, so the evidence is the one the
@@ -41,14 +43,19 @@ export declare function readJournalEvents(journal: Journal): {
     events: JournalEvent[];
     sourceIndexes: number[];
 };
+/** OBS-1178: the token a park is decided by — what status, park notices and the cockpit print. */
+export declare const parkToken: (park: Pick<NewestPark, "line" | "ts">) => string | undefined;
+/** OBS-1178: the newest task-failed row for a task — the failure a failed-task recheck binds to. */
+export declare function newestFailure(events: readonly JournalEvent[], taskId: string, sourceIndexes?: readonly number[]): DecisionBinding | undefined;
 /**
- * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra →
- * approve or recheck; review gate-fail → waive/uphold/recheck; other gate-fail → waive/recheck; a
+ * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra, and
+ * a stall park that recorded a reapFailure (OBS-1202), → approve or recheck; review gate-fail →
+ * waive/uphold/recheck; other gate-fail → waive/recheck; a
  * gate-fail park with no failed-gate evidence, or a tombstone → nothing (a diagnostic, never a
  * fabricated verb). The refusals in `approve` below enforce the same table; this is the one place a
  * surface may read it from, so what a menu offers and what the command accepts cannot drift.
  */
-export declare function permittedDecisionVerbs(park: Pick<NewestPark, "kind" | "failedGate" | "tombstone"> | undefined): readonly DecisionVerb[];
+export declare function permittedDecisionVerbs(park: Pick<NewestPark, "kind" | "failedGate" | "tombstone" | "reapFailure"> | undefined): readonly DecisionVerb[];
 /** The release marker this command appends for a verb on a park — the fact a read-back must match. */
 export declare function releaseForDecision(verb: DecisionVerb, park: Pick<NewestPark, "kind" | "failedGate">): string | undefined;
 export type ApprovalStatus = "deferred-live" | "recorded-no-owner";