tickmarkr 2.6.1 → 2.6.3

package/dist/run/git.d.ts

@@ -277,6 +277,14 @@ export type BaseContainment = {
  * future `git cherry` ever emitted a `-` line for a merge.
  */
 export declare function declaredBaseContainment(cwd: string, declaredRef: string, targetRef?: string): Promise<BaseContainment>;
+/**
+ * OBS-1107: does `dest` already hold everything `commit` changed? Replays the commit's OWN
+ * parent-to-commit change onto `dest` as a three-way merge; a clean merge whose tree IS `dest`'s tree
+ * brings nothing the destination lacks — a content-empty commit, or a patch already represented there
+ * under another hash. Content, never hash identity. Any git failure (a root commit, a git without
+ * `merge-tree --merge-base`) answers false: unproven work stays unaccounted.
+ */
+export declare function changeRepresented(cwd: string, commit: string, dest?: string): Promise<boolean>;
 export declare function removeWorktree(repo: string, dir: string): Promise<void>;
 export declare const REFS_PREFLIGHT_PREFIX = "refs/tickmarkr/preflight";
 export declare const REFS_PROBE_REMEDY = "run from the main repository or a full clone; a sandbox that denies writes under that path cannot host a run";

package/dist/run/git.js

@@ -863,6 +863,20 @@ export async function declaredBaseContainment(cwd, declaredRef, targetRef = "HEA
     }
     return missing.length > 0 ? { result: "drifted", missing } : { result: "contained", via: "patch-id" };
 }
+/**
+ * OBS-1107: does `dest` already hold everything `commit` changed? Replays the commit's OWN
+ * parent-to-commit change onto `dest` as a three-way merge; a clean merge whose tree IS `dest`'s tree
+ * brings nothing the destination lacks — a content-empty commit, or a patch already represented there
+ * under another hash. Content, never hash identity. Any git failure (a root commit, a git without
+ * `merge-tree --merge-base`) answers false: unproven work stays unaccounted.
+ */
+export async function changeRepresented(cwd, commit, dest = "HEAD") {
+    const merged = await shGit(`git merge-tree --write-tree --merge-base=${shq(`${commit}^`)} ${shq(dest)} ${shq(commit)}`, cwd);
+    if (merged.code !== 0)
+        return false;
+    const tree = await shGit(`git rev-parse ${shq(`${dest}^{tree}`)}`, cwd);
+    return tree.code === 0 && merged.stdout.split("\n")[0].trim() === tree.stdout.trim();
+}
 export async function removeWorktree(repo, dir) {
     await shGit(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
     await shGit(`rm -rf ${shq(dir)}`, repo);

package/dist/run/interactive-seed.d.ts

@@ -1,4 +1,5 @@
 import { type Assignment, type WorkerAdapter } from "../adapters/types.js";
+import { DeliveryReadinessError } from "../drivers/herdr.js";
 import type { ExecutorDriver, Slot } from "../drivers/types.js";
 export interface InteractiveSeedResult {
     output: string;
@@ -8,6 +9,9 @@ export interface InteractiveSeedResult {
     trustAnswered: boolean;
 }
 type SeedDriver = Pick<ExecutorDriver, "run" | "waitOutput" | "read" | "sendKey">;
+export declare class SeedReadinessError extends DeliveryReadinessError {
+    constructor(waitedMs: number, transcript: string, readinessMatch: string);
+}
 export declare function runInteractiveSeed(opts: {
     driver: SeedDriver;
     slot: Slot;

package/dist/run/interactive-seed.js

@@ -1,4 +1,5 @@
 import { matchesTrustDialog } from "../adapters/types.js";
+import { DeliveryReadinessError } from "../drivers/herdr.js";
 // The workspace-trust prompt is a STARTUP gate: it renders before the readiness banner and blocks
 // it, so this wait is the only window in which anything can answer it. Observation therefore runs
 // for the WHOLE readiness budget. Review round 7 (material): a 60-second cutoff here was a window
@@ -9,6 +10,18 @@ import { matchesTrustDialog } from "../adapters/types.js";
 // blocked anyway, and it ends at the first of readiness, a modal, or the deadline.
 const TRUST_POLL_MS = 1_000;
 const TRUST_PANE_ROWS = 80;
+// OBS-1205 add.1: a launch whose readiness never appeared never received the brief, so its deadline is
+// the delivery-readiness class (OBS-142: the interface never became interactive), not a launched
+// worker. Thrown as that class, the daemon's existing catch journals `delivery-readiness-failed`,
+// closes the slot and walks the escalation ladder to a failover — with no `worker-launch` row, which is
+// where a funded repair's findings expire, so the repair the seed never delivered stays owed.
+export class SeedReadinessError extends DeliveryReadinessError {
+    constructor(waitedMs, transcript, readinessMatch) {
+        super(waitedMs, transcript);
+        this.name = "SeedReadinessError";
+        this.message = `seed readiness pattern not seen after ${waitedMs}ms: ${readinessMatch}`;
+    }
+}
 // v1.89 T19 / OBS-406: wait for readiness, answering a fingerprint-matched trust modal at most ONCE
 // on the way. The daemon's own trust loop runs only after runInteractiveSeed returns, and this wait
 // is exactly the window the modal blocks in — a declaration consulted only there is unreachable
@@ -17,23 +30,34 @@ async function awaitReadiness(opts) {
     const { driver, slot, readinessMatch, deadline } = opts;
     const dialog = opts.adapter.trustDialog;
     const left = () => Math.max(0, deadline - Date.now());
+    // Every wait below is awaited, and the budget can run out inside any of them (OrcaDriver.waitOutput
+    // checks its sweep before its clock). Readiness a wait returns after the deadline is expired — it may
+    // be what a key pressed at the edge produced — and a launch whose deadline passed has already
+    // failed, so neither a key nor a seed follows it. Both branches apply it.
+    const expired = () => Date.now() >= deadline;
+    const readyInTime = async (ms) => (await driver.waitOutput(slot, readinessMatch, ms)) && !expired();
     // Nothing this launch could answer (no declaration, an honest {kind:"none"}, or a driver with no
-    // keystroke surface): the single long wait, byte-identical to pre-T19 behaviour.
+    // keystroke surface): the single long wait, pre-T19 behaviour plus the post-await deadline check.
     if (!dialog || dialog.kind === "none" || !driver.sendKey) {
-        return { ready: await driver.waitOutput(slot, readinessMatch, left()), trustAnswered: false };
+        return { ready: await readyInTime(left()), trustAnswered: false };
     }
     let trustAnswered = false;
-    while (!trustAnswered && left() > 0) {
-        if (await driver.waitOutput(slot, readinessMatch, Math.min(TRUST_POLL_MS, left()))) {
+    while (!trustAnswered && !expired()) {
+        if (await readyInTime(Math.min(TRUST_POLL_MS, left()))) {
             return { ready: true, trustAnswered };
         }
         let paneText;
         try {
-            paneText = await driver.read(slot, TRUST_PANE_ROWS);
+            // OBS-1205: a cursor-drawn modal has text only on the RENDERED frame, so the slot's screen read
+            // is preferred when its driver has one. An unreadable or foreign frame is a failed read, never
+            // a cue to match the stream instead; drivers without a screen keep polling `read`.
+            paneText = await (slot.readScreen ? slot.readScreen() : driver.read(slot, TRUST_PANE_ROWS));
         }
         catch {
             continue; // a failed read is not a matched modal — keep observing, spend nothing
         }
+        if (expired())
+            break; // the wait or the read outlived the budget: no key after the deadline
         if (!matchesTrustDialog(paneText, dialog))
             continue;
         // Review round 7 (material): the latch is spent BEFORE the awaited send, not after it. A send
@@ -54,7 +78,8 @@ async function awaitReadiness(opts) {
             /* dispatched-then-rejected: never retried here, and never re-tried by the daemon either */
         }
     }
-    return { ready: await driver.waitOutput(slot, readinessMatch, left()), trustAnswered };
+    // An expired budget gets no closing sweep: a zero-length wait still reads the terminal once.
+    return { ready: !expired() && await readyInTime(left()), trustAnswered };
 }
 // v1.69 T6: launch-then-seed handoff for adapters whose real TUI cannot be argv-seeded.
 // Both the launch command and the seed line are delivered through the driver's existing `run`
@@ -65,6 +90,8 @@ export async function runInteractiveSeed(opts) {
     await opts.driver.run(opts.slot, seed.launch(opts.assignment.model));
     // `trustAnswered` rides EVERY return below, including both early ones: the daemon initializes its
     // per-slot latch from it, and an omission there reads as "no key was sent" — the second-Enter defect.
+    // The readiness deadline throws instead; `onTrustAnswered` already carried the latch out.
+    const launchedAt = Date.now();
     const { ready, trustAnswered } = await awaitReadiness({
         driver: opts.driver,
         slot: opts.slot,
@@ -74,9 +101,8 @@ export async function runInteractiveSeed(opts) {
         ...(opts.onTrustAnswered ? { onTrustAnswered: opts.onTrustAnswered } : {}),
     });
     const banner = await opts.driver.read(opts.slot, 1000);
-    if (!ready) {
-        return { output: banner, seedFailed: true, seedError: `readiness pattern not seen: ${seed.readinessMatch}`, trustAnswered };
-    }
+    if (!ready)
+        throw new SeedReadinessError(Date.now() - launchedAt, banner, seed.readinessMatch);
     let sessionId;
     if (seed.confirmBanner) {
         const confirm = seed.confirmBanner(banner, opts.assignment.model);

package/dist/run/journal.d.ts

@@ -18,6 +18,8 @@ export interface ResumeState {
     tried: string[];
     lastAssignment?: Assignment;
     upheldFeedback?: string;
+    escalated?: Record<string, string>;
+    escalatedAdapters?: string[];
 }
 export interface CurrentAttemptGateReplay {
     commit: string;
@@ -29,12 +31,70 @@ export declare const ATTEMPT_CAP_RELEASE: "attempt-cap";
 export declare const GATE_SATISFIED_RELEASE: "gate-satisfied";
 export declare const REVIEW_UPHELD_RELEASE: "review-upheld";
 export declare const RECHECK_RELEASE: "recheck";
+export declare const APPROVAL_REFUSED: "approval-refused";
+/** OBS-1178: the journal row a decision answers — its physical 1-based line plus its timestamp. */
+export interface DecisionBinding {
+    line: number;
+    ts: string;
+}
+/** The token every surface prints and `approve --park` accepts: `<line>@<ts>`. */
+export declare const bindingToken: (binding: DecisionBinding) => string;
+export declare function parseBindingToken(token: string): DecisionBinding | undefined;
+/** The binding a task-approved row recorded under `park` or `failure`, when well formed. */
+export declare function recordedBinding(value: unknown): DecisionBinding | undefined;
+/** The newest failed gate before a park row — the gate a waive of that park would satisfy. */
+export declare function failedGateBeforePark(events: readonly JournalEvent[], taskId: string, parkIndex: number): GateName | undefined;
+/** The physical journal line of `events[i]` (see SOURCE_LINE). */
+export declare const physicalLine: (events: readonly JournalEvent[], i: number) => number;
+/** A row parsed outside this module (a cockpit capture) names its own physical line to the decision fold. */
+export declare const withPhysicalLine: <T extends JournalEvent>(row: T, line: number) => T;
+/** OBS-1178: an approval neither enacted nor refused yet, and — when it may not be enacted — why. */
+export interface OpenDecision {
+    taskId: string;
+    line: number;
+    stale?: string;
+}
+/**
+ * OBS-1178: THE decision fold. Every reader of task-approved rows — the replay folds, the daemon's
+ * startup, sweep and pending-action folds, scope-amendment replay and its audits, status and both
+ * cockpits — reads decisions through it, so no two surfaces can disagree on whether one happened.
+ *
+ * `effective` holds the PHYSICAL lines of the task-approved rows whose effects may apply: a row that
+ * was sound when an enactment row consumed it (bound by line and timestamp to the task's newest park,
+ * a waive also to that park's failed gate, or a recheck to the newest failure with no park after it;
+ * a legacy row carrying no binding only when no park or failure landed between it and that
+ * enactment), plus a row still open that is sound NOW. A refused row is never effective, and neither is an open row that no
+ * longer binds — a newer park or failure landed, or it names none — whatever unrelated rows landed
+ * around it. An enactment row also consumes the task's park and failure: a decision naming either
+ * after the task moved on is stale, while the decisions that enactment already consumed stay effective.
+ * `open` lists every unenacted, unrefused row with why it may not be enacted, and `refused` the lines
+ * an approval-refused row answered.
+ */
+export declare function foldDecisions(events: readonly JournalEvent[]): {
+    effective: Set<number>;
+    open: OpenDecision[];
+    refused: Set<number>;
+};
+/** The physical lines of the task-approved rows whose effects may apply (see foldDecisions). */
+export declare const effectiveDecisions: (events: readonly JournalEvent[]) => Set<number>;
+/**
+ * The journal as every decision reader must see it: task-approved rows that are not effective removed,
+ * every other row (and its physical line) kept. Order-only folds iterate this instead of skipping rows
+ * on their own.
+ */
+export declare function effectiveEvents(events: readonly JournalEvent[]): JournalEvent[];
+/** Per task, the open decisions that may not be enacted now — what the daemon refuses before enactment. */
+export interface StaleApprovals {
+    reason: string;
+    lines: number[];
+}
+export declare function staleApprovals(events: readonly JournalEvent[]): Map<string, StaleApprovals>;
 export interface PreservedRef {
     ref: string;
     diffCommand: string;
 }
 export declare function preservedRefsByTask(events: JournalEvent[]): Map<string, PreservedRef[]>;
-export declare function reviewRoundsSinceApproval(events: JournalEvent[], taskId: string): number;
+export declare function reviewRoundsSinceApproval(events: JournalEvent[], taskId: string, rounds?: (decided: JournalEvent[]) => JournalEvent[]): number;
 export declare function upheldFeedbackByTask(events: JournalEvent[]): Map<string, string>;
 export interface StructuredFinding {
     class: string;
@@ -47,6 +107,8 @@ export interface StructuredFinding {
     observedFingerprints?: string[];
     /** Prior id validated against the reviewer's reraised list by the review gate. */
     reraisedFrom?: string;
+    /** OBS-1195: an anchor's explicitly named parent chain; it retires when that chain is resolved. */
+    boundTo?: string;
     /** Resolved definition AND defect identity; bare symbol spelling is never lineage. */
     codeIdentity?: {
         definition: string;
@@ -125,7 +187,10 @@ export declare function formatPriorFindingEvidence(evidence: PriorFindingEvidenc
 /** Normalized identity of a gate failure: the same defect, seen twice, normalizes to the same bytes. */
 export declare function normalizeGateFailure(details: string): string;
 export declare const GATE_FINGERPRINT_CAP = 2;
+/** The invocation a gate row's receipt names — the identity of the execution that observed it. */
+export declare const receiptOrigin: (data: Record<string, unknown>) => string | undefined;
 export declare function identicalGateFailures(events: JournalEvent[], taskId: string, gate: string, normalized: string): number;
+export declare const readableExcerpt: (text: string) => string;
 /** What each funded repair's next battery actually reached. A repair spends its budget only
  * when that battery reaches one of the gates it was funded to fix; an earlier red is evidence that
  * this repair never got its funded turn, not a charge against the repair ladder. */
@@ -177,6 +242,7 @@ export type PendingApprovalAction = {
  * enacts it.
  */
 export declare function pendingApprovalActions(events: JournalEvent[]): Map<string, PendingApprovalAction>;
+export declare function approvalAction(taskId: string, e: JournalEvent): PendingApprovalAction;
 /**
  * Why the last attempt failed, one row per journaled cause, in the daemon's own `source: details`
  * shape. The daemon builds that brief in a loop-local variable, which dies with the process: a resumed
@@ -192,10 +258,20 @@ export declare function pendingApprovalActions(events: JournalEvent[]): Map<stri
  * failures OR the delivery failure that preceded it. Of the approvals, only a WAIVE clears (the operator
  * retired the findings by fiat — the uphold case re-derives its own brief separately). OBS-1074: a
  * plain approve, a scope grant or a recheck re-funds an attempt that must still see why the last one
- * parked, plus the operator's stated reason — v2.5.7's T11 looped four times on one hygiene oracle
- * because every approval erased exactly the finding the fresh attempt was funded to fix.
+ * parked — v2.5.7's T11 looped four times on one hygiene oracle because every approval erased exactly
+ * the finding the fresh attempt was funded to fix. The operator's stated reasons ride after those rows
+ * as `standingRulings` (OBS-1150): no launch and no waive resets them.
  */
 export declare function journaledFailureBrief(events: JournalEvent[], taskId: string): string[];
+/**
+ * OBS-1150: an operator's approval reason is a ruling on the TASK, not on the attempt it released.
+ * The failure rows above are spent at the next worker-launch and the review context once bound only
+ * the newest reason, so ruling A vanished at the first launch after it and a later ruling B replaced
+ * it. Every effective reason therefore stands, oldest first, for the whole run; a repeat is carried
+ * once. A gate-satisfied release accepts a gate's verdict rather than ruling on the work, so its
+ * reason adds no standing ruling — and, being no ruling, it retires none either.
+ */
+export declare function standingRulings(events: JournalEvent[], taskId: string): string[];
 /** Never infer a cross-path alias from a symbol, sentence, or hash. */
 export declare function reviewFingerprintMatches(candidate: unknown, fingerprint: string): boolean;
 export declare function observedReviewFingerprints(finding: StructuredFinding): string[];
@@ -238,7 +314,28 @@ export declare function carryReviewFindings(priors: readonly StructuredFinding[]
  * after round re-seats ONE fingerprint, and a revised rationale replaces the prior rationale on that
  * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
+/** OBS-1151: this task's journaled judgments, newest first — subjects to compare a fresh ruling against,
+ * never verdicts to reuse. A row without a well-formed judgment (legacy, park, unparseable) is skipped. */
+export declare function priorJudgments(events: readonly JournalEvent[], taskId: string): Array<{
+    commit: string;
+    judge?: string;
+    criteria: Array<{
+        id: string;
+        key: string;
+        met: boolean;
+        paths: string[];
+    }>;
+}>;
 export declare function outstandingReviewFindings(events: JournalEvent[], taskId: string): StructuredFinding[];
+/**
+ * OBS-1019 add.2: each outstanding material chain with the number of valid review verdicts that
+ * re-raised it since the last review pass or review-gate waive. Only a chain's own observed spellings
+ * count, so an unrelated finding sharing a path never lengthens it.
+ */
+export declare function reraisedReviewChains(events: JournalEvent[], taskId: string): Array<{
+    finding: StructuredFinding;
+    reraises: number;
+}>;
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export declare function pendingRepairFindings(events: JournalEvent[], taskId: string): string | undefined;
 /**
@@ -256,6 +353,32 @@ export type WorkerResultCause = (typeof WORKER_RESULT_CAUSES)[number];
 export declare function isQualityFailureParkKind(kind: ParkKind): boolean;
 export declare function classifyTaskFailure(taskEvents: JournalEvent[]): ParkKind;
 export declare function recordedTaskFailureKind(events: JournalEvent[], taskId: string): ParkKind | undefined;
+export declare const RESUME_HARVEST_SOURCE: "resume";
+export interface InterruptedAttempt {
+    attempt: number;
+    /** The producing dispatch's own assignment — the author the harvested work is gated under. */
+    assignment: Assignment;
+    /** Owned evidence still to read: nothing of this attempt's harvest is recorded yet. */
+    launch?: {
+        nonce: string;
+        dispatchScript: string;
+        slot: {
+            id: string;
+            name: string;
+            cwd: string;
+        };
+    };
+    /** A worker-result with no harvest row after it: finish that record. `reaped` only when a resume wrote
+     *  it — a resume records the result after its owned-process cleanup; a live daemon records it BEFORE
+     *  handling a failed reap, so its result alone never proves cleanup and `launch` must be reaped again. */
+    result?: {
+        finished: boolean;
+        summary: string;
+        reaped: boolean;
+    };
+}
+export declare function resumeHarvestAuthor(events: JournalEvent[], taskId: string): Assignment | undefined;
+export declare function interruptedAttempt(events: JournalEvent[], taskId: string): InterruptedAttempt | undefined;
 export declare function runHasEnded(events: JournalEvent[]): boolean;
 /** OBS-53: classify worker-result failures so retries and routing see the true signal, not one lumped bucket. */
 export declare function classifyWorkerResultCause(opts: {
@@ -392,6 +515,8 @@ export type EngagementCompare = {
 export declare function engagementComparable(events: JournalEvent[], loadedHash: string): EngagementCompare;
 export declare function newRunId(now?: Date): string;
 export declare function parseRunId(runId: string): string;
+/** The journal reader rule over bytes in hand: skip blanks, drop a torn line, keep each row's physical line. */
+export declare function parseJournalText(raw: string): JournalEvent[];
 export declare function readAllTelemetry(repoRoot: string, lastK: number, opts?: {
     after?: string;
 }): (TelemetryRow & {
@@ -402,6 +527,23 @@ export declare const PRIOR_JOURNAL_RUN_WINDOW = 50;
 export declare function readPriorRunEvidence(repoRoot: string, tasks: readonly Pick<Task, "id" | "goal" | "files" | "acceptance">[], opts?: {
     suppressRunId?: string;
 }): PriorRunEvidence;
+export declare const REVIEW_NO_VERDICT_RUN_WINDOW = 10;
+export declare const REVIEW_NO_VERDICT_ADVISORY_AT = 2;
+export interface ReviewNoVerdictHistory {
+    /** completed runs measured, oldest first */
+    runs: string[];
+    /** window journals with a row that did not parse — their events are unknown, never zero */
+    unreadable: string[];
+    /** reviewer channel → review-no-verdict events; every channel seen reviewing is present, 0 included */
+    counts: Map<string, number>;
+}
+export declare function readReviewNoVerdictHistory(repoRoot: string, window?: number): ReviewNoVerdictHistory;
+/** One row per measured channel (plus one naming unreadable journals); doctor prints all, Fleet the warn rows. */
+export declare function reviewNoVerdictRows(history: ReviewNoVerdictHistory): {
+    channel: string;
+    verdict: "pass" | "warn";
+    value: string;
+}[];
 export declare function readProfileCursor(repoRoot: string): string | undefined;
 export declare function profileDiscountsPath(repoRoot: string): string;
 export declare function readProfileDiscounts(repoRoot: string): ProfileDiscount[];
@@ -424,6 +566,13 @@ export declare class Journal {
     append(event: string, taskId?: string, data?: Record<string, unknown>): void;
     phaseStart(taskId: string, phase: TaskPhase, data?: Record<string, unknown>): void;
     read(): JournalEvent[];
+    /** Parsed rows paired with their physical 1-based journal lines (OBS-1178 bindings name lines). */
+    readSourced(): {
+        events: JournalEvent[];
+        lines: number[];
+    };
+    /** OBS-1178: the binding of a task's newest park (or `task-failed`) row — what a decision on it names. */
+    newestBinding(taskId: string, event?: "task-human" | "task-failed"): DecisionBinding | undefined;
     readTracked(): TrackedJournalRow[];
     replayStatuses(): Map<string, TaskStatus>;
     /**