tickmarkr 2.6.1 → 2.6.3

package/dist/cli/commands/approve.js

@@ -5,7 +5,7 @@ import { loadConfig } from "../../config/config.js";
 import { integrationBranch } from "../../run/merge.js";
 import { separabilityErrors, surfaceErrors, taskBudgetErrors } from "../../compile/collateral.js";
 import { GATE_NAMES } from "../../graph/schema.js";
-import { applyScopeAmendments, engagementComparable, engagementReleased, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
+import { applyScopeAmendments, bindingToken, engagementComparable, engagementReleased, failedGateBeforePark, parseBindingToken, physicalLine, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
 export const APPROVAL_DISPOSITIONS = ["dispatch", "waive-gate", "re-dispatch", "fund-fixed-attempt", "fresh-budget"];
 /**
  * What each disposition's release actually buys — the clause every operator-facing sentence about
@@ -56,9 +56,10 @@ sourceIndexes) {
         const kind = typeof e.data.kind === "string" ? e.data.kind : undefined;
         const reason = typeof e.data.reason === "string" ? e.data.reason : undefined;
         return {
-            index: i, line: (sourceIndexes?.[i] ?? i) + 1, ts: typeof e.ts === "string" ? e.ts : undefined, kind, reason,
+            index: i, line: sourceIndexes?.[i] === undefined ? physicalLine(events, i) : sourceIndexes[i] + 1, ts: typeof e.ts === "string" ? e.ts : undefined, kind, reason,
             approveCommand: typeof e.data.approveCommand === "string" ? e.data.approveCommand : undefined,
-            failedGate: failedGateForNewestPark(events, taskId, i), tombstone: isTombstonePark(kind, reason),
+            failedGate: failedGateBeforePark(events, taskId, i), tombstone: isTombstonePark(kind, reason),
+            ...(kind === "stall" && typeof e.data.reapFailure === "string" ? { reapFailure: e.data.reapFailure } : {}),
         };
     }
     return undefined;
@@ -71,9 +72,21 @@ export function readJournalEvents(journal) {
         sourceIndexes: tracked.map((row) => row.sourceIndex),
     };
 }
+/** OBS-1178: the token a park is decided by — what status, park notices and the cockpit print. */
+export const parkToken = (park) => park.ts === undefined ? undefined : bindingToken({ line: park.line, ts: park.ts });
+/** OBS-1178: the newest task-failed row for a task — the failure a failed-task recheck binds to. */
+export function newestFailure(events, taskId, sourceIndexes) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.event === "task-failed" && e.taskId === taskId && typeof e.ts === "string")
+            return { line: sourceIndexes?.[i] === undefined ? physicalLine(events, i) : sourceIndexes[i] + 1, ts: e.ts };
+    }
+    return undefined;
+}
 /**
- * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra →
- * approve or recheck; review gate-fail → waive/uphold/recheck; other gate-fail → waive/recheck; a
+ * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra, and
+ * a stall park that recorded a reapFailure (OBS-1202), → approve or recheck; review gate-fail →
+ * waive/uphold/recheck; other gate-fail → waive/recheck; a
  * gate-fail park with no failed-gate evidence, or a tombstone → nothing (a diagnostic, never a
  * fabricated verb). The refusals in `approve` below enforce the same table; this is the one place a
  * surface may read it from, so what a menu offers and what the command accepts cannot drift.
@@ -88,6 +101,10 @@ export function permittedDecisionVerbs(park) {
     }
     if (park.kind === "infra")
         return ["approve", "recheck"];
+    // OBS-1202: an unreadable reap census parks finished work; recheck re-verifies that census and gates the
+    // harvested commits with no worker. An ordinary stall recorded no census failure: approve alone.
+    if (park.kind === "stall" && park.reapFailure !== undefined)
+        return ["approve", "recheck"];
     // OBS-1084: an authoring park whose newest gate row is a red tool gate is a runner report (a load
     // flake in an unowned suite), so the battery re-runs on the preserved ref with no worker.
     if (park.kind === "authoring" && isToolGate(park.failedGate))
@@ -137,13 +154,17 @@ export function approvalEnactment(token, run) {
 }
 /** The production command registered in COMMANDS; its returned bytes are what the CLI prints. */
 export async function approve(argv, cwd = process.cwd()) {
-    const { runId, taskId, by, reason, waive, uphold, recheck, reviewRoundCeiling, files } = parseArgs(argv);
+    const { runId, taskId, by, reason, waive, uphold, recheck, reviewRoundCeiling, files, park: namedPark, gate: namedGate } = parseArgs(argv);
     const decisions = [waive, uphold, recheck].filter(Boolean).length;
     if (decisions > 1)
         throw new Error("--waive, --uphold and --recheck are different decisions — pass one");
+    // OBS-1178: the decision binds at COMMAND time — to the named --park, else to the park (or, for a
+    // failed task's recheck, the failure) open now — and is revalidated under serialization below. A
+    // decision queued behind another approval can therefore never land on a park that opened meanwhile.
+    // Journal.open throws `no journal for <runId> at <dir>` on an unknown run — that IS the refusal.
+    const bound = namedPark ?? openDecision(Journal.open(cwd, runId), taskId);
     const serialization = await acquireApprovalSerialization(cwd, runId);
     try {
-        // Journal.open throws `no journal for <runId> at <dir>` on an unknown run — that IS the refusal.
         const journal = Journal.open(cwd, runId);
         const status = journal.replayStatuses().get(taskId);
         if (status === undefined) {
@@ -153,13 +174,17 @@ export async function approve(argv, cwd = process.cwd()) {
         // integration base owns verified-able work; --recheck re-gates that tree with no worker. Any other
         // verb on a failed task, or a recheck over nothing landed, is refused naming why.
         if (status === "failed" && recheck) {
+            if (namedGate !== undefined)
+                throw new Error(`--gate names a parked failed gate; task ${taskId} is failed — bind its recheck with --park <failure token>`);
+            const { events: failedEvents, sourceIndexes: failedIndexes } = readJournalEvents(journal);
+            const failure = requireBound(runId, taskId, bound, newestFailure(failedEvents, taskId, failedIndexes), "failure");
             const ahead = failedTaskCommitsAhead(cwd, journal, runId, taskId);
             if (ahead.count === 0) {
                 throw new Error(`task ${taskId} is failed and ${ahead.ref} carries no commits ahead of ${ahead.base} — nothing to re-gate; use resume --retry-failed to fund a worker`);
             }
             journal.append("task-approved", taskId, {
                 by, ...(reason ? { reason } : {}), via: "cli", release: RECHECK_RELEASE,
-                recheckedRef: ahead.ref, commitsAhead: ahead.count,
+                recheckedRef: ahead.ref, commitsAhead: ahead.count, failure,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
             return disposition(cwd, runId, "re-dispatch", `re-checking failed ${taskId} in ${runId} — by ${by}; ${ahead.count} commit(s) on ${ahead.ref} ahead of ${ahead.base}; no worker funded`, serialization.contended);
@@ -177,7 +202,12 @@ export async function approve(argv, cwd = process.cwd()) {
         const gateFailPark = park?.kind === "gate-fail";
         const infraPark = park?.kind === "infra" || park?.kind === "diff-cap";
         const authoringRunnerPark = park?.kind === "authoring" && isToolGate(park.failedGate);
+        const reapFailurePark = park?.kind === "stall" && park.reapFailure !== undefined;
         const failedGate = gateFailPark || authoringRunnerPark ? park?.failedGate : undefined;
+        const parkBinding = requireBound(runId, taskId, bound, park?.ts === undefined ? undefined : { line: park.line, ts: park.ts }, "park");
+        if (namedGate !== undefined && namedGate !== park?.failedGate) {
+            throw new Error(`refusing mismatched gate for ${taskId}: --gate ${namedGate} but park ${bindingToken(parkBinding)} failed ${park?.failedGate ?? "no gate"} — nothing appended`);
+        }
         if ((park?.kind === "scope-request" && !decisions) || files !== undefined) {
             if (park?.kind !== "scope-request")
                 throw new Error("--files requires a scope-request park");
@@ -209,7 +239,7 @@ export async function approve(argv, cwd = process.cwd()) {
                     + `remedy: close the run, split the task in its spec, recompile, then \`tickmarkr resume ${runId} --graph-changed\``);
             }
             journal.append("task-approved", taskId, {
-                by, ...(reason ? { reason } : {}), via: "cli", release: "scope-request",
+                by, ...(reason ? { reason } : {}), via: "cli", release: "scope-request", park: parkBinding,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }), // OBS-1083
                 amendment: { from, to: graphDefinitionHash(amended), beforeFiles: task.files, files: amendedFiles, parkLine: park.line, definition: taskDefinitionFingerprint(task) },
             });
@@ -234,12 +264,16 @@ export async function approve(argv, cwd = process.cwd()) {
                 via: "cli",
                 release: REVIEW_UPHELD_RELEASE,
                 gate: "review",
+                park: parkBinding,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
             return disposition(cwd, runId, "fund-fixed-attempt", `upheld the reviewer for ${taskId} in ${runId} — by ${by}`, serialization.contended);
         }
         if (recheck) {
-            if ((!gateFailPark || !failedGate) && !infraPark && !authoringRunnerPark) {
+            if (park?.kind === "stall" && !reapFailurePark) {
+                throw new Error(`--recheck applies to a stall park only when it recorded a reapFailure (census recovery); ${taskId}'s stall park recorded none — plain approve dispatches a worker; refusing`);
+            }
+            if ((!gateFailPark || !failedGate) && !infraPark && !authoringRunnerPark && !reapFailurePark) {
                 throw new Error(`--recheck applies to a gate-fail, infra, diff-cap or red-tool-gate authoring park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
             journal.append("task-approved", taskId, {
@@ -247,13 +281,16 @@ export async function approve(argv, cwd = process.cwd()) {
                 ...(reason ? { reason } : {}),
                 via: "cli",
                 release: RECHECK_RELEASE,
+                park: parkBinding,
                 // OBS-1084: failedGate names the runner report for every recheck. Authoring rechecks additionally
                 // carry gate so their durable release row identifies the red tool gate that made recheck admissible.
                 ...(failedGate ? { failedGate } : {}),
                 ...(authoringRunnerPark && failedGate ? { gate: failedGate } : {}),
+                // OBS-1202: the daemon re-verifies the parked attempt's owned census before any gate runs.
+                ...(reapFailurePark ? { reapFailure: park.reapFailure } : {}),
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
-            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : `${park.kind} park`}; no gate marked satisfied`, serialization.contended);
+            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : reapFailurePark ? "reapFailure stall park; the owned census is re-verified before the gates" : `${park.kind} park`}; no gate marked satisfied`, serialization.contended);
         }
         if (waive) {
             if (!gateFailPark || !failedGate) {
@@ -265,6 +302,7 @@ export async function approve(argv, cwd = process.cwd()) {
                 via: "cli",
                 release: GATE_SATISFIED_RELEASE,
                 gate: failedGate,
+                park: parkBinding,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
             return disposition(cwd, runId, "waive-gate", `waived failed gate ${failedGate} for ${taskId} in ${runId} — by ${by}`, serialization.contended);
@@ -292,6 +330,7 @@ export async function approve(argv, cwd = process.cwd()) {
             via: "cli",
             ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             ...(capPark ? { release: ATTEMPT_CAP_RELEASE } : {}),
+            park: parkBinding,
         });
         const token = capPark ? "fresh-budget" : "dispatch";
         return disposition(cwd, runId, token, `approved ${taskId} in ${runId} — by ${by}`, serialization.contended);
@@ -300,6 +339,23 @@ export async function approve(argv, cwd = process.cwd()) {
         serialization.release();
     }
 }
+/** The row a decision on this task answers right now: its newest failure when failed, else its newest park. */
+function openDecision(journal, taskId) {
+    const { events, sourceIndexes } = readJournalEvents(journal);
+    if (journal.replayStatuses().get(taskId) === "failed")
+        return newestFailure(events, taskId, sourceIndexes);
+    const park = newestPark(events, taskId, sourceIndexes);
+    return park?.ts === undefined ? undefined : { line: park.line, ts: park.ts };
+}
+/** OBS-1178: under serialization, the decision's command-time binding must still name the open row. */
+function requireBound(runId, taskId, bound, open, what) {
+    if (open === undefined)
+        throw new Error(`task ${taskId} has no ${what} row with a timestamp to bind this decision to — refusing an unbound release`);
+    if (bound === undefined || bound.line !== open.line || bound.ts !== open.ts) {
+        throw new Error(`refusing stale decision for ${taskId}: bound to ${bound === undefined ? "no open row" : `${what} ${bindingToken(bound)}`} but the open ${what} is ${bindingToken(open)} — read \`tickmarkr status ${runId}\` and decide the open ${what}; nothing appended`);
+    }
+    return open;
+}
 /**
  * OBS-1022: what a failed task has landed. A preserved snapshot is authoritative only when it contains
  * the current task-branch tip; an older preservation can remain in the journal after a later retry has
@@ -365,12 +421,14 @@ function disposition(cwd, runId, token, message, contended) {
     };
     return `${out}\nTICKMARKR_APPROVAL ${JSON.stringify(record)}`;
 }
-const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--files <glob,…>] [--waive|--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
+const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--park <line>@<ts>] [--gate <gate>] [--files <glob,…>] [--waive|--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
 // hand-parsed argv — no CLI framework (house style). Positionals are runId then taskId; decision,
 // ceiling, actor and reason are flags. Throws usage on missing positionals (mirrors resume.ts/unlock.ts).
 function parseArgs(argv) {
     const positionals = [];
     let files;
+    let park;
+    let gate;
     let by;
     let reason;
     let waive = false;
@@ -388,6 +446,17 @@ function parseArgs(argv) {
                 throw new Error("--files requires non-empty repository-relative globs");
             }
         }
+        else if (a === "--park") {
+            const value = argv[++i];
+            park = value === undefined ? undefined : parseBindingToken(value);
+            if (!park)
+                throw new Error("--park requires the <line>@<ts> token `tickmarkr status` prints for the park");
+        }
+        else if (a === "--gate") {
+            gate = argv[++i];
+            if (!gate || !GATE_NAMES.includes(gate))
+                throw new Error(`--gate requires one of ${GATE_NAMES.join(", ")}`);
+        }
         else if (a === "--by") {
             by = argv[++i];
             if (!by)
@@ -424,19 +493,5 @@ function parseArgs(argv) {
     if (!runId || !taskId) {
         throw new Error(USAGE);
     }
-    return { runId, taskId, by: by ?? userInfo().username, reason, waive, uphold, recheck, reviewRoundCeiling, files };
-}
-function failedGateForNewestPark(events, taskId, lastHumanIndex) {
-    for (let i = lastHumanIndex - 1; i >= 0; i -= 1) {
-        const event = events[i];
-        if (event.taskId !== taskId)
-            continue;
-        if (event.event === "task-approved" || event.event === "task-human" || event.event === "task-dispatch")
-            return undefined;
-        if (event.event === "gate-result" && event.data.pass === false
-            && typeof event.data.gate === "string" && GATE_NAMES.includes(event.data.gate)) {
-            return event.data.gate;
-        }
-    }
-    return undefined;
+    return { runId, taskId, by: by ?? userInfo().username, reason, waive, uphold, recheck, reviewRoundCeiling, files, park, gate };
 }

package/dist/cli/commands/compile.js

@@ -2,8 +2,9 @@ import { isAbsolute, join } from "node:path";
 import { parseArgs } from "node:util";
 import { collateralLints, sourceScopeFindings, sourceScopeLints, } from "../../compile/collateral.js";
 import { CompileError } from "../../compile/common.js";
+import { readDoctor } from "../../adapters/registry.js";
 import { loadConfig } from "../../config/config.js";
-import { denyPreferCollisionLine, denyPreferCollisions } from "../../route/preference.js";
+import { deadPoolEntries, deadPoolEntryLine, denyPreferCollisionLine, denyPreferCollisions } from "../../route/preference.js";
 import { compileSource } from "../../compile/index.js";
 import { retiredLiteralErrors } from "../../compile/retired-literals.js";
 import { clearCompileRefusal, saveCompileRefusal, saveGraph, stateDirName } from "../../graph/graph.js";
@@ -88,11 +89,20 @@ export async function compile(argv, cwd = process.cwd(), harnessFrom = process.a
         // that uses it; plan already said so, compile now refuses the seal before any state write so a dry
         // run reaches the same refusal. Pool only: a partial deny leaves live members, and pin/prefer
         // collisions on the default map stay doctor's and resume's business. Scoped to the graph's shapes.
-        const deadPools = denyPreferCollisions(loadConfig(cwd), g.tasks.map((task) => task.shape))
+        // OBS-1143: aliases are judged by doctor's CACHED identity — compile never spends a probe.
+        const routingCfg = loadConfig(cwd);
+        const shapes = g.tasks.map((task) => task.shape);
+        const health = readDoctor(cwd);
+        const deadPools = denyPreferCollisions(routingCfg, shapes, health)
             .filter((collision) => collision.kind === "pool");
         if (deadPools.length > 0) {
             throw new CompileError(`${src} routes a task shape to a fully denied pool:\n${deadPools.map((collision) => `  - ${denyPreferCollisionLine(collision)}`).join("\n")}${diagnostics}`);
         }
+        // OBS-1144: a partial deny compiles, as the router routes it — but each skipped entry is named.
+        const skippedPoolEntries = deadPoolEntries(routingCfg, shapes, health).map(deadPoolEntryLine);
+        const poolNotes = skippedPoolEntries.length
+            ? `\npool notes:\n${skippedPoolEntries.map((line) => `  ! ${line}`).join("\n")}`
+            : "";
         // One bounded read supplies both cross-run surfaces: unresolved findings below and merge facts for
         // the ancestry check. Neither fact mutates the compiled graph; status and every readiness predicate
         // remain the source compiler's answer.
@@ -121,7 +131,7 @@ export async function compile(argv, cwd = process.cwd(), harnessFrom = process.a
         const mergeHistory = mergedPending.length
             ? `\nmerge history:\n${mergedPending.map((line) => `  ${line}`).join("\n")}`
             : "";
-        return `${harnessLine(resolveHarness(harnessFrom))}\n${summary}${diagnostics}${priorFindings}${mergeHistory}`;
+        return `${harnessLine(resolveHarness(harnessFrom))}\n${summary}${diagnostics}${poolNotes}${priorFindings}${mergeHistory}`;
     }
     catch (error) {
         // A dry run is a pure validation query. A real authoring refusal records the negative result

package/dist/cli/commands/doctor.d.ts

@@ -162,6 +162,7 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
         modelOverrides?: Record<string, {
             vendor?: string | undefined;
             channel?: "sub" | "api" | undefined;
+            effort?: "low" | "medium" | "high" | undefined;
         }> | undefined;
         windows?: Record<string, number> | undefined;
     }>;
@@ -172,6 +173,8 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
         tipTest?: string | undefined;
         lint?: string | undefined;
         diffCap?: number | undefined;
+        evidenceQuotaBytes?: number | undefined;
+        repairSelection?: boolean | undefined;
         byShape?: Partial<Record<"plan" | "spec" | "implement" | "tests" | "docs" | "migration" | "ui" | "refactor" | "chore", {
             [x: string]: unknown;
             acceptance?: boolean | undefined;
@@ -205,8 +208,8 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
     };
     executionPolicy?: {
         boundedInfrastructure: boolean;
-        repairSelection: boolean;
         taskExecutionLimitMs: number;
+        repairSelection?: boolean | undefined;
     } | undefined;
     setup?: string | undefined;
     cost?: {
@@ -286,6 +289,7 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
         modelOverrides?: Record<string, {
             vendor?: string | undefined;
             channel?: "sub" | "api" | undefined;
+            effort?: "low" | "medium" | "high" | undefined;
         }> | undefined;
         windows?: Record<string, number> | undefined;
     }>;
@@ -296,6 +300,8 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
         tipTest?: string | undefined;
         lint?: string | undefined;
         diffCap?: number | undefined;
+        evidenceQuotaBytes?: number | undefined;
+        repairSelection?: boolean | undefined;
         byShape?: Partial<Record<"plan" | "spec" | "implement" | "tests" | "docs" | "migration" | "ui" | "refactor" | "chore", {
             [x: string]: unknown;
             acceptance?: boolean | undefined;
@@ -329,8 +335,8 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
     };
     executionPolicy?: {
         boundedInfrastructure: boolean;
-        repairSelection: boolean;
         taskExecutionLimitMs: number;
+        repairSelection?: boolean | undefined;
     } | undefined;
     setup?: string | undefined;
     cost?: {

package/dist/cli/commands/doctor.js

@@ -14,10 +14,11 @@ import { loadConfig, overlayPreferShapes } from "../../config/config.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
 import { ORCA_FIXTURE_VERSION, parseEnvelope, resolveOrcaCliBinary } from "../../drivers/orca.js";
 import { kimi, probeKimiDoctorTurn } from "../../adapters/kimi.js";
-import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
+import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, observedSeat, preferRanks } from "../../route/preference.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, LIVEBENCH_TABLE_DATE, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { sh } from "../../run/git.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
+import { readReviewNoVerdictHistory, reviewNoVerdictRows } from "../../run/journal.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
  *  concatenation and publishes no index, so the release listing is the only enumerable surface. */
 export const LIVEBENCH_RELEASES_URL = "https://api.github.com/repos/LiveBench/livebench.github.io/contents/public";
@@ -670,6 +671,13 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             rows.push(alignedStatusRow("warn", demotion.reviewer, `${demotion.count} review seat${demotion.count === 1 ? "" : "s"} demoted · cause ${causes}`));
         }
     }
+    // OBS-1052(3): measured, never inferred — an unreadable journal renders unknown, not a clean zero.
+    const noVerdictRows = reviewNoVerdictRows(readReviewNoVerdictHistory(cwd));
+    if (noVerdictRows.length) {
+        rows.push(legend("review no-verdict history:"));
+        for (const row of noVerdictRows)
+            rows.push(alignedStatusRow(row.verdict, row.channel, row.value));
+    }
     if (existsSync(graphPath(cwd))) {
         try {
             const graph = loadGraph(cwd);
@@ -780,7 +788,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     const excluded = excludedChannels(cfg, adapters, health);
     if (excluded.length)
         lintRows.push(attentionRow(exclusionLine(excluded)));
-    lintRows.push(...denyPreferCollisions(cfg).map((c) => attentionRow(denyPreferCollisionLine(c))));
+    lintRows.push(...denyPreferCollisions(cfg, undefined, health).map((c) => attentionRow(denyPreferCollisionLine(c))));
     const aliasExcluded = modelAliasExclusions(cfg, adapters, health);
     if (aliasExcluded.length)
         lintRows.push(attentionRow(modelAliasLine(aliasExcluded)));
@@ -857,7 +865,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
                     : v.authed
                         ? `${ok("authed")}${probed}`
                         : `${fail("unauthed:")} ${trunc(v.reason ?? "probe failed", 40)} (${dateOf(v.probedAt)})`;
-            const d = disallowedBy({ adapter: a.id, model: m }, cfg.routing);
+            const d = disallowedBy(observedSeat(health, a.id, m), cfg.routing);
             const denied = d?.by === "deny" ? d.entry : "—";
             const pref = preferRanks({ adapter: a.id, model: m }, cfg).map((p) => `${p.shape}#${p.rank}`).join(",") || "—";
             const window = declaredModelWindow(cfg, a.id, m);

package/dist/cli/commands/fleet.js

@@ -5,16 +5,16 @@ import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, modelAuthE
 import { catalogModelAdvisory, catalogTierRanking, declaredModelWindow, fleetUnclassifiedModels } from "../../adapters/model-lints.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, readClaudeAliasIdentity } from "../../adapters/claude-code.js";
-import { fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, DENY_SCOPES, initialDenyPropOf, loadConfigWithMode, overlayBytesLoadError, readOverlayFile, stagedDenyKeyOf, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, TIER_RANK, unifiedYamlDiff, } from "../../config/config.js";
+import { ConfigError, fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, DENY_SCOPES, initialDenyPropOf, loadConfigWithMode, lowerLayerModelOverrides, overlayBytesLoadError, readOverlayFile, stagedDenyKeyOf, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, TIER_RANK, unifiedYamlDiff, } from "../../config/config.js";
 import { exclusionReason, projectFleetWhy, renderFleetWhy } from "../../config/fleet-why.js";
 import { SHAPES, TIERS } from "../../graph/schema.js";
 import { doctor } from "./doctor.js";
 import { candidateRow, costSignal, shapeCandidates } from "./fleet-picker.js";
 import { route } from "../../route/router.js";
 import { pickRole } from "../../route/role-pick.js";
-import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, entryMatchesChannel, exclusionCollector } from "../../route/preference.js";
+import { deadPoolEntries, deadPoolEntryLine, denyPreferCollisionLine, denyPreferCollisions, disallowedBy, entryMatchesChannel, exclusionCollector } from "../../route/preference.js";
 import { resolveRunMode } from "../../run/daemon.js";
-import { loadRoutingProfile } from "../../run/journal.js";
+import { loadRoutingProfile, readReviewNoVerdictHistory, reviewNoVerdictRows } from "../../run/journal.js";
 const initialFetch = globalThis.fetch;
 const NON_TTY_MSG = "tickmarkr fleet: interactive fleet editor requires a TTY — use `tickmarkr fleet --print` for non-interactive output";
 const QUIT = "fleet: quit without writing";
@@ -346,8 +346,10 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const channels = discoverChannels(cfg, adapters, health);
     const profile = loadRoutingProfile(cwd, cfg, { preview: true });
     const stagedDenyOf = (editable) => Object.fromEntries(DENY_SCOPES.map((scope) => [stagedDenyKeyOf(scope), editable[scope.key] ?? []]));
+    // OBS-1188: previews stage no effort, so both sides drop efforts — the writer then needs no lower layers
+    const previewInitial = { ...structuredClone(initial), efforts: undefined };
     const stagedEditable = (map, deny) => ({
-        ...structuredClone(initial),
+        ...structuredClone(previewInitial),
         ...Object.fromEntries(DENY_SCOPES.map((scope) => [scope.key, deny[stagedDenyKeyOf(scope)]])),
         // OBS-1046: the allow complement is staged beside the deny lists, never folded into them
         allowOut: deny.allowOut ?? initial.allowOut,
@@ -362,7 +364,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         let preview;
         try {
             const bytes = renderFleetOverlayWrite(currentRepoOverlayText(cwd), {
-                initial,
+                initial: previewInitial,
                 edited: stagedEditable(map, deny),
                 universe,
                 ...(mode !== rm.mode.mode ? { mode } : {}),
@@ -581,7 +583,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             captions.push(`task hint: routing.map.${shape}.prefer ranks ${entry.prefer.join(", ")} — not manageable here, edit it in Shapes`);
         }
         // 8. deny∩prefer collision — a standing lint on this shape's declaration, never a fleet toggle.
-        for (const collision of denyPreferCollisions(cfgPreview, [shape])) {
+        for (const collision of denyPreferCollisions(cfgPreview, [shape], health)) {
             captions.push(denyPreferCollisionLine(collision));
         }
         // 9. first-match provenance — the per-channel ledger below lists EVERY collector scope.
@@ -594,7 +596,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const channelLedger = (shape, map, cfgPreview, offered) => {
         const entry = map[shape];
         const floor = cfgPreview.routing.floors[shape];
-        const collisions = denyPreferCollisions(cfgPreview, [shape]);
+        const collisions = denyPreferCollisions(cfgPreview, [shape], health);
         const discovered = new Set(previewChannels.map((c) => `${c.adapter}:${c.model}`));
         // T2 review (D-225): discovery already dropped a channel whose model probe failed — it is
         // rebuilt as a structured channel from its adapter's own declaration and walks the SAME
@@ -616,7 +618,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         // never greys beside itself; its pin/pool/floor/prefer captions stay in excludedNote
         const ledgerChannels = [...previewChannels.map((c) => ({ ...c, authReason: undefined })), ...failedProbes, ...unauthedCliChannels]
             .filter((c) => !offered.has(`${c.adapter}:${c.model}`));
-        return ledgerChannels.flatMap((c) => {
+        const lines = ledgerChannels.flatMap((c) => {
             const key = `${c.adapter}:${c.model}`;
             const reasons = exclusionCollector(c, cfgPreview.routing, "worker").map(exclusionReason);
             // OBS-1065: a greyed picker row carries its reach beside its reasons, like the models view
@@ -645,8 +647,19 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             if (c.authReason)
                 reasons.push(c.authReason);
             // labelled like the models view's row (adapter/model), so a ledger row never reads as a candidate
-            return reasons.length ? [`${c.adapter}/${c.model} — reach: ${reach} — ${reasons.join("; ")}`] : [];
+            return reasons.length ? [{ key, line: `${c.adapter}/${c.model} — reach: ${reach} — ${reasons.join("; ")}` }] : [];
         });
+        // OBS-1145 add.1: every carried pool member the picker does not offer leads the ledger in chain
+        // order — one no reason above names still gets its own row — so the picker renders its ordinal
+        // and Space can drop it; a chain member with no row is hidden AND irremovable
+        const carried = entry?.pool?.channels.filter((key) => !offered.has(key)) ?? [];
+        const named = new Set(lines.map((row) => row.key));
+        const unnamed = carried.filter((key) => !named.has(key)).map((key) => ({
+            key,
+            line: `${key.replace(":", "/")} — ${discovered.has(key) ? `not offered for ${shape}` : "not served by an installed adapter"} — carried in routing.map.${shape}.pool`,
+        }));
+        const order = (key) => (carried.includes(key) ? carried.indexOf(key) : carried.length);
+        return [...lines, ...unnamed].sort((a, b) => order(a.key) - order(b.key)).map((row) => row.line);
     };
     const candidatesForShape = (shape, mode, map, deny) => {
         const preview = previewCfg(mode, map, deny);
@@ -677,6 +690,10 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         review: cfg.review.prefer?.slice(),
         consult: cfg.consult.prefer?.slice(),
     };
+    // OBS-1052(3): shown on the Steering view beside review.prefer; the pickers above stay untouched.
+    const reviewAdvisories = reviewNoVerdictRows(readReviewNoVerdictHistory(cwd))
+        .filter((row) => row.verdict === "warn")
+        .map((row) => `review history: ${row.channel} — ${row.value}`);
     const steeringOptionsFor = (which, current) => {
         const discovered = which === "review" ? [...reviewAdapters, ...seats] : seats;
         return [...discovered, ...current.filter((entry) => !discovered.includes(entry))];
@@ -685,6 +702,26 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     // discovered seats universe plus a keep-default row, and a write is staged only on a real change.
     const initialJudge = `${cfg.judge.adapter}:${cfg.judge.model}`;
     let pendingWrite = null;
+    // OBS-1182: the layers under the repo overlay, read raw, so clearing an effort masks an inherited
+    // one even when those layers only validate beside repo fields. OBS-1188: re-read at every review
+    // and save, never an assembly-time snapshot; an unreadable read keeps the last good one for the
+    // preview only — the save guard below refuses it.
+    let lowerOverrides = {};
+    // OBS-1188: the reviewed bytes are the only bytes that may land. Re-rendered from the repo overlay
+    // and lower layers as they are NOW; any difference is a stale preview. Null = still current.
+    const stalePreview = (write, reviewed, prior = currentRepoOverlayText(cwd)) => {
+        const lower = lowerLayerModelOverrides({ globalDir });
+        if (!lower.ok)
+            return lower.error;
+        try {
+            if (renderFleetOverlayWrite(prior, { ...write, lowerOverrides: lower.overrides }) === reviewed)
+                return null;
+        }
+        catch (error) {
+            return error.message;
+        }
+        return "stale preview — the repo overlay or a lower config layer changed after the review diff was rendered; press w to review what would be written now";
+    };
     const reviewOverlay = (state) => {
         const staged = structuredClone(initial);
         // OBS-994/FL-1, OBS-1099 add.1: every schema-enumerated deny scope rides the same review/write funnel
@@ -692,6 +729,12 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             staged[scope.key] = state[scope.key];
         staged.allowOut = state.allowOut ?? initial.allowOut;
         staged.map = state.map;
+        // OBS-1182: staged efforts replace the loaded ones; none staged anywhere ⇒ no key, as loaded
+        const efforts = Object.fromEntries(Object.entries(state.efforts ?? {}).filter(([, models]) => Object.keys(models).length));
+        if (Object.keys(efforts).length)
+            staged.efforts = efforts;
+        else
+            delete staged.efforts;
         const today = new Date().toISOString().slice(0, 10);
         for (const classification of state.classifications) {
             staged.tiers[classification.adapter] ??= {};
@@ -713,10 +756,14 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             pendingWrite = null;
             return { kind: "empty" };
         }
+        const lower = lowerLayerModelOverrides({ globalDir });
+        if (lower.ok)
+            lowerOverrides = lower.overrides;
         const write = {
             initial,
             edited: staged,
             universe,
+            lowerOverrides,
             ...(modeChanged ? { mode: state.selectedMode } : {}),
             ...(judgeChanged && judgeSeat ? { judge: judgeSeat } : {}),
             steering: { initial: initialSteering, edited: state.steering },
@@ -727,22 +774,37 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             return { kind: "empty" };
         }
         pendingWrite = write;
+        // OBS-1144: the review names every dead pool entry the written config carries, with its reason and
+        // what still routes — before y. Unloadable bytes carry no notes: the reload guard refuses them anyway.
+        let poolNotes = [];
+        try {
+            const written = loadConfigWithMode(cwd, { globalDir, repoOverlayText: after }).cfg;
+            poolNotes = deadPoolEntries(written, undefined, health).map(deadPoolEntryLine);
+        }
+        catch {
+            poolNotes = [];
+        }
+        const notes = [...(lower.ok ? [] : [`${lower.error} — y will be refused`]), ...poolNotes];
         return {
             kind: "diff",
             before,
             after,
             diff: unifiedYamlDiff(before, after, path),
             path,
+            ...(notes.length ? { notes } : {}),
         };
     };
-    const reloadGuard = io.reloadGuard
+    const loaderGuard = io.reloadGuard
         ?? ((bytes) => overlayBytesLoadError(cwd, bytes, { globalDir }));
+    // OBS-1188: a stale preview or an unreadable lower layer answers on the same error channel as the loader
+    const reloadGuard = (bytes) => (pendingWrite && stalePreview(pendingWrite, bytes)) || loaderGuard(bytes);
     const props = {
         ageMs: doctorAgeMs(cwd),
         adapters,
         health,
         ...Object.fromEntries(DENY_SCOPES.map((scope) => [initialDenyPropOf(scope), editable[scope.key] ?? []])),
         initialAllowOut: editable.allowOut,
+        initialEfforts: editable.efforts,
         modelGroups,
         initialMode: rm.mode.mode,
         modeOptions: ROUTING_MODES.map((mode) => ({ id: mode, gloss: MODE_GLOSS[mode] })),
@@ -756,6 +818,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         ],
         initialSteering,
         steeringOptionsFor,
+        reviewAdvisories,
         reviewOverlay,
         reloadGuard,
         stagedRouting,
@@ -782,7 +845,20 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         const write = pendingWrite;
         if (!write)
             throw new Error("fleet write reached confirmation without a staged overlay mutation");
-        writeFleetOverlay(result.review.path, (prior) => renderFleetOverlayWrite(prior, write));
+        // OBS-1188: re-checked against the bytes on disk at write time; a refusal throws before the temp file exists
+        try {
+            writeFleetOverlay(result.review.path, (prior) => {
+                const stale = stalePreview(write, result.review.after, prior);
+                if (stale !== null)
+                    throw new ConfigError(stale);
+                return result.review.after;
+            });
+        }
+        catch (error) {
+            if (error instanceof ConfigError)
+                return `fleet: nothing written — ${error.message}`;
+            throw error;
+        }
         // OBS-529: a freshly classified model has no probe verdict (doctor probes CONFIGURED models,
         // and it was not configured at probe time), so it stays unroutable — invisible in every
         // picker — until the next probe. Name the step, or the classify flow reads as broken.