tickmarkr 2.6.1 → 2.6.3

package/dist/config/config.js

@@ -2,11 +2,11 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
-import { Document, parse } from "yaml";
+import { Document, isScalar, parse } from "yaml";
 import { z } from "zod";
 import { CITED_MODEL_WINDOWS } from "../adapters/model-windows.js";
 import { stateDirName } from "../graph/graph.js";
-import { SHAPES, TIERS } from "../graph/schema.js";
+import { EFFORTS, SHAPES, TIERS } from "../graph/schema.js";
 const TierEnum = z.enum(TIERS, {
     error: (iss) => `Invalid option: expected one of "cheap"|"mid"|"frontier" (got ${JSON.stringify(iss.input)})`,
 });
@@ -51,21 +51,32 @@ export const MapEntrySchema = z.object({
     escalate: z.boolean().optional(),
 });
 const DeclaredVendorSchema = z.string().trim().min(1, "vendor must be nonempty");
-const ModelOverrideSchema = z
+// OBS-1182: effort is launch metadata only these CLIs accept (claude --effort, codex -c
+// model_reasoning_effort=). Every other adapter's override refuses the key outright, so config
+// load and the emitted JSON schema both reject an effort that could never be launched.
+export const EFFORT_ADAPTERS = ["claude-code", "codex"];
+const EffortEnum = z.enum(EFFORTS, {
+    error: (iss) => `Invalid effort: expected one of "low"|"medium"|"high" (got ${JSON.stringify(iss.input)})`,
+});
+const NoEffort = z.never({
+    error: () => `effort is launch metadata only ${EFFORT_ADAPTERS.join(" and ")} accept — this adapter's CLI takes no effort level`,
+});
+const modelOverrideSchema = (effort) => z
     .object({
     vendor: DeclaredVendorSchema.optional(),
     channel: z.enum(["sub", "api"]).optional(),
+    effort: effort.optional(),
 })
-    .refine((override) => override.vendor !== undefined || override.channel !== undefined, {
-    message: "a model override must declare vendor, channel, or both",
+    .refine((override) => override.vendor !== undefined || override.channel !== undefined || override.effort !== undefined, {
+    message: "a model override must declare vendor, channel, effort, or a combination",
 });
-export const TierEntrySchema = z.object({
+const tierEntrySchema = (effort) => z.object({
     vendor: DeclaredVendorSchema.nullable(),
     channel: z.enum(["sub", "api"]),
     models: z.record(z.string(), TierEnum),
     // T19: keep model values scalar for existing consumers. Optional sibling metadata resolves before
     // parent metadata in channelsFromConfig; neither provider prefixes nor adapter ids manufacture it.
-    modelOverrides: z.record(z.string(), ModelOverrideSchema).optional(),
+    modelOverrides: z.record(z.string(), modelOverrideSchema(effort)).optional(),
     // v1.47 T3: optional per-model context-window sizes (tokens). Absent block ⇒ no doctor column, no plan lint.
     windows: z.record(z.string(), z.number().int().positive()).optional(),
 }).superRefine((entry, ctx) => {
@@ -81,6 +92,13 @@ export const TierEntrySchema = z.object({
         });
     }
 });
+export const TierEntrySchema = tierEntrySchema(EffortEnum);
+// Per-adapter object + catchall rather than a record, so the emitted JSON schema carries the same
+// adapter restriction as the loader; typed as the record every consumer already reads.
+// ponytail: catchall parses the EFFORT_ADAPTERS keys first — the seed table already lists them first.
+const TiersSchema = z
+    .object(Object.fromEntries(EFFORT_ADAPTERS.map((id) => [id, TierEntrySchema.optional()])))
+    .catchall(tierEntrySchema(NoEffort));
 // v1.10 FLEET-06: optional routing.allow/deny fleet preference; absent blocks ⇒ byte-identical routing/discovery.
 // deny wins on conflict; presence of allow (even {} / empty arrays) activates allowlist (fail-closed).
 const PrefBlockSchema = z.object({
@@ -307,7 +325,8 @@ const ShapeGateParticipationSchema = z
 });
 export const ExecutionPolicySchema = z.object({
     boundedInfrastructure: z.boolean().default(false),
-    repairSelection: z.boolean().default(false),
+    // OBS-1199: absent inherits the effective default (on); an explicit false stays off.
+    repairSelection: z.boolean().optional(),
     taskExecutionLimitMs: z.number().int().positive(),
 }).strict();
 export const TickmarkrConfigSchema = z.object({
@@ -372,7 +391,7 @@ export const TickmarkrConfigSchema = z.object({
         allow: PrefBlockSchema.optional(),
         deny: DenyBlockSchema.optional(),
     }),
-    tiers: z.record(z.string(), TierEntrySchema),
+    tiers: TiersSchema,
     pricing: z.record(z.string(), z.number()),
     // v1.20 REC-02: optional detailed price table for cost estimation. Distinct from `pricing` above
     // (the coarse per-task tier estimate `tickmarkr plan` shows) — this one drives the usage/cost report.
@@ -390,6 +409,12 @@ export const TickmarkrConfigSchema = z.object({
         tipTest: z.string(),
         lint: z.string(),
         diffCap: z.number().int().positive(),
+        // OBS-1140: per-run gate-evidence byte quota; the oldest artifacts are evicted (and tombstoned)
+        // past it. Zero retains zero artifact bytes. Evidence retention never changes a gate's pass bit.
+        evidenceQuotaBytes: z.number().int().nonnegative(),
+        // OBS-1199: repair rounds screen known failing files plus affected tests before the full suite
+        // that still decides every merge. On unless false here or in executionPolicy, on every driver.
+        repairSelection: z.boolean(),
         byShape: z.partialRecord(z.enum(SHAPES), ShapeGateParticipationSchema).optional(),
     }).partial(),
     scope: z.object({
@@ -470,6 +495,7 @@ function assertSeededModelWindows() {
         }
     }
 }
+export const DEFAULT_EVIDENCE_QUOTA_BYTES = 8 * 1024 * 1024;
 export const DEFAULT_CONFIG = {
     concurrency: 3,
     driver: "auto",
@@ -642,7 +668,7 @@ export const DEFAULT_CONFIG = {
         },
     },
     pricing: { cheap: 0.1, mid: 0.5, frontier: 2.5 },
-    gates: { diffCap: DEFAULT_DIFF_CAP },
+    gates: { diffCap: DEFAULT_DIFF_CAP, evidenceQuotaBytes: DEFAULT_EVIDENCE_QUOTA_BYTES },
     judge: { adapter: "claude-code", model: "fable" },
     // R3: no `policy` floor — the neutral floor leaves the compiler's per-task assignment standing, so
     // the path-keyed rule is reachable out of the box rather than raised to full by construction.
@@ -798,6 +824,44 @@ export function loadConfigWithMode(repoRoot, opts = {}) {
     assertSeededModelWindows();
     return { cfg: r.data, mode: resolveRoutingMode(r.data, [globalCfg, repoCfg]) };
 }
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
+ *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
+ *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited.
+ *  OBS-1188: an unparseable global file, or a non-map where this path expects a map, is an error —
+ *  never an empty lower layer, which would silently drop the metadata a write must re-mask. */
+export function lowerLayerModelOverrides(opts = {}) {
+    const isMap = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    const path = join(opts.globalDir ?? globalConfigDir(), "config.yaml");
+    let global;
+    try {
+        global = readYaml(path);
+    }
+    catch (error) {
+        return { ok: false, error: `lower config layer ${path} is malformed YAML: ${error.message.replace(/\s+/g, " ").trim()}` };
+    }
+    const malformed = (at) => ({ ok: false, error: `lower config layer ${path} is malformed: ${at} is not a map` });
+    // deepMerge replaces a map with any non-map the global declares, so the merged shape is the global's
+    const merged = deepMerge(structuredClone(DEFAULT_CONFIG), global);
+    if (!isMap(merged))
+        return malformed("the document");
+    const tiers = merged.tiers ?? {}; // a global `tiers: null` tombstone leaves no lower tiers
+    if (!isMap(tiers))
+        return malformed("tiers");
+    const overrides = {};
+    for (const [adapter, entry] of Object.entries(tiers)) {
+        if (!isMap(entry))
+            return malformed(`tiers.${adapter}`);
+        const models = entry.modelOverrides ?? {};
+        if (!isMap(models))
+            return malformed(`tiers.${adapter}.modelOverrides`);
+        for (const [model, override] of Object.entries(models)) {
+            if (!isMap(override))
+                return malformed(`tiers.${adapter}.modelOverrides.${model}`);
+        }
+        overrides[adapter] = models;
+    }
+    return { ok: true, overrides };
+}
 export function loadConfig(repoRoot, opts = {}) {
     return loadConfigWithMode(repoRoot, opts).cfg;
 }
@@ -959,10 +1023,14 @@ export function universeCovers(universe, entry) {
 // Absent universe ⇒ deny arrays verbatim and no allowOut, so non-UI callers stay byte-identical.
 export function fleetEditableFromConfig(cfg, universe) {
     const tiers = {};
+    const efforts = {};
     for (const [adapter, entry] of Object.entries(cfg.tiers)) {
         tiers[adapter] = {};
         for (const [model, tier] of Object.entries(entry.models)) {
             tiers[adapter][model] = { tier };
+            const effort = entry.modelOverrides?.[model]?.effort;
+            if (effort)
+                (efforts[adapter] ??= {})[model] = effort;
         }
     }
     // every enumerated deny scope rides verbatim (sorted) under its own key
@@ -991,6 +1059,7 @@ export function fleetEditableFromConfig(cfg, universe) {
         ...denyLists,
         ...(allowOut !== undefined ? { allowOut } : {}),
         tiers,
+        ...(Object.keys(efforts).length ? { efforts } : {}),
         map: structuredClone(cfg.routing.map),
         floors: { ...cfg.routing.floors },
     };
@@ -1037,6 +1106,13 @@ export function formatFleetPrint(repoRoot, opts = {}) {
     for (const [adapter, entry] of Object.entries(effective.tiers)) {
         for (const model of Object.keys(entry.models))
             annotate(["tiers", adapter, "models", model]);
+        // OBS-1182: the effort value prints in place; its note names the layer that set it and the edit
+        for (const [model, override] of Object.entries(entry.modelOverrides ?? {})) {
+            const path = ["tiers", adapter, "modelOverrides", model, "effort"];
+            const node = doc.getIn(path, true);
+            if (override.effort && isScalar(node))
+                node.comment = ` ${fleetKeyLayer(repoRoot, path.join("."), opts)} — fleet e edits`;
+        }
     }
     return String(doc);
 }

package/dist/config/fleet-overlay.d.ts

@@ -1,7 +1,7 @@
-import { type FleetEditable, type FleetUniverseRow, type RoutingMode } from "./config.js";
+import { type FleetEditable, type FleetUniverseRow, type LowerLayerModelOverrides, type RoutingMode } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
-export type FleetOverlayWrite = {
+type FleetOverlayWriteFields = {
     initial: FleetEditable;
     edited: FleetEditable;
     mode?: RoutingMode;
@@ -21,6 +21,16 @@ export type FleetOverlayWrite = {
     };
     universe?: FleetUniverseRow[];
 };
+type EffortFree = FleetEditable & {
+    efforts?: undefined;
+};
+export type FleetOverlayWrite = FleetOverlayWriteFields & ({
+    lowerOverrides: LowerLayerModelOverrides;
+} | {
+    initial: EffortFree;
+    edited: EffortFree;
+    lowerOverrides?: undefined;
+});
 export type FleetFirstTouch = {
     vendor: string;
     channel: "sub" | "api";
@@ -35,3 +45,4 @@ export declare function repoOverlayYaml(overlay: Record<string, unknown>): strin
 export declare function serializeFleetOverlay(overlay: Record<string, unknown>): string;
 export declare function unifiedYamlDiff(before: string, after: string, label?: string): string;
 export declare function fleetEditableEquals(a: FleetEditable, b: FleetEditable): boolean;
+export {};

package/dist/config/fleet-overlay.js

@@ -360,6 +360,66 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 setScalarPreservingComment(doc, path, after.tier, unpackFleetProvenance(after.provenance).provenance);
         }
     }
+    // OBS-1182: effort lands in tiers.<adapter>.modelOverrides.<model>.effort — the scalar tier and
+    // every sibling override key (vendor, channel) keep their bytes.
+    const efforts = (e) => e.efforts ?? {};
+    for (const adapter of new Set([...Object.keys(efforts(initial)), ...Object.keys(efforts(edited))])) {
+        for (const model of new Set([...Object.keys(efforts(initial)[adapter] ?? {}), ...Object.keys(efforts(edited)[adapter] ?? {})])) {
+            const after = efforts(edited)[adapter]?.[model];
+            if (efforts(initial)[adapter]?.[model] === after)
+                continue;
+            // OBS-1188: the type already demands lower state here; this refuses a cast/JS caller before the
+            // bytes are returned, so a blind effort write never reaches disk.
+            const lowerAll = write.lowerOverrides;
+            if (!lowerAll) {
+                throw new Error(`fleet write: the effort edit on ${adapter}:${model} needs the lower config layers' model overrides — refusing to write it blind`);
+            }
+            const override = ["tiers", adapter, "modelOverrides", model];
+            if (after !== undefined) {
+                // Setting beneath a tombstone (the override, or modelOverrides above it) lifts it, and
+                // deepMerge would restore what it masked: re-mask each lower-layer key it covered — sibling
+                // models, then this override's own keys.
+                // ponytail: tiers.<adapter> itself tombstoned is unreachable here — its models, and so a tier, are masked too.
+                const tombstoned = (depth) => {
+                    const node = doc.getIn(override.slice(0, depth), true);
+                    return node !== undefined && !isMap(node);
+                };
+                const lowerModels = lowerAll[adapter] ?? {};
+                const remask = [];
+                if (tombstoned(3))
+                    for (const other of Object.keys(lowerModels))
+                        if (other !== model)
+                            remask.push([...override.slice(0, 3), other]);
+                if (tombstoned(3) || tombstoned(4)) {
+                    for (const key of Object.keys(lowerModels[model] ?? {}))
+                        if (key !== "effort")
+                            remask.push([...override, key]);
+                }
+                setScalarPreservingComment(doc, [...override, "effort"], after);
+                for (const path of remask)
+                    setScalarPreservingComment(doc, path, null);
+                continue;
+            }
+            // Clearing means no effort in the MERGED config: drop the repo key, then mask an effort the
+            // lower layers still declare.
+            deleteAt(doc, [...override, "effort"]);
+            const lower = lowerAll[adapter]?.[model];
+            const maskEffort = lower?.effort !== undefined;
+            const repoNode = doc.getIn(override, true);
+            const { effort: _masked, ...rest } = { ...lower, ...(isMap(repoNode) ? repoNode.toJSON() : {}) };
+            if (Object.values(rest).some((v) => v !== null && v !== undefined)) {
+                if (maskEffort)
+                    setScalarPreservingComment(doc, [...override, "effort"], null);
+            }
+            else if (maskEffort || (isMap(repoNode) && repoNode.items.length > 0)) {
+                // Tombstone-only siblings must still suppress lower metadata when effort is cleared,
+                // even without inherited effort. Their merged {} would fail the nonempty refinement.
+                setScalarPreservingComment(doc, override, null);
+            }
+            for (const depth of [4, 3, 2, 1])
+                deleteEmptyMap(doc, override.slice(0, depth));
+        }
+    }
     if (write.mode !== undefined) {
         setScalarPreservingComment(doc, ["routing", "mode"], write.mode);
     }

package/dist/drivers/herdr.d.ts

@@ -62,6 +62,8 @@ export declare class HerdrDriver implements ExecutorDriver {
     private deliverySerial;
     private dispatchLeases;
     private deliveredPanes;
+    /** OBS-1203: slots bound by adopt() — their reads are harvest evidence, so a failed read throws. */
+    private adoptedSlots;
     private inputBoxes;
     private bootstraps;
     private journalRoots;
@@ -93,6 +95,16 @@ export declare class HerdrDriver implements ExecutorDriver {
     private paneId;
     private paneWidth;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
+    /**
+     * OBS-1203: bind THIS instance, READ-ONLY, to the pane an earlier daemon created for an owned slot,
+     * so a resumed daemon can read the interrupted attempt's trailer. slot() is never a substitute: it
+     * allocates a tab, reclaimStaleLabel closes the very pane holding the evidence, and it holds a
+     * dispatch lease only run() releases. Binding needs ownership evidence, never a label alone: exactly
+     * one pane carries the FULL owned label, herdr reports that pane's cwd as the journaled task
+     * checkout, and that path is a git checkout whose own top level it is. Zero, ambiguous or foreign
+     * candidates throw — the caller's decline. `pane list` and `git rev-parse` are the only calls made.
+     */
+    adopt(slot: Slot): Promise<Slot>;
     private tabSlot;
     private reclaimStaleLabel;
     private staleLabelPanes;

package/dist/drivers/herdr.js

@@ -7,6 +7,7 @@ import { consumePaneLaunchIntent, PANE_IDENTITY_ENV, paneIdentityLine } from "..
 import { createWorktree, sh } from "../run/git.js";
 import { Journal } from "../run/journal.js";
 import { readSupervision, readWatchBoard, requestWatchBoardStop, reserveWatchBoard, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
+import { canonicalWorktreePath } from "./orca.js";
 import { herdrSealShellPrefix } from "./subprocess.js";
 import { canonicalizeLegacyName, formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 // VIS-09 P43-03: adopted safety floor from 43-MEASUREMENT.md (narrowest safe 53 → floor 108).
@@ -153,6 +154,8 @@ export class HerdrDriver {
     deliverySerial = Promise.resolve();
     dispatchLeases = new WeakMap();
     deliveredPanes = new WeakMap();
+    /** OBS-1203: slots bound by adopt() — their reads are harvest evidence, so a failed read throws. */
+    adoptedSlots = new WeakSet();
     inputBoxes = new WeakMap();
     // OBS-253: the adapter-declared bootstrap this slot has already delivered. A fresh pane is a bare
     // shell, so it is the only thing that can put a TUI back under a typed turn that has to move.
@@ -452,6 +455,49 @@ export class HerdrDriver {
         // refcount, no groupSerial, no degrade latch — dedicated tabs have no shared state to guard (SUP-01).
         return slot; // label undefined → defaults to name (today's behavior)
     }
+    /**
+     * OBS-1203: bind THIS instance, READ-ONLY, to the pane an earlier daemon created for an owned slot,
+     * so a resumed daemon can read the interrupted attempt's trailer. slot() is never a substitute: it
+     * allocates a tab, reclaimStaleLabel closes the very pane holding the evidence, and it holds a
+     * dispatch lease only run() releases. Binding needs ownership evidence, never a label alone: exactly
+     * one pane carries the FULL owned label, herdr reports that pane's cwd as the journaled task
+     * checkout, and that path is a git checkout whose own top level it is. Zero, ambiguous or foreign
+     * candidates throw — the caller's decline. `pane list` and `git rev-parse` are the only calls made.
+     */
+    async adopt(slot) {
+        if (!parseOwnedName(slot.name))
+            throw new Error(`herdr adopt: slot ${slot.name} carries no owned label — nothing to adopt`);
+        const listed = await this.herdr("pane list");
+        let panes;
+        try {
+            const parsed = JSON.parse(listed.stdout).result?.panes;
+            if (listed.code !== 0 || !Array.isArray(parsed))
+                throw new Error("no panes array");
+            panes = parsed;
+        }
+        catch {
+            throw new Error(`herdr adopt: pane list unreadable (exit ${listed.code}) — cannot prove ownership of ${slot.name}`);
+        }
+        const owned = panes.filter((p) => p.label === slot.name && typeof p.pane_id === "string" && p.pane_id);
+        if (owned.length !== 1) {
+            throw new Error(`herdr adopt: ${owned.length === 0 ? "no pane carries" : `${owned.length} panes carry`} the owned label ${slot.name}`);
+        }
+        const pane = owned[0];
+        const checkout = canonicalWorktreePath(slot.cwd);
+        if (typeof pane.cwd !== "string" || canonicalWorktreePath(pane.cwd) !== checkout) {
+            throw new Error(`herdr adopt: pane ${pane.pane_id} labelled ${slot.name} sits in ${pane.cwd ?? "an unreported cwd"}, not the task checkout ${checkout} — foreign`);
+        }
+        const top = await sh("git rev-parse --show-toplevel", checkout);
+        if (top.code !== 0 || canonicalWorktreePath(top.stdout.trim()) !== checkout) {
+            throw new Error(`herdr adopt: ${checkout} is not its own git checkout — no checkout proof for ${slot.name}`);
+        }
+        const adopted = { id: pane.pane_id, name: slot.name, cwd: slot.cwd,
+            ...(pane.tab_id === undefined ? {} : { tabId: pane.tab_id }), ...(slot.group === undefined ? {} : { group: slot.group }) };
+        // Reads go to the pane ownership was proven on, never to a later re-resolution of the label.
+        this.deliveredPanes.set(adopted, pane.pane_id);
+        this.adoptedSlots.add(adopted);
+        return adopted;
+    }
     // today's per-slot tab path, plus the VIS-04 orphan reap
     // label defaults to the slot name; group tabs pass the STAGE name instead — a first-member label
     // outlives its member once keepPanes reaps it (run-20260709-104447: the codex pane sat in a tab
@@ -1099,6 +1145,11 @@ export class HerdrDriver {
     async read(slot, lines) {
         const pane = await this.paneId(slot);
         const r = await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${lines}`, slot.cwd);
+        // OBS-1203 review: an adopted pane's read decides a resume harvest; a failed read proves neither a
+        // trailer nor its absence, so it throws (the caller's decline) rather than read as an empty pane.
+        // ponytail: other slots keep the historical empty-on-failure read; widen once seed/consult callers catch.
+        if (r.code !== 0 && this.adoptedSlots.has(slot))
+            throw new Error(`herdr pane read ${pane} failed (exit ${r.code}): ${r.stderr || r.stdout}`);
         return r.stdout;
     }
     // v1.22 T5 / OBS-19: raw keystroke into the pane TUI (trust-dialog auto-answer). Resolves the pane

package/dist/drivers/orca.d.ts

@@ -123,12 +123,13 @@ export declare function mapAgentState(term: Record<string, unknown>, tuiIdle: bo
  * A retired record is replaced by a new reservation (CAS on the tombstone bytes) only once its pane
  * is proven gone. Everything else — a reservation or claim with no bound pane, a failed cleanup, a
  * record another driver holds with a live observer — refuses and keeps the record exactly as it is.
+ * One reservation or claim is HELD rather than in flight: its placer is this process after an
+ * indeterminate split receipt (OBS-1172). It is reconciled again on every call, never split over.
  */
 /** `placer` is the pid of the narrator that wrote the reservation: a reserved or claimed record is a
  *  normal intermediate state while that pid lives (another driver awaiting listing or bind) and a
  *  crash to recover only once it is dead. */
 type BoardRecord = WatchBoardOwner & {
-    retired?: true;
     runtimeId?: string;
     placer?: number;
 };
@@ -198,6 +199,16 @@ export declare class OrcaDriver implements ExecutorDriver {
     /** Explicit runtime probe. Also T3's doctor probe. */
     probeRuntime(cwd?: string): Promise<string>;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
+    /**
+     * OBS-1109: bind THIS instance to a terminal an earlier daemon created for an OWNED slot, so a
+     * resumed daemon can read the interrupted attempt's pane. Binding needs ownership evidence, never
+     * a title or handle alone: exactly one tab on the tracked worktree carries the FULL journaled owned
+     * title, it resolves to exactly one terminal, and that terminal's scrollback proves the exact task
+     * checkout `slot.cwd` (the frame only tickmarkr's own create command prints). Zero, ambiguous or
+     * foreign candidates leave the slot unbound: the throw is the caller's decline. The journaled
+     * nonce is then checked by the caller against the trailer this binding reads.
+     */
+    adopt(slot: Slot): Promise<Slot>;
     /** Where to invoke the CLI for this slot's calls (see OrcaSlotState.dir). */
     private cliCwd;
     private state;
@@ -263,7 +274,15 @@ export declare class OrcaDriver implements ExecutorDriver {
      */
     private screenBehindBlindStream;
     /** A rendered-frame liveness read. `--screen` and `--cursor` are mutually exclusive in Orca. */
-    private readScreen;
+    private screenFrame;
+    /**
+     * OBS-1205: the public rendered-screen read a slot carries (Slot.readScreen). Kimi draws its trust
+     * modal with cursor addressing, so the stream holds the box rules and no `Trust` text while the
+     * painted frame shows `❯ Trust this folder`. Same ownership discipline as every read — bound
+     * runtime, addressed handle, running status — and a frame the runtime could not render is
+     * unreadable, never an empty screen a caller could read as "no modal".
+     */
+    readScreen(slot: Slot): Promise<string>;
     /** A single UNPAGED tail read — exactly what the caller asked for and nothing more. Markers split
      *  across cursor pages are not reassembled here; that is waitOutput's job. */
     read(slot: Slot, lines: number): Promise<string>;
@@ -290,6 +309,15 @@ export declare class OrcaDriver implements ExecutorDriver {
     sendKey(slot: Slot, key: string): Promise<void>;
     nudge(slot: Slot, message: string): Promise<boolean>;
     narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
+    /** OBS-1172: what an indeterminate split left behind, reconciled from the owner record and Orca's
+     *  terminal table — never from the receipt that did not arrive. The reservation's token reaches no
+     *  process but the split's own command, so a claim proves that split started a board; the owned
+     *  record (this driver, the watch title) is ours by that same token. The claimant must be live (pid
+     *  and arm presence), and it must name the terminal it runs in — a listed pane in the launching tab.
+     *  A claim that names none proves a board started, not WHICH pane hosts it: a sole neighbouring pane
+     *  (row titles are shell-controlled, never ownership keys) is not adopted, so the claim stays held.
+     *  No claim and no such pane: the split started nothing the table shows. Anything else is held. */
+    private settleIndeterminate;
     private boardPath;
     /** A recorded pane (a receipt's handle bound to the split envelope's runtime, never a guess) is
      *  gone when that runtime no longer lists it, or when a handle-bound close receipt names it.
@@ -303,6 +331,11 @@ export declare class OrcaDriver implements ExecutorDriver {
      *  handle-bound close (timeout keeps the tombstone and the pane); a dead one never acknowledges,
      *  so it is only asked. */
     private retireAndClose;
+    /** Stop a retired board's observer before its pane is closed. A live observer acknowledges on
+     *  injected time; a dead one never can, so it is only asked. OBS-1131: an acknowledgement timeout
+     *  is not proof of death — while the pid lives the owned pane stays protected — but a pid that died
+     *  during the wait is, and its pane is closed instead of leaked. */
+    private stopObserver;
     /** WB-1 seam: the daemon reports this board lost. "Lost" can be a stale beat or missing presence
      *  under a still-live owner pid, so it is not proof of a dead observer — retirement keeps close's
      *  acknowledgement discipline (Leg-2 T9 P1). */