tickmarkr 2.6.2 → 2.6.3

package/README.md

@@ -208,6 +208,8 @@ worker. Other parks have different permitted decisions:
 | Human gate / other non-gate park | Plain approve records permission to dispatch. |
 | Attempt cap | Plain approve grants a fresh attempt budget; prior routing exclusions remain. |
 | Infrastructure | Plain approve or `--recheck`; recheck reruns the declared battery and satisfies no gate. |
+| Stall with a recorded `reapFailure` (the worker's process census was unreadable or had survivors) | `--recheck` bound to that park's token re-verifies the parked attempt's owned census: only an explicitly recorded empty survivors array (`[]`) releases its harvested commits to the declared battery, with no worker; a missing, unreadable or surviving census re-parks the stall (new token, still approve/recheck). Plain approve dispatches a worker. |
+| Ordinary stall (no `reapFailure`) | Plain approve only — it dispatches a worker; `--recheck` refuses. |
 | Failed review gate | `--waive` satisfies only that identified gate; `--uphold` funds one fixed attempt carrying findings; `--recheck` reruns the battery. |
 | Other failed gate | `--waive` or `--recheck`; plain approve refuses. |
 | Tombstone / gate failure without identifying evidence | Diagnostic only; no invented decision. |

package/dist/cli/commands/approve.d.ts

@@ -26,6 +26,8 @@ export interface NewestPark {
     failedGate: string | undefined;
     /** A pre-dispatch human gate whose reason marks it permanent by design (see isTombstonePark). */
     tombstone: boolean;
+    /** OBS-1202: a stall park's recorded reap failure (task-human data.reapFailure) — its census is unproven. */
+    reapFailure?: string;
 }
 /**
  * There is no closed park kind for a declaration-shaped retirement, so the evidence is the one the
@@ -46,13 +48,14 @@ export declare const parkToken: (park: Pick<NewestPark, "line" | "ts">) => strin
 /** OBS-1178: the newest task-failed row for a task — the failure a failed-task recheck binds to. */
 export declare function newestFailure(events: readonly JournalEvent[], taskId: string, sourceIndexes?: readonly number[]): DecisionBinding | undefined;
 /**
- * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra →
- * approve or recheck; review gate-fail → waive/uphold/recheck; other gate-fail → waive/recheck; a
+ * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra, and
+ * a stall park that recorded a reapFailure (OBS-1202), → approve or recheck; review gate-fail →
+ * waive/uphold/recheck; other gate-fail → waive/recheck; a
  * gate-fail park with no failed-gate evidence, or a tombstone → nothing (a diagnostic, never a
  * fabricated verb). The refusals in `approve` below enforce the same table; this is the one place a
  * surface may read it from, so what a menu offers and what the command accepts cannot drift.
  */
-export declare function permittedDecisionVerbs(park: Pick<NewestPark, "kind" | "failedGate" | "tombstone"> | undefined): readonly DecisionVerb[];
+export declare function permittedDecisionVerbs(park: Pick<NewestPark, "kind" | "failedGate" | "tombstone" | "reapFailure"> | undefined): readonly DecisionVerb[];
 /** The release marker this command appends for a verb on a park — the fact a read-back must match. */
 export declare function releaseForDecision(verb: DecisionVerb, park: Pick<NewestPark, "kind" | "failedGate">): string | undefined;
 export type ApprovalStatus = "deferred-live" | "recorded-no-owner";

package/dist/cli/commands/approve.js

@@ -59,6 +59,7 @@ sourceIndexes) {
             index: i, line: sourceIndexes?.[i] === undefined ? physicalLine(events, i) : sourceIndexes[i] + 1, ts: typeof e.ts === "string" ? e.ts : undefined, kind, reason,
             approveCommand: typeof e.data.approveCommand === "string" ? e.data.approveCommand : undefined,
             failedGate: failedGateBeforePark(events, taskId, i), tombstone: isTombstonePark(kind, reason),
+            ...(kind === "stall" && typeof e.data.reapFailure === "string" ? { reapFailure: e.data.reapFailure } : {}),
         };
     }
     return undefined;
@@ -83,8 +84,9 @@ export function newestFailure(events, taskId, sourceIndexes) {
     return undefined;
 }
 /**
- * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra →
- * approve or recheck; review gate-fail → waive/uphold/recheck; other gate-fail → waive/recheck; a
+ * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra, and
+ * a stall park that recorded a reapFailure (OBS-1202), → approve or recheck; review gate-fail →
+ * waive/uphold/recheck; other gate-fail → waive/recheck; a
  * gate-fail park with no failed-gate evidence, or a tombstone → nothing (a diagnostic, never a
  * fabricated verb). The refusals in `approve` below enforce the same table; this is the one place a
  * surface may read it from, so what a menu offers and what the command accepts cannot drift.
@@ -99,6 +101,10 @@ export function permittedDecisionVerbs(park) {
     }
     if (park.kind === "infra")
         return ["approve", "recheck"];
+    // OBS-1202: an unreadable reap census parks finished work; recheck re-verifies that census and gates the
+    // harvested commits with no worker. An ordinary stall recorded no census failure: approve alone.
+    if (park.kind === "stall" && park.reapFailure !== undefined)
+        return ["approve", "recheck"];
     // OBS-1084: an authoring park whose newest gate row is a red tool gate is a runner report (a load
     // flake in an unowned suite), so the battery re-runs on the preserved ref with no worker.
     if (park.kind === "authoring" && isToolGate(park.failedGate))
@@ -196,6 +202,7 @@ export async function approve(argv, cwd = process.cwd()) {
         const gateFailPark = park?.kind === "gate-fail";
         const infraPark = park?.kind === "infra" || park?.kind === "diff-cap";
         const authoringRunnerPark = park?.kind === "authoring" && isToolGate(park.failedGate);
+        const reapFailurePark = park?.kind === "stall" && park.reapFailure !== undefined;
         const failedGate = gateFailPark || authoringRunnerPark ? park?.failedGate : undefined;
         const parkBinding = requireBound(runId, taskId, bound, park?.ts === undefined ? undefined : { line: park.line, ts: park.ts }, "park");
         if (namedGate !== undefined && namedGate !== park?.failedGate) {
@@ -263,7 +270,10 @@ export async function approve(argv, cwd = process.cwd()) {
             return disposition(cwd, runId, "fund-fixed-attempt", `upheld the reviewer for ${taskId} in ${runId} — by ${by}`, serialization.contended);
         }
         if (recheck) {
-            if ((!gateFailPark || !failedGate) && !infraPark && !authoringRunnerPark) {
+            if (park?.kind === "stall" && !reapFailurePark) {
+                throw new Error(`--recheck applies to a stall park only when it recorded a reapFailure (census recovery); ${taskId}'s stall park recorded none — plain approve dispatches a worker; refusing`);
+            }
+            if ((!gateFailPark || !failedGate) && !infraPark && !authoringRunnerPark && !reapFailurePark) {
                 throw new Error(`--recheck applies to a gate-fail, infra, diff-cap or red-tool-gate authoring park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
             journal.append("task-approved", taskId, {
@@ -276,9 +286,11 @@ export async function approve(argv, cwd = process.cwd()) {
                 // carry gate so their durable release row identifies the red tool gate that made recheck admissible.
                 ...(failedGate ? { failedGate } : {}),
                 ...(authoringRunnerPark && failedGate ? { gate: failedGate } : {}),
+                // OBS-1202: the daemon re-verifies the parked attempt's owned census before any gate runs.
+                ...(reapFailurePark ? { reapFailure: park.reapFailure } : {}),
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
-            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : `${park.kind} park`}; no gate marked satisfied`, serialization.contended);
+            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : reapFailurePark ? "reapFailure stall park; the owned census is re-verified before the gates" : `${park.kind} park`}; no gate marked satisfied`, serialization.contended);
         }
         if (waive) {
             if (!gateFailPark || !failedGate) {

package/dist/cli/commands/doctor.d.ts

@@ -173,6 +173,8 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
         tipTest?: string | undefined;
         lint?: string | undefined;
         diffCap?: number | undefined;
+        evidenceQuotaBytes?: number | undefined;
+        repairSelection?: boolean | undefined;
         byShape?: Partial<Record<"plan" | "spec" | "implement" | "tests" | "docs" | "migration" | "ui" | "refactor" | "chore", {
             [x: string]: unknown;
             acceptance?: boolean | undefined;
@@ -206,8 +208,8 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
     };
     executionPolicy?: {
         boundedInfrastructure: boolean;
-        repairSelection: boolean;
         taskExecutionLimitMs: number;
+        repairSelection?: boolean | undefined;
     } | undefined;
     setup?: string | undefined;
     cost?: {
@@ -298,6 +300,8 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
         tipTest?: string | undefined;
         lint?: string | undefined;
         diffCap?: number | undefined;
+        evidenceQuotaBytes?: number | undefined;
+        repairSelection?: boolean | undefined;
         byShape?: Partial<Record<"plan" | "spec" | "implement" | "tests" | "docs" | "migration" | "ui" | "refactor" | "chore", {
             [x: string]: unknown;
             acceptance?: boolean | undefined;
@@ -331,8 +335,8 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
     };
     executionPolicy?: {
         boundedInfrastructure: boolean;
-        repairSelection: boolean;
         taskExecutionLimitMs: number;
+        repairSelection?: boolean | undefined;
     } | undefined;
     setup?: string | undefined;
     cost?: {

package/dist/cli/commands/fleet.js

@@ -5,7 +5,7 @@ import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, modelAuthE
 import { catalogModelAdvisory, catalogTierRanking, declaredModelWindow, fleetUnclassifiedModels } from "../../adapters/model-lints.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, readClaudeAliasIdentity } from "../../adapters/claude-code.js";
-import { fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, DENY_SCOPES, initialDenyPropOf, loadConfigWithMode, lowerLayerModelOverrides, overlayBytesLoadError, readOverlayFile, stagedDenyKeyOf, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, TIER_RANK, unifiedYamlDiff, } from "../../config/config.js";
+import { ConfigError, fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, DENY_SCOPES, initialDenyPropOf, loadConfigWithMode, lowerLayerModelOverrides, overlayBytesLoadError, readOverlayFile, stagedDenyKeyOf, renderFleetOverlayWrite, repoOverlayPath, ROUTING_MODES, TIER_RANK, unifiedYamlDiff, } from "../../config/config.js";
 import { exclusionReason, projectFleetWhy, renderFleetWhy } from "../../config/fleet-why.js";
 import { SHAPES, TIERS } from "../../graph/schema.js";
 import { doctor } from "./doctor.js";
@@ -346,8 +346,10 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const channels = discoverChannels(cfg, adapters, health);
     const profile = loadRoutingProfile(cwd, cfg, { preview: true });
     const stagedDenyOf = (editable) => Object.fromEntries(DENY_SCOPES.map((scope) => [stagedDenyKeyOf(scope), editable[scope.key] ?? []]));
+    // OBS-1188: previews stage no effort, so both sides drop efforts — the writer then needs no lower layers
+    const previewInitial = { ...structuredClone(initial), efforts: undefined };
     const stagedEditable = (map, deny) => ({
-        ...structuredClone(initial),
+        ...structuredClone(previewInitial),
         ...Object.fromEntries(DENY_SCOPES.map((scope) => [scope.key, deny[stagedDenyKeyOf(scope)]])),
         // OBS-1046: the allow complement is staged beside the deny lists, never folded into them
         allowOut: deny.allowOut ?? initial.allowOut,
@@ -362,7 +364,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         let preview;
         try {
             const bytes = renderFleetOverlayWrite(currentRepoOverlayText(cwd), {
-                initial,
+                initial: previewInitial,
                 edited: stagedEditable(map, deny),
                 universe,
                 ...(mode !== rm.mode.mode ? { mode } : {}),
@@ -701,8 +703,25 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const initialJudge = `${cfg.judge.adapter}:${cfg.judge.model}`;
     let pendingWrite = null;
     // OBS-1182: the layers under the repo overlay, read raw, so clearing an effort masks an inherited
-    // one even when those layers only validate beside repo fields.
-    const lowerOverrides = lowerLayerModelOverrides({ globalDir });
+    // one even when those layers only validate beside repo fields. OBS-1188: re-read at every review
+    // and save, never an assembly-time snapshot; an unreadable read keeps the last good one for the
+    // preview only — the save guard below refuses it.
+    let lowerOverrides = {};
+    // OBS-1188: the reviewed bytes are the only bytes that may land. Re-rendered from the repo overlay
+    // and lower layers as they are NOW; any difference is a stale preview. Null = still current.
+    const stalePreview = (write, reviewed, prior = currentRepoOverlayText(cwd)) => {
+        const lower = lowerLayerModelOverrides({ globalDir });
+        if (!lower.ok)
+            return lower.error;
+        try {
+            if (renderFleetOverlayWrite(prior, { ...write, lowerOverrides: lower.overrides }) === reviewed)
+                return null;
+        }
+        catch (error) {
+            return error.message;
+        }
+        return "stale preview — the repo overlay or a lower config layer changed after the review diff was rendered; press w to review what would be written now";
+    };
     const reviewOverlay = (state) => {
         const staged = structuredClone(initial);
         // OBS-994/FL-1, OBS-1099 add.1: every schema-enumerated deny scope rides the same review/write funnel
@@ -737,6 +756,9 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             pendingWrite = null;
             return { kind: "empty" };
         }
+        const lower = lowerLayerModelOverrides({ globalDir });
+        if (lower.ok)
+            lowerOverrides = lower.overrides;
         const write = {
             initial,
             edited: staged,
@@ -762,17 +784,20 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         catch {
             poolNotes = [];
         }
+        const notes = [...(lower.ok ? [] : [`${lower.error} — y will be refused`]), ...poolNotes];
         return {
             kind: "diff",
             before,
             after,
             diff: unifiedYamlDiff(before, after, path),
             path,
-            ...(poolNotes.length ? { notes: poolNotes } : {}),
+            ...(notes.length ? { notes } : {}),
         };
     };
-    const reloadGuard = io.reloadGuard
+    const loaderGuard = io.reloadGuard
         ?? ((bytes) => overlayBytesLoadError(cwd, bytes, { globalDir }));
+    // OBS-1188: a stale preview or an unreadable lower layer answers on the same error channel as the loader
+    const reloadGuard = (bytes) => (pendingWrite && stalePreview(pendingWrite, bytes)) || loaderGuard(bytes);
     const props = {
         ageMs: doctorAgeMs(cwd),
         adapters,
@@ -820,7 +845,20 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         const write = pendingWrite;
         if (!write)
             throw new Error("fleet write reached confirmation without a staged overlay mutation");
-        writeFleetOverlay(result.review.path, (prior) => renderFleetOverlayWrite(prior, write));
+        // OBS-1188: re-checked against the bytes on disk at write time; a refusal throws before the temp file exists
+        try {
+            writeFleetOverlay(result.review.path, (prior) => {
+                const stale = stalePreview(write, result.review.after, prior);
+                if (stale !== null)
+                    throw new ConfigError(stale);
+                return result.review.after;
+            });
+        }
+        catch (error) {
+            if (error instanceof ConfigError)
+                return `fleet: nothing written — ${error.message}`;
+            throw error;
+        }
         // OBS-529: a freshly classified model has no probe verdict (doctor probes CONFIGURED models,
         // and it was not configured at probe time), so it stays unroutable — invisible in every
         // picker — until the next probe. Name the step, or the classify flow reads as broken.

package/dist/cli/commands/plan.js

@@ -11,9 +11,9 @@ import { batteryPriority, chainDepth, dispatchWaves, graphDefinitionHash, loadGr
 import { filesGlob } from "../../graph/files-glob.js";
 import { renderAcceptanceItem } from "../../graph/schema.js";
 import { pendingDaemonApprovalActions, resolveRunMode } from "../../run/daemon.js";
-import { disallowedBy, excludedChannels, exclusionLine, routingEntrySeatLines } from "../../route/preference.js";
+import { disallowedBy, excludedChannels, exclusionLine, observedSeat, routingEntrySeatLines } from "../../route/preference.js";
 import { decayWeight, HALF_LIFE_RUNS, staffLedEvidence } from "../../route/profile.js";
-import { route, RoutingError } from "../../route/router.js";
+import { resolvedFloor, route, RoutingError } from "../../route/router.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
 import { modelId, modelProvider, pickReviewer } from "../../gates/review.js";
 import { Journal, loadRoutingProfile, readProfileCursor, recordedGraphDefinitionHash, RUNS_WINDOW } from "../../run/journal.js";
@@ -237,16 +237,21 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
         ...(runLine ? [runLine] : []),
         "",
     ];
-    const judgeDeny = disallowedBy(cfg.judge, cfg.routing, "judge");
+    // OBS-1186: the judge seat is judged under doctor's cached identity for that exact channel — the
+    // runtime judge's rule; unknown stays conservative (alias-family deny).
+    const judgeDeny = disallowedBy(observedSeat(health, cfg.judge.adapter, cfg.judge.model), cfg.routing, "judge");
     if (judgeDeny?.by === "deny") {
         lines.push(`REFUSAL OBS-576: judge seat ${cfg.judge.adapter}:${cfg.judge.model} is removed by flat routing.deny (${judgeDeny.entry}) — move worker-only policy to routing.deny.workers`, "");
     }
     const entrySeats = routingEntrySeatLines(cfg);
     if (entrySeats.length)
         lines.push(...entrySeats, "");
-    const derivation = (shape) => {
-        const floor = cfg.routing.floors[shape];
-        return floor ? `    floor ${floor} ← ${mode.provenance[shape] ?? "config floors"}` : null;
+    // OBS-1185: the floor route() resolved for THIS task — a task hint over the configured/mode floor.
+    const derivation = (t) => {
+        const floor = resolvedFloor(t, cfg);
+        if (!floor)
+            return null;
+        return `    floor ${floor.tier} ← ${floor.source === "task" ? "task hint" : mode.provenance[t.shape] ?? "config floors"}`;
     };
     const excluded = excludedChannels(cfg, adapters, health);
     if (excluded.length)
@@ -408,7 +413,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             const review = reviewSeat(t, r.assignment);
             cost += est + judge.cost + review.cost;
             lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`, `    judge: ${judge.line}${judge.cost ? ` ~$${judge.cost.toFixed(2)}` : ""}`, `    review: ${review.line}${review.cost ? ` ~$${review.cost.toFixed(2)}` : ""}`, chainLine(t));
-            const d = derivation(t.shape);
+            const d = derivation(t);
             if (d)
                 lines.push(d);
             if (r.deviation) {
@@ -432,7 +437,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
                 throw e;
             const msg = `${e.message}${exclusionReason(e.message)}`;
             lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} !! ${msg}`, chainLine(t));
-            const d = derivation(t.shape);
+            const d = derivation(t);
             if (d)
                 lines.push(d);
             lints.push(`${t.id}: unroutable — ${msg}`);

package/dist/cli/commands/report.d.ts

@@ -1,4 +1,5 @@
+import type { BaselineCommand } from "../../gates/baseline.js";
 import { type ChannelCost } from "../../report/cost.js";
 import { type JournalEvent, type TelemetryRow } from "../../run/journal.js";
-export declare function renderMarkdownRecord(runId: string, events: JournalEvent[], prices?: ChannelCost[], rows?: TelemetryRow[]): string;
+export declare function renderMarkdownRecord(runId: string, events: JournalEvent[], prices?: ChannelCost[], rows?: TelemetryRow[], suite?: BaselineCommand): string;
 export declare function report(argv: string[], cwd?: string): Promise<string>;

package/dist/cli/commands/report.js

@@ -1,4 +1,5 @@
-import { writeFileSync } from "node:fs";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { parseArgs } from "node:util";
 import { ttyVisual } from "../../adapters/model-lints.js";
 import { addUsage } from "../../adapters/types.js";
@@ -12,6 +13,7 @@ import { assignmentChannel, buildOperatorRecord, formatChannelMoney, formatChann
 import { cellsOf, cellSummary } from "../../route/profile.js";
 import { Journal, loadRoutingProfile } from "../../run/journal.js";
 import { baselineProvenanceOf, fingerprintsOf, forgivenFingerprints, forgivenGateRow, formatBaselineProvenance, formatFingerprints, formatForgiven, formatTipProof, runEndTipProof, } from "../../run/daemon.js";
+import { formatSpan, WALL_PRIORITY_TEXT, wallBudget, wallBudgetFacts } from "../../run/wall-budget.js";
 import { deriveRunCockpitData } from "../../tui/cockpit/derive.js";
 const n = (x) => x.toLocaleString("en-US"); // explicit locale — CI/darwin flake guard
 const EM = "—";
@@ -75,6 +77,44 @@ const wallClock = (start, end) => {
     const minutes = Math.floor(seconds / 60);
     return minutes ? `${minutes}m ${seconds % 60}s` : `${seconds}s`;
 };
+// OBS-1201: the disjoint wall budget, or why the journal cannot give one — never a zeroed table.
+const wallFacts = (events) => {
+    const budget = wallBudget(events);
+    if (!budget)
+        return [["window", "not measurable — the journal names no run-start with a readable timestamp"]];
+    return [["window", `${formatSpan(budget.wallMs)} — each instant counted once, by priority ${WALL_PRIORITY_TEXT}; task-time sums concurrent spans`], ...wallBudgetFacts(budget)];
+};
+// OBS-634: the four numbers the baseline capture already measured for the test command. A capture that
+// measured nothing says so; a missing number is not measurable, never a zero.
+const suiteTelemetry = (entry) => {
+    if (!entry)
+        return "not recorded — this run's baseline holds no test capture";
+    if (entry.infra)
+        return `not measurable — the baseline capture returned no verdict (${entry.invalidCause ?? "infra"})`;
+    if (typeof entry.durationMs !== "number" || !Number.isFinite(entry.durationMs))
+        return "not recorded — the baseline predates capture timing";
+    const unmeasured = "not measurable (the runner named no per-file durations)";
+    const sum = entry.fileDurationSumMs;
+    const parallelism = entry.impliedParallelism;
+    const longest = entry.longestFile;
+    return [
+        `wall ${formatSpan(entry.durationMs)}`,
+        `file-sum ${typeof sum === "number" ? formatSpan(sum) : unmeasured}`,
+        `implied parallelism ${typeof parallelism === "number" ? parallelism.toFixed(2) : unmeasured}`,
+        `longest file ${longest ? `${longest.file} ${formatSpan(longest.durationMs)}` : unmeasured}`,
+        ...(typeof entry.fileCount === "number" ? [`${entry.fileCount} files`] : []),
+    ].join(" · ");
+};
+/** The run's own baseline.json test entry; absent or unreadable reads as not recorded. */
+const baselineTestEntry = (runDir) => {
+    try {
+        const baseline = JSON.parse(readFileSync(join(runDir, "baseline.json"), "utf8"));
+        return baseline.commands?.test;
+    }
+    catch {
+        return undefined;
+    }
+};
 const detail = (value) => typeof value === "string" || typeof value === "number" ? String(value) : EM;
 // T11: a gate that declined never ran. Drop those before the comparison metrics so the pass rate
 // counts only gates that actually ran — a declined gate is never a pass and never pads the base.
@@ -194,7 +234,7 @@ const fingerprintClauses = (data) => {
         + `; forgiven vs baseline: ${formatFingerprints(forgiven)} — ${formatBaselineProvenance(baselineProvenanceOf(data.baselineProvenance))}`;
 };
 // VIS-07 / REC-01: derived only from the run journal, telemetry, and local configuration.
-export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
+export function renderMarkdownRecord(runId, events, prices = [], rows = [], suite) {
     const runStart = events.find((e) => e.event === "run-start");
     const runEnd = [...events].reverse().find((e) => e.event === "run-end");
     const baseRef = typeof runStart?.data.baseRef === "string" ? runStart.data.baseRef : EM;
@@ -242,6 +282,11 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
         `- **consults:** ${events.filter((e) => e.event === "consult-verdict").length}`,
         `- **escalations:** ${events.filter((e) => e.event === "escalation").length}`,
         "",
+        "## Wall budget",
+        "",
+        ...wallFacts(events).map(([label, fact]) => `- **${label}:** ${fact}`),
+        `- **suite telemetry (baseline test capture):** ${suiteTelemetry(suite)}`,
+        "",
     ];
     lines.push("## Channels", "");
     const operatorRecords = buildOperatorRecord(events, prices);
@@ -326,7 +371,7 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
     }
     return lines.join("\n").trimEnd() + "\n";
 }
-function textReport(runId, events, rows, cwd) {
+function textReport(runId, events, rows, cwd, suite) {
     // one group per adapter:model, carrying channel + the folded usage across its rows
     const groups = new Map();
     for (const r of rows) {
@@ -388,6 +433,10 @@ function textReport(runId, events, rows, cwd) {
         `tickmark rate: ${gateRan ? Math.round((100 * gatePass) / gateRan) : 0}% (${gatePass}/${gateRan})${declinedCount ? ` · declined: ${declinedCount}` : ""}`,
         `escalations: ${escalations} · National Office consults: ${consults} · quota failovers: ${failovers}`,
         "",
+        "wall budget — exposed wall, disjoint:",
+        ...wallFacts(events).map(([label, fact]) => `  ${label.padEnd(14)} ${fact}`),
+        `  ${"suite".padEnd(14)} ${suiteTelemetry(suite)}`,
+        "",
         "spend — tokens (measured where observed):",
         ...tokenLines,
         "spend — money:",
@@ -407,7 +456,7 @@ const stylizeReport = (out) => {
         return out;
     return out
         .replace(/^.*$/m, (first) => `${title(first)}\n${rule()}`) // non-global /m ⇒ first line only
-        .replace(/^(engagement summary — audit trail:|spend — tokens[^\n]*|spend — money:|learning \([^\n]*)$/gm, (l) => dim(l));
+        .replace(/^(engagement summary — audit trail:|wall budget — [^\n]*|spend — tokens[^\n]*|spend — money:|learning \([^\n]*)$/gm, (l) => dim(l));
 };
 export async function report(argv, cwd = process.cwd()) {
     const { values, positionals } = parseArgs({
@@ -428,6 +477,7 @@ export async function report(argv, cwd = process.cwd()) {
     const events = j.read();
     const rows = j.readTelemetry();
     const cfg = loadConfig(cwd);
+    const suite = baselineTestEntry(j.dir);
     let bundleNote = "";
     if (values.bundle) {
         // Local-only write of the pure proof packet — no network path exists in buildProofBundle.
@@ -454,7 +504,7 @@ export async function report(argv, cwd = process.cwd()) {
         comparison = "\n" + outcome.text;
     }
     if (values.md) {
-        return bundleNote + renderMarkdownRecord(runId, events, estimateCosts(rows, cfg.cost), rows) + comparison;
+        return bundleNote + renderMarkdownRecord(runId, events, estimateCosts(rows, cfg.cost), rows, suite) + comparison;
     }
-    return bundleNote + stylizeReport(textReport(runId, events, rows, cwd)) + comparison;
+    return bundleNote + stylizeReport(textReport(runId, events, rows, cwd, suite)) + comparison;
 }

package/dist/cli/commands/status.js

@@ -17,6 +17,7 @@ import { isPidLive, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
 import { normalizeStallSnapshot } from "../../run/stall.js";
+import { formatSpan, wallBudget, wallBudgetFacts } from "../../run/wall-budget.js";
 import { armWatchSupervision, observeNamedRun, WATCH_OWNER_ENV, readSupervision, supervisionText } from "../../run/supervision.js";
 import { deriveRunCockpitData, } from "../../tui/cockpit/derive.js";
 import { cellWidth, fitCells, wrapCells } from "../../tui/cockpit/width.js";
@@ -1155,6 +1156,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
             ...(hotPhase ? { hotPhase } : {}),
             ...(runId ? { runId } : {}),
             workerPhases: [...phases.values()].filter((phase) => phase.phase === "worker"),
+            events,
         };
     }
     // TTY: the operator-approved task table. The daemon gives this surface a ~110-column pane first;
@@ -1364,8 +1366,22 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
         ...(hotPhase ? { hotPhase } : {}),
         ...(runId ? { runId } : {}),
         workerPhases: [...phases.values()].filter((phase) => phase.phase === "worker"),
+        events,
     };
 };
+// OBS-1201: the one-shot print closes with where the run's wall went (src/run/wall-budget.ts). A
+// window of zero length measured nothing, so it prints nothing; watch frames are untouched. Rows wrap
+// to the board width, so narrowing costs rows, never columns.
+const wallBudgetLines = (events) => {
+    const budget = wallBudget(events);
+    if (!budget || budget.wallMs <= 0)
+        return [];
+    const columns = Math.max(40, process.stdout.columns ?? 120);
+    return [
+        `  wall budget ${formatSpan(budget.wallMs)} · each instant once, by priority`,
+        ...wallBudgetFacts(budget).map(([label, fact]) => `    ${label} ${fact}`),
+    ].flatMap((line) => wrapCells(line, columns, { continuationPrefix: "      " }));
+};
 /**
  * The compact form a statusline calls, so journal interpretation happens ONCE, inside the product.
  * (An operator-local bash reimplementation counted `tip-verify` events instead of reading the
@@ -1401,7 +1417,9 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
     // The task-table frame owns its own two-row brand lockup; the four-row global banner would
     // create the second header the approved replacement removes.
     if (!argv.includes("--watch")) {
-        return renderFrame(cwd, binaryVersion, opts.now?.() ?? Date.now(), 0, undefined, false, namedRunId).content;
+        const frame = renderFrame(cwd, binaryVersion, opts.now?.() ?? Date.now(), 0, undefined, false, namedRunId);
+        const wall = wallBudgetLines(frame.events);
+        return wall.length ? [frame.content, "", ...wall].join("\n") : frame.content;
     }
     const eventStream = argv.some((arg) => arg === "--events" || arg === "--jsonl" || arg === "--decision-events");
     const webhookUrl = opts.webhookUrl

package/dist/compile/native.js

@@ -911,6 +911,13 @@ acceptance is required on every task (a nested list of observable outcomes).
     - Enumerating one axis exhaustively is what hides the others. A spec that guards PARTIAL coverage
       site-by-site, member-by-member, can be defeated wholesale by CONDITIONAL coverage, which leaves
       every enumeration satisfied. After you enumerate, ask what a single flag would do to the whole set.
+    - A GOAL STATING AN INVARIANT OVER "every", "never" OR "any" CARRIES ITS CLOSED CASE TABLE AS A
+      CRITERION: the in-scope consumers, bridges, operations and event sequences it ranges over, each a
+      row a test exercises. An unenumerated invariant is repaired one edge per review round while every
+      round re-judges the accumulated diff (OBS-1019 add.2). The table binds author and reviewer, never a
+      worker's claim: each review material binds its declared class to the goal clause or criterion it
+      violates through input-to-consequence evidence marked executed, static or blocked. A worker's own
+      table alone never silences a real finding, and blocked evidence is never a pass.
     - EVERY CRITERION NAMES THE PAIR IT DISCRIMINATES: the correct case that MUST PASS, and the
       neighbouring plausible-wrong or false-clean case that MUST FAIL. Two easy examples that both pass are
       not discrimination — they are two ways of being green, and the wrong half is the whole point: it is

package/dist/config/config.d.ts

@@ -181,13 +181,13 @@ export declare function effectiveReviewPolicy(files: ReadonlyArray<string>, revi
 export declare function criticalPathHits(files: ReadonlyArray<string>, criticalPaths?: ReadonlyArray<string>): string[];
 export declare const ExecutionPolicySchema: z.ZodObject<{
     boundedInfrastructure: z.ZodDefault<z.ZodBoolean>;
-    repairSelection: z.ZodDefault<z.ZodBoolean>;
+    repairSelection: z.ZodOptional<z.ZodBoolean>;
     taskExecutionLimitMs: z.ZodNumber;
 }, z.core.$strict>;
 export declare const TickmarkrConfigSchema: z.ZodObject<{
     executionPolicy: z.ZodOptional<z.ZodObject<{
         boundedInfrastructure: z.ZodDefault<z.ZodBoolean>;
-        repairSelection: z.ZodDefault<z.ZodBoolean>;
+        repairSelection: z.ZodOptional<z.ZodBoolean>;
         taskExecutionLimitMs: z.ZodNumber;
     }, z.core.$strict>>;
     concurrency: z.ZodNumber;
@@ -309,6 +309,8 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
         tipTest: z.ZodOptional<z.ZodString>;
         lint: z.ZodOptional<z.ZodString>;
         diffCap: z.ZodOptional<z.ZodNumber>;
+        evidenceQuotaBytes: z.ZodOptional<z.ZodNumber>;
+        repairSelection: z.ZodOptional<z.ZodBoolean>;
         byShape: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             plan: "plan";
             spec: "spec";
@@ -374,6 +376,7 @@ export type TickmarkrConfig = z.infer<typeof TickmarkrConfigSchema>;
 export declare class ConfigError extends Error {
     constructor(message: string);
 }
+export declare const DEFAULT_EVIDENCE_QUOTA_BYTES: number;
 export declare const DEFAULT_CONFIG: TickmarkrConfig;
 export declare function globalConfigDir(): string;
 export declare function overlayPreferShapes(repoRoot: string, opts?: {
@@ -395,12 +398,22 @@ export declare function loadConfigWithMode(repoRoot: string, opts?: {
     cfg: TickmarkrConfig;
     mode: ModeResolution;
 };
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay resolve them. */
+export type LowerLayerModelOverrides = Record<string, Record<string, Record<string, unknown>>>;
 /** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
  *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
- *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited. */
+ *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited.
+ *  OBS-1188: an unparseable global file, or a non-map where this path expects a map, is an error —
+ *  never an empty lower layer, which would silently drop the metadata a write must re-mask. */
 export declare function lowerLayerModelOverrides(opts?: {
     globalDir?: string;
-}): Record<string, Record<string, Record<string, unknown>>>;
+}): {
+    ok: true;
+    overrides: LowerLayerModelOverrides;
+} | {
+    ok: false;
+    error: string;
+};
 export declare function loadConfig(repoRoot: string, opts?: {
     globalDir?: string;
 }): TickmarkrConfig;