tickmarkr 2.6.2 → 2.6.4

package/README.md

@@ -183,8 +183,16 @@ can enact the release at its next task boundary; a different live run must end b
 one resumes. Keep any resume refusal and its remediation visible, including a deny/prefer
 config conflict; repair the source/config as directed, never edit the compiled graph to
 force success. After resume, CURRENT TIP is PENDING until fresh evidence arrives. Completion
-requires the latest run-end, a nonfailed known tip result, and empty `failed`, `human`,
-`blocked` and `pending` buckets; the completed case has 3/3 recorded merges. An unrelated
+requires the latest run-end, a nonfailed known tip result, empty `failed`, `human`,
+`blocked` and `pending` buckets, and owed checks outstanding empty AND known in CURRENT
+`tickmarkr status <runId>` (`outstanding 0`); the completed case has 3/3 recorded merges.
+Empty buckets alone are not completion (D-660): 3/3 merged with every bucket empty and the
+tip passed, after the operator waived T2's review, leaves one accepted-risk review check owed.
+`run`/`resume` exit 0 on execution alone, their final line says
+`execution complete; outstanding 1 (T2 review)` rather than `verified`, and status reads
+`outstanding 1`. That run completes only when `tickmarkr verify --record <runId>` discharges
+the check and CURRENT status reads `outstanding 0` — a discharge after run-end counts, while the
+run-end record keeps its old count; `outstanding unknown` never completes. An unrelated
 graph says “not comparable” and supplies no borrowed denominator. Historical GATES RAN
 does not establish current completion.
 
@@ -208,6 +216,8 @@ worker. Other parks have different permitted decisions:
 | Human gate / other non-gate park | Plain approve records permission to dispatch. |
 | Attempt cap | Plain approve grants a fresh attempt budget; prior routing exclusions remain. |
 | Infrastructure | Plain approve or `--recheck`; recheck reruns the declared battery and satisfies no gate. |
+| Stall with a recorded `reapFailure` (the worker's process census was unreadable or had survivors) | `--recheck` bound to that park's token re-verifies the parked attempt's owned census: only an explicitly recorded empty survivors array (`[]`) releases its harvested commits to the declared battery, with no worker; a missing, unreadable or surviving census re-parks the stall (new token, still approve/recheck). Plain approve dispatches a worker. |
+| Ordinary stall (no `reapFailure`) | Plain approve only — it dispatches a worker; `--recheck` refuses. |
 | Failed review gate | `--waive` satisfies only that identified gate; `--uphold` funds one fixed attempt carrying findings; `--recheck` reruns the battery. |
 | Other failed gate | `--waive` or `--recheck`; plain approve refuses. |
 | Tombstone / gate failure without identifying evidence | Diagnostic only; no invented decision. |

package/dist/adapters/codex.d.ts

@@ -1,7 +1,8 @@
-import { type TrustDialog, type TrustVerdict, type WorkerAdapter } from "./types.js";
+import { type ModelRetirement, type TrustDialog, type TrustVerdict, type WorkerAdapter } from "./types.js";
 export declare function readCodexModelsCache(path?: string): {
     models: string[];
     fetchedAt?: string;
+    retirements?: Record<string, ModelRetirement | null>;
 };
 export declare const CODEX_TRUST_DIALOG: TrustDialog;
 export declare const CODEX_INPUT_BOX: import("./types.js").InputBox;

package/dist/adapters/codex.js

@@ -61,20 +61,39 @@ function codexSessionDayDirs(sessions, sinceMs) {
 // Fails OPEN to { models: [] } on missing/corrupt cache. Version drift observed (installed CLI
 // 0.143.0 vs cache client_version 0.144.0, 2026-07-10) — hence the defensive try/catch and no shape
 // assumptions. CODEX_HOME is codex's own relocation env. fetchedAt is the honest codex knowledge age.
+// v2.6.4 T2 (B1a): each listed entry's `upgrade` is the CLI's own retirement notice (0.159.0 cache,
+// 2026-09-29: gpt-5.5 → {model: gpt-5.6-sol, retirement_at: 2026-10-14T19:00:00Z}; every other listed
+// id carries upgrade: null). null records known clean; a malformed or absent `upgrade` records nothing,
+// so that id stays unknown. An unreadable cache returns no retirements at all (unknown, never clean).
 export function readCodexModelsCache(path) {
     const p = path ?? join(process.env.CODEX_HOME || join(homedir(), ".codex"), "models_cache.json");
     try {
         const d = JSON.parse(readFileSync(p, "utf8"));
-        const models = (d.models ?? [])
-            .filter((m) => m?.visibility === "list" && typeof m.slug === "string" && m.slug.length > 0)
-            .map((m) => m.slug)
-            .filter((id) => MODEL_ID_RE.test(id));
-        return { models, fetchedAt: typeof d.fetched_at === "string" ? d.fetched_at : undefined };
+        const listed = (d.models ?? [])
+            .filter((m) => m?.visibility === "list" && typeof m.slug === "string" && m.slug.length > 0 && MODEL_ID_RE.test(m.slug));
+        const retirements = {};
+        for (const m of listed) {
+            const notice = codexRetirement(m.upgrade);
+            if (notice !== undefined)
+                retirements[m.slug] = notice;
+        }
+        return { models: listed.map((m) => m.slug), fetchedAt: typeof d.fetched_at === "string" ? d.fetched_at : undefined, retirements };
     }
     catch {
         return { models: [] };
     }
 }
+function codexRetirement(upgrade) {
+    if (upgrade === null)
+        return null;
+    const u = upgrade;
+    if (typeof u?.retirement_at !== "string" || !Number.isFinite(Date.parse(u.retirement_at)))
+        return undefined;
+    if (u.model === undefined)
+        return { retiresAt: u.retirement_at };
+    // the successor id comes from an external file and is rendered in lints — same charset gate as slugs
+    return typeof u.model === "string" && MODEL_ID_RE.test(u.model) ? { retiresAt: u.retirement_at, successor: u.model } : undefined;
+}
 // tickmarkr worktrees keep their gitdir under the MAIN repo's .git/worktrees/<name> — outside the
 // workspace-write sandbox root — so git commit dies on index.lock (incident run-20260709-104447
 // P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the pane shell at the
@@ -272,6 +291,8 @@ export const codex = {
     // v1.5 MODEL-05: codex reads an offline cache, so "now" would re-stamp an ancient cache fresh and the
     // 30-day staleness lint could never fire. Surface the cache's own fetched_at so doctor stamps the real age.
     listModelsFetchedAt: () => readCodexModelsCache().fetchedAt,
+    // v2.6.4 T2 (B1a): the cache's per-model retirement notices, persisted beside models in doctor.json.
+    listModelsRetirements: () => readCodexModelsCache().retirements,
     collectUsage(cwd, sinceMs) {
         try {
             const real = realpathSync(cwd);

package/dist/adapters/model-lints.d.ts

@@ -81,6 +81,7 @@ export declare function modelLints(cfg: TickmarkrConfig, health: Record<string,
     tty?: boolean;
     stateDir?: string;
     overlayPreferShapes?: ReadonlySet<string>;
+    now?: Date;
 }): string[];
 export declare function formatModelAuthLine(excluded: {
     key: string;

package/dist/adapters/model-lints.js

@@ -478,10 +478,55 @@ export function preferEntryLints(cfg, health, mapShapes = new Set()) {
     sweep("consult.prefer", cfg.consult.prefer);
     return lints;
 }
+// v2.6.4 T2 (B1a): doctor.json is read without a schema (compat), so a stored notice is re-checked here —
+// anything but null (known clean) or a dated notice reads as unknown, never as clean.
+function storedRetirement(record, model) {
+    if (!record || typeof record !== "object")
+        return undefined;
+    const r = record[model];
+    if (r === null)
+        return null;
+    const n = r;
+    if (typeof n?.retiresAt !== "string" || !Number.isFinite(Date.parse(n.retiresAt)))
+        return undefined;
+    if (n.successor === undefined)
+        return { retiresAt: n.retiresAt };
+    return typeof n.successor === "string" && MODEL_ID_RE.test(n.successor) ? { retiresAt: n.retiresAt, successor: n.successor } : undefined;
+}
+// Configured AND listed models only — a configured id the CLI stopped listing already carries the
+// tombstone advisory. The CLI's notice is quoted as-is: its successor is the CLI's upgrade target, never
+// a tier or benchmark claim, and no model name or visibility is read as one. Advisory: routing unchanged.
+function retirementLints(id, listedConfigured, record, nowMs) {
+    const lints = [];
+    const unknown = [];
+    for (const model of listedConfigured) {
+        const notice = storedRetirement(record, model);
+        if (notice === undefined) {
+            unknown.push(model);
+            continue;
+        }
+        if (!notice)
+            continue; // listed with no notice: known clean
+        const successor = notice.successor
+            ? `successor ${notice.successor} (named by the CLI — not a tier claim; classify it per benchmark policy)`
+            : "no successor named";
+        lints.push(nowMs >= Date.parse(notice.retiresAt)
+            ? `${id}: ${model} retired ${notice.retiresAt} per the CLI's notice; ${successor} — tombstone it (${model}: null overlay) or verify the id (advisory — routing unchanged)`
+            : `${id}: ${model} retires ${notice.retiresAt} per the CLI's notice; ${successor} — tombstone it (${model}: null overlay) before then (advisory — routing unchanged)`);
+    }
+    if (unknown.length) {
+        const why = record && typeof record === "object"
+            ? "the CLI's notice is absent or unreadable"
+            : "doctor record carries no CLI retirement notices; rerun tickmarkr doctor";
+        lints.push(`${id}: retirement unknown for ${unknown.join(", ")} — ${why}`);
+    }
+    return lints;
+}
 // Diffs detected models (doctor.json) against configured tiers, both directions, per installed adapter.
 // No `  ! ` prefix here — the consumer (doctor rows / plan lints) owns that. Pre-v1.5 doctor.json (models:[], no
 // modelsDetectedAt) is the compat baseline: `?.`/`?? []` everywhere, no zod (would reject old files).
 export function modelLints(cfg, health, adapters, opts) {
+    const nowMs = (opts?.now ?? new Date()).getTime();
     const cap = opts?.tty ? TTY_LINT_CAP : LINT_CAP;
     const doctorRef = opts?.tty ? doctorJsonRef(opts.stateDir ?? DEFAULT_STATE_DIR) : "";
     const lints = [];
@@ -517,6 +562,8 @@ export function modelLints(cfg, health, adapters, opts) {
                 lints.push(`${id}: tiers lists ${model} — CLI no longer reports it; tombstone it (${model}: null overlay) or verify the id`);
             }
         }
+        if (adapter.listModelsRetirements)
+            lints.push(...retirementLints(id, configured.filter((m) => detected.includes(m)), h?.modelRetirements, nowMs));
         const extra = collapseUnclassified(detected, new Set(configured));
         if (extra.length) {
             const shown = extra.slice(0, cap).map((row) => row.model).join(", ");
@@ -525,7 +572,7 @@ export function modelLints(cfg, health, adapters, opts) {
         }
         const at = h?.modelsDetectedAt;
         if (at) {
-            const days = Math.floor((Date.now() - Date.parse(at)) / DAY_MS); // completed days — never overstate age
+            const days = Math.floor((nowMs - Date.parse(at)) / DAY_MS); // completed days — never overstate age
             if (days >= MODEL_STALE_DAYS)
                 lints.push(`${id}: model knowledge is ${days} days old — rerun tickmarkr doctor`);
         }

package/dist/adapters/model-windows.d.ts

@@ -15,7 +15,8 @@ export type ModelWindowResolution = {
 };
 /**
  * Validate cited model-window claims before production code can consume them.
- * These values are vendor-published claims, not measurements made by tickmarkr.
+ * These values are vendor-published claims (a vendor page, or a vendor CLI's own model cache), not
+ * measurements made by tickmarkr.
  */
 export declare function loadModelWindowClaims(input: unknown): readonly ModelWindowClaim[];
 /** The closed, production-readable catalog of cited context-window claims. */

package/dist/adapters/model-windows.js

@@ -9,7 +9,8 @@ const ModelWindowClaimSchema = z
     .strict();
 /**
  * Validate cited model-window claims before production code can consume them.
- * These values are vendor-published claims, not measurements made by tickmarkr.
+ * These values are vendor-published claims (a vendor page, or a vendor CLI's own model cache), not
+ * measurements made by tickmarkr.
  */
 export function loadModelWindowClaims(input) {
     const claims = z.array(ModelWindowClaimSchema).parse(input);
@@ -22,8 +23,15 @@ export function loadModelWindowClaims(input) {
     return Object.freeze(claims.map((claim) => Object.freeze(claim)));
 }
 const ANTHROPIC_SOURCE = "https://platform.claude.com/docs/en/about-claude/models/overview";
-const OPENAI_SOURCE = "https://developers.openai.com/api/docs/models";
-const OPENAI_GPT_55_SOURCE = "https://developers.openai.com/api/docs/models/gpt-5.5";
+// v2.6.4 T3 (D-717): the Codex rows cite the installed CLI's own models_cache.json snapshot, not the API
+// docs. That file has no public URL, so the source names it in its own scheme, snapshot instant included.
+// Every listed entry there carried context_window=272000 — the budget the codex CLI launches with. The
+// API docs' 1,050,000 (formerly cited here) describes the API surface; it is superseded for these CLI
+// seeds, not called false. These windows are the CLI's self-report, not a tickmarkr measurement. Only the
+// window comes from this snapshot: the codex tiers seeded beside it (config.ts) rest on the provider's
+// descriptions and the retained workhorse tier policy, not on any measured benchmark.
+const CODEX_CLI_CACHE_SOURCE = "codex-cli:models_cache.json#fetched_at=2026-09-29T16:09Z";
+const CODEX_CLI_CACHE_READ_DATE = "2026-09-29";
 const CURSOR_SOURCE = "https://cursor.com/help/ai-features/max-mode";
 const ZAI_SOURCE = "https://z.ai/blog/glm-5.2";
 const XAI_SOURCE = "https://docs.x.ai/developers/models/grok-4.5";
@@ -37,10 +45,13 @@ const VENDORED_MODEL_WINDOW_CLAIMS = [
     { modelId: "opus", window: 1_000_000, source: ANTHROPIC_SOURCE, readDate: READ_DATE },
     { modelId: "sonnet", window: 1_000_000, source: ANTHROPIC_SOURCE, readDate: READ_DATE },
     { modelId: "haiku", window: 200_000, source: ANTHROPIC_SOURCE, readDate: READ_DATE },
-    { modelId: "gpt-5.6-sol", window: 1_050_000, source: OPENAI_SOURCE, readDate: READ_DATE },
-    { modelId: "gpt-5.5", window: 1_050_000, source: OPENAI_GPT_55_SOURCE, readDate: READ_DATE },
-    { modelId: "gpt-5.6-terra", window: 1_050_000, source: OPENAI_SOURCE, readDate: READ_DATE },
-    { modelId: "gpt-5.6-luna", window: 1_050_000, source: OPENAI_SOURCE, readDate: READ_DATE },
+    { modelId: "gpt-6-astra", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-6-sol", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-6-luna", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-5.6-sol", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-5.5", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-5.6-terra", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-5.6-luna", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "composer-2.5", window: 200_000, source: CURSOR_SOURCE, readDate: READ_DATE },
     { modelId: "composer-2.5-fast", window: 200_000, source: CURSOR_SOURCE, readDate: READ_DATE },
     { modelId: "claude-fable-5-1", window: 1_000_000, source: ANTHROPIC_SOURCE, readDate: OBS_871_READ_DATE },

package/dist/adapters/types.d.ts

@@ -36,6 +36,10 @@ export interface ModelAuth {
     probedAt: string;
     identity?: string;
 }
+export interface ModelRetirement {
+    retiresAt: string;
+    successor?: string;
+}
 export interface AuthHealth {
     installed: boolean;
     authed: boolean;
@@ -46,6 +50,7 @@ export interface AuthHealth {
     servable?: string[];
     modelAuth?: Record<string, ModelAuth>;
     modelIdentities?: Record<string, string>;
+    modelRetirements?: Record<string, ModelRetirement | null>;
 }
 export declare function modelAuthed(health: AuthHealth | undefined, model: string, allowUnverifiedModels?: boolean): boolean;
 export interface Invocation {
@@ -190,6 +195,7 @@ export interface WorkerAdapter {
     parse(output: string, nonce: string): WorkerResult;
     listModels?(): Promise<string[]>;
     listModelsFetchedAt?(): string | undefined;
+    listModelsRetirements?(): Record<string, ModelRetirement | null> | undefined;
     collectUsage?(cwd: string, sinceMs: number): TokenUsage | undefined;
     contextUsage?(session: SessionRef): ContextUsage | null;
     readSessionTranscript?(session: SessionRef): {

package/dist/cli/commands/approve.d.ts

@@ -26,6 +26,8 @@ export interface NewestPark {
     failedGate: string | undefined;
     /** A pre-dispatch human gate whose reason marks it permanent by design (see isTombstonePark). */
     tombstone: boolean;
+    /** OBS-1202: a stall park's recorded reap failure (task-human data.reapFailure) — its census is unproven. */
+    reapFailure?: string;
 }
 /**
  * There is no closed park kind for a declaration-shaped retirement, so the evidence is the one the
@@ -46,13 +48,14 @@ export declare const parkToken: (park: Pick<NewestPark, "line" | "ts">) => strin
 /** OBS-1178: the newest task-failed row for a task — the failure a failed-task recheck binds to. */
 export declare function newestFailure(events: readonly JournalEvent[], taskId: string, sourceIndexes?: readonly number[]): DecisionBinding | undefined;
 /**
- * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra →
- * approve or recheck; review gate-fail → waive/uphold/recheck; other gate-fail → waive/recheck; a
+ * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra, and
+ * a stall park that recorded a reapFailure (OBS-1202), → approve or recheck; review gate-fail →
+ * waive/uphold/recheck; other gate-fail → waive/recheck; a
  * gate-fail park with no failed-gate evidence, or a tombstone → nothing (a diagnostic, never a
  * fabricated verb). The refusals in `approve` below enforce the same table; this is the one place a
  * surface may read it from, so what a menu offers and what the command accepts cannot drift.
  */
-export declare function permittedDecisionVerbs(park: Pick<NewestPark, "kind" | "failedGate" | "tombstone"> | undefined): readonly DecisionVerb[];
+export declare function permittedDecisionVerbs(park: Pick<NewestPark, "kind" | "failedGate" | "tombstone" | "reapFailure"> | undefined): readonly DecisionVerb[];
 /** The release marker this command appends for a verb on a park — the fact a read-back must match. */
 export declare function releaseForDecision(verb: DecisionVerb, park: Pick<NewestPark, "kind" | "failedGate">): string | undefined;
 export type ApprovalStatus = "deferred-live" | "recorded-no-owner";

package/dist/cli/commands/approve.js

@@ -1,11 +1,13 @@
 import { graphDefinitionHash, loadGraph, saveGraph, taskDefinitionFingerprint } from "../../graph/graph.js";
 import { execFileSync } from "node:child_process";
 import { userInfo } from "node:os";
+import { allAdapters } from "../../adapters/registry.js";
+import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
 import { integrationBranch } from "../../run/merge.js";
 import { separabilityErrors, surfaceErrors, taskBudgetErrors } from "../../compile/collateral.js";
 import { GATE_NAMES } from "../../graph/schema.js";
-import { applyScopeAmendments, bindingToken, engagementComparable, engagementReleased, failedGateBeforePark, parseBindingToken, physicalLine, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
+import { applyScopeAmendments, bindingToken, captureOwedCheck, engagementComparable, engagementReleased, failedGateBeforePark, parseBindingToken, physicalLine, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
 export const APPROVAL_DISPOSITIONS = ["dispatch", "waive-gate", "re-dispatch", "fund-fixed-attempt", "fresh-budget"];
 /**
  * What each disposition's release actually buys — the clause every operator-facing sentence about
@@ -59,6 +61,7 @@ sourceIndexes) {
             index: i, line: sourceIndexes?.[i] === undefined ? physicalLine(events, i) : sourceIndexes[i] + 1, ts: typeof e.ts === "string" ? e.ts : undefined, kind, reason,
             approveCommand: typeof e.data.approveCommand === "string" ? e.data.approveCommand : undefined,
             failedGate: failedGateBeforePark(events, taskId, i), tombstone: isTombstonePark(kind, reason),
+            ...(kind === "stall" && typeof e.data.reapFailure === "string" ? { reapFailure: e.data.reapFailure } : {}),
         };
     }
     return undefined;
@@ -83,8 +86,9 @@ export function newestFailure(events, taskId, sourceIndexes) {
     return undefined;
 }
 /**
- * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra →
- * approve or recheck; review gate-fail → waive/uphold/recheck; other gate-fail → waive/recheck; a
+ * FINAL §3.3's decision menu as data: human-gate/attempt-cap/other non-gate parks → approve; infra, and
+ * a stall park that recorded a reapFailure (OBS-1202), → approve or recheck; review gate-fail →
+ * waive/uphold/recheck; other gate-fail → waive/recheck; a
  * gate-fail park with no failed-gate evidence, or a tombstone → nothing (a diagnostic, never a
  * fabricated verb). The refusals in `approve` below enforce the same table; this is the one place a
  * surface may read it from, so what a menu offers and what the command accepts cannot drift.
@@ -99,6 +103,10 @@ export function permittedDecisionVerbs(park) {
     }
     if (park.kind === "infra")
         return ["approve", "recheck"];
+    // OBS-1202: an unreadable reap census parks finished work; recheck re-verifies that census and gates the
+    // harvested commits with no worker. An ordinary stall recorded no census failure: approve alone.
+    if (park.kind === "stall" && park.reapFailure !== undefined)
+        return ["approve", "recheck"];
     // OBS-1084: an authoring park whose newest gate row is a red tool gate is a runner report (a load
     // flake in an unowned suite), so the battery re-runs on the preserved ref with no worker.
     if (park.kind === "authoring" && isToolGate(park.failedGate))
@@ -196,6 +204,7 @@ export async function approve(argv, cwd = process.cwd()) {
         const gateFailPark = park?.kind === "gate-fail";
         const infraPark = park?.kind === "infra" || park?.kind === "diff-cap";
         const authoringRunnerPark = park?.kind === "authoring" && isToolGate(park.failedGate);
+        const reapFailurePark = park?.kind === "stall" && park.reapFailure !== undefined;
         const failedGate = gateFailPark || authoringRunnerPark ? park?.failedGate : undefined;
         const parkBinding = requireBound(runId, taskId, bound, park?.ts === undefined ? undefined : { line: park.line, ts: park.ts }, "park");
         if (namedGate !== undefined && namedGate !== park?.failedGate) {
@@ -263,7 +272,10 @@ export async function approve(argv, cwd = process.cwd()) {
             return disposition(cwd, runId, "fund-fixed-attempt", `upheld the reviewer for ${taskId} in ${runId} — by ${by}`, serialization.contended);
         }
         if (recheck) {
-            if ((!gateFailPark || !failedGate) && !infraPark && !authoringRunnerPark) {
+            if (park?.kind === "stall" && !reapFailurePark) {
+                throw new Error(`--recheck applies to a stall park only when it recorded a reapFailure (census recovery); ${taskId}'s stall park recorded none — plain approve dispatches a worker; refusing`);
+            }
+            if ((!gateFailPark || !failedGate) && !infraPark && !authoringRunnerPark && !reapFailurePark) {
                 throw new Error(`--recheck applies to a gate-fail, infra, diff-cap or red-tool-gate authoring park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
             journal.append("task-approved", taskId, {
@@ -276,14 +288,38 @@ export async function approve(argv, cwd = process.cwd()) {
                 // carry gate so their durable release row identifies the red tool gate that made recheck admissible.
                 ...(failedGate ? { failedGate } : {}),
                 ...(authoringRunnerPark && failedGate ? { gate: failedGate } : {}),
+                // OBS-1202: the daemon re-verifies the parked attempt's owned census before any gate runs.
+                ...(reapFailurePark ? { reapFailure: park.reapFailure } : {}),
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
-            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : `${park.kind} park`}; no gate marked satisfied`, serialization.contended);
+            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : reapFailurePark ? "reapFailure stall park; the owned census is re-verified before the gates" : `${park.kind} park`}; no gate marked satisfied`, serialization.contended);
         }
         if (waive) {
             if (!gateFailPark || !failedGate) {
                 throw new Error(`--waive applies to a gate-fail park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
+            // C1: the waiver's owed check rides the SAME row — one append, captured synchronously so a live
+            // daemon's boundary never observes the decision without its obligation (or a second write).
+            // The seats a review discharge may resolve to are this repository's declared channels, recorded on
+            // the row so every later fold reads the same table whatever process or checkout it runs in.
+            let integrationRef = "unknown";
+            let declared;
+            let owedTask;
+            try {
+                const cfg = loadConfig(cwd);
+                integrationRef = integrationBranch(cfg, runId);
+                declared = allAdapters().flatMap((a) => a.channels(cfg)).map((c) => ({ key: channelKey(c), vendor: c.vendor }));
+            }
+            catch { /* an unreadable config binds no range and declares no seat: unknown */ }
+            try {
+                owedTask = loadGraph(cwd).tasks.find((t) => t.id === taskId);
+            }
+            catch { /* recorded as unknown criteria and scope */ }
+            const obligation = captureOwedCheck({
+                cwd, runId, taskId, gate: failedGate, events, acceptance: owedTask?.acceptance, files: owedTask?.files, declared,
+                cause: reason ?? `operator waived failed ${failedGate} gate`, // the row's own park field binds the park
+                taskRef: `${integrationRef}--${taskId}`, integrationRef,
+            });
             journal.append("task-approved", taskId, {
                 by,
                 ...(reason ? { reason } : {}),
@@ -292,8 +328,9 @@ export async function approve(argv, cwd = process.cwd()) {
                 gate: failedGate,
                 park: parkBinding,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
+                obligation,
             });
-            return disposition(cwd, runId, "waive-gate", `waived failed gate ${failedGate} for ${taskId} in ${runId} — by ${by}`, serialization.contended);
+            return disposition(cwd, runId, "waive-gate", `waived failed gate ${failedGate} for ${taskId} in ${runId} — by ${by}; owes ${failedGate} check ${obligation.id}${obligation.known ? "" : " (debt unknown)"}`, serialization.contended);
         }
         if (gateFailPark) {
             const choices = [`--waive (disposition waive-gate)`, `--recheck (disposition re-dispatch)`];

package/dist/cli/commands/doctor.d.ts

@@ -34,6 +34,8 @@ export type DoctorOpts = {
     resolveOrcaBinary?: (cwd: string) => string | undefined;
     /** Test seam for the runner-owned JSON listing used by the acceptance-oracle report row. */
     listTests?: (cwd: string) => Promise<VitestListResult>;
+    /** Clock for model-knowledge lints (retirement notices, knowledge age); absent = the wall clock. */
+    now?: () => Date;
 };
 type OrcaCapability = {
     verdict: "pass" | "fail" | "warn";
@@ -173,6 +175,8 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
         tipTest?: string | undefined;
         lint?: string | undefined;
         diffCap?: number | undefined;
+        evidenceQuotaBytes?: number | undefined;
+        repairSelection?: boolean | undefined;
         byShape?: Partial<Record<"plan" | "spec" | "implement" | "tests" | "docs" | "migration" | "ui" | "refactor" | "chore", {
             [x: string]: unknown;
             acceptance?: boolean | undefined;
@@ -206,8 +210,8 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
     };
     executionPolicy?: {
         boundedInfrastructure: boolean;
-        repairSelection: boolean;
         taskExecutionLimitMs: number;
+        repairSelection?: boolean | undefined;
     } | undefined;
     setup?: string | undefined;
     cost?: {
@@ -298,6 +302,8 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
         tipTest?: string | undefined;
         lint?: string | undefined;
         diffCap?: number | undefined;
+        evidenceQuotaBytes?: number | undefined;
+        repairSelection?: boolean | undefined;
         byShape?: Partial<Record<"plan" | "spec" | "implement" | "tests" | "docs" | "migration" | "ui" | "refactor" | "chore", {
             [x: string]: unknown;
             acceptance?: boolean | undefined;
@@ -331,8 +337,8 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
     };
     executionPolicy?: {
         boundedInfrastructure: boolean;
-        repairSelection: boolean;
         taskExecutionLimitMs: number;
+        repairSelection?: boolean | undefined;
     } | undefined;
     setup?: string | undefined;
     cost?: {

package/dist/cli/commands/doctor.js

@@ -590,6 +590,11 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             // no fetch timestamp, so it still stamps now — its staleness lint is best-effort until it surfaces one.
             if (health[a.id].models.length)
                 health[a.id].modelsDetectedAt = a.listModelsFetchedAt?.() ?? new Date().toISOString();
+            // v2.6.4 T2 (B1a): the CLI's retirement notices ride into doctor.json beside the list they describe;
+            // an unreadable source leaves the field absent, which every reader treats as unknown.
+            const retirements = a.listModelsRetirements?.();
+            if (retirements)
+                health[a.id].modelRetirements = retirements;
         }
         catch { /* fail open: leave models as-is, doctor stays healthy */ }
     }
@@ -784,7 +789,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     const liveBenchStale = liveBenchStalenessFinding(opts.catalogNow?.() ?? new Date());
     if (liveBenchStale)
         lintRows.push(attentionRow(liveBenchStale));
-    lintRows.push(...modelLints(cfg, health, adapters, { tty: ttyVisual(), stateDir: stateDirName(cwd), overlayPreferShapes: overlayPreferShapes(cwd) }).map(attentionRow));
+    lintRows.push(...modelLints(cfg, health, adapters, { tty: ttyVisual(), stateDir: stateDirName(cwd), overlayPreferShapes: overlayPreferShapes(cwd), now: opts.now?.() }).map(attentionRow));
     const excluded = excludedChannels(cfg, adapters, health);
     if (excluded.length)
         lintRows.push(attentionRow(exclusionLine(excluded)));