tickmarkr 2.6.2 → 2.6.4

package/dist/tui/cockpit/live-store.js

@@ -7,6 +7,8 @@ import { isPidLive, STALE_MS } from "../../run/lock.js";
 import { readTierLiveness, SUPERVISION_TIERS } from "../../run/supervision.js";
 import { OperatorStateFold } from "../../run/operator-state.js";
 export const OBSERVATION_INTERVAL_MS = 1_000;
+/** Stat-to-fstat observations one poll spends on a journal a writer keeps appending to. */
+export const APPEND_RACE_OBSERVATIONS = 3;
 // Graph declarations have a separate 16 MiB bound; journal retention remains unchanged.
 export const STORE_LIMITS = { graphBytes: 16 * 1024 * 1024, history: 256, historyBytes: 2 * 1024 * 1024, recordBytes: 1024 * 1024, readBytes: 1024 * 1024, subscribers: 64, metrics: 12, errors: 32 };
 const errorText = (e) => e instanceof Error ? e.message : String(e);
@@ -48,6 +50,7 @@ export class JournalTail {
     bytesRead = 0;
     lastSuccessfulReadAt;
     failure;
+    stale = false;
     constructor(source, hooks = {}) {
         this.source = source;
         this.hooks = hooks;
@@ -65,18 +68,45 @@ export class JournalTail {
         this.generation++;
         this.hooks.reset?.();
     }
+    /** A same-inode append between stat and fstat is retried; exhaustion keeps the last good snapshot, pending. */
     poll(now = Date.now()) {
+        try {
+            for (let observation = 1; !this.observe(); observation++) {
+                if (observation === APPEND_RACE_OBSERVATIONS) {
+                    this.stale = true;
+                    this.failure = undefined;
+                    return this.snapshot();
+                }
+            }
+            this.stale = false;
+            this.failure = undefined;
+            this.lastSuccessfulReadAt = now;
+        }
+        catch (e) {
+            this.failure = { source: this.source, error: errorText(e) };
+        }
+        return this.snapshot();
+    }
+    /** One stat-to-fstat observation. False when an append raced it; nothing was consumed or reset. */
+    observe() {
         let fd;
         try {
             const st = statSync(this.source, { bigint: true });
             if (!st.isFile())
                 throw new Error("journal source is not a regular file");
-            if (!this.st || fileIdentity(st) !== fileIdentity(this.st) || st.size < this.st.size || (st.size === this.st.size && stamp(st) !== stamp(this.st)))
-                this.reset();
-            if (Number(st.size) > this.offset) {
+            const replaced = !this.st || fileIdentity(st) !== fileIdentity(this.st) || st.size < this.st.size || (st.size === this.st.size && stamp(st) !== stamp(this.st));
+            if (Number(st.size) > (replaced ? 0 : this.offset)) {
                 fd = openSync(this.source, "r");
-                if (stamp(fstatSync(fd, { bigint: true })) !== stamp(st))
+                const opened = fstatSync(fd, { bigint: true });
+                if (stamp(opened) !== stamp(st)) {
+                    if (fileIdentity(opened) === fileIdentity(st) && opened.size > st.size)
+                        return false;
                     throw new Error("journal changed before read; retry observation");
+                }
+            }
+            if (replaced)
+                this.reset();
+            if (fd !== undefined) {
                 let remaining = STORE_LIMITS.readBytes;
                 const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, Number(st.size) - this.offset));
                 while (this.offset < Number(st.size) && remaining > 0) {
@@ -113,17 +143,12 @@ export class JournalTail {
                 }
             }
             this.st = st;
-            this.failure = undefined;
-            this.lastSuccessfulReadAt = now;
-        }
-        catch (e) {
-            this.failure = { source: this.source, error: errorText(e) };
+            return true;
         }
         finally {
             if (fd !== undefined)
                 closeSync(fd);
         }
-        return this.snapshot();
     }
     appendCarry(bytes) {
         this.carryBytes += bytes.length;
@@ -137,7 +162,7 @@ export class JournalTail {
             history: this.history.slice(), errors: this.errors.slice(), malformedCount: this.malformedCount,
             pending: this.carryBytes ? { line: this.line + 1, bytes: this.carryBytes } : undefined,
             backlogBytes: Math.max(0, Number(this.st?.size ?? 0) - this.offset),
-            status: this.failure ? "unreadable" : this.malformedCount ? "corrupt" : this.carryBytes ? "pending" : "readable",
+            status: this.failure ? "unreadable" : this.malformedCount ? "corrupt" : this.carryBytes || this.stale ? "pending" : "readable",
             error: this.failure, lastSuccessfulReadAt: this.lastSuccessfulReadAt, bytesRead: this.bytesRead,
         };
     }

package/dist/tui/cockpit/run-cockpit.js

@@ -334,7 +334,7 @@ export function taskProjectionText(row, journal = []) {
         `blocker ${blocker ? `${blocker.kind} ${at(evidence.blocker)}` : "none"}`,
         `next ${blocker?.nextAction == null ? fieldReading(undefined) : `${blocker.nextAction} ${at(evidence.nextAction)}`}`,
         ...(harvest?.suspectedStalledHarvest ? [`${STALL_MARKER} · launch ${at(evidence.launch)} · ${harvest.nudgeFailures} nudge failed ${at(evidence.nudge)} · ${harvest.pageCount} paged ${at(evidence.page)} · no worker-result`] : []),
-    ].reduce((text, part) => `${text} · ${part}`);
+    ].join(" · ");
 }
 /**
  * Identity, phase, and build are unrecorded until a dispatch. Append the blocker and next action
@@ -354,7 +354,7 @@ function undispatchedProjectionText(row, journal) {
         MISSING_EVIDENCE,
         ...(showBlocker ? [`blocker ${blocker.kind} ${at(evidence.blocker)}`] : []),
         ...(showNext ? [`next ${blocker.nextAction} ${at(evidence.nextAction)}`] : []),
-    ].reduce((text, part) => `${text} · ${part}`);
+    ].join(" · ");
 }
 /**
  * Correlate each already-derived field with the row that can have produced that value. This is

package/dist/tui/cockpit/run-view.d.ts

@@ -93,8 +93,9 @@ export interface TaskProjection {
     readonly build: ProjectionField;
     readonly blocker: ProjectionField;
     readonly nextAction: ProjectionField;
-    /** OBS-1048: present only when the newest launched attempt has failed nudges, pages and no worker-result. OBS-1104: neverDispatched collapses that task's line. */
+    /** OBS-1048: present only when the newest launched attempt has failed nudges, pages and no worker-result. */
     readonly stalled?: ProjectionField;
+    /** OBS-1104: a task with no recorded dispatch collapses its line to one missing-evidence clause. */
     readonly neverDispatched?: true;
 }
 export declare const STALL_MARKER = "\u26A0 stalled harvest suspected";

package/dist/tui/cockpit/run-view.js

@@ -251,8 +251,11 @@ export function projectRunTasks(snapshot, rows, graph, decisions, runId) {
         const blocker = { label: `blocker ${blk ? `${blk.kind}${blk.diagnostic ? ` · ${blk.diagnostic}` : ""}` : "none"}`, ...(blk && blockerRow ? { line: blockerRow.line } : {}) };
         const nextAction = { label: `next ${blk?.nextAction ?? "none"}`, ...(blk?.nextAction && blockerRow ? { line: blockerRow.line } : {}) };
         // OBS-1048 harvest, chronological: the newest worker-launch opens the attempt; a later worker-result retires it.
-        let launched, launchedAttempt, returned = false;
-        const nudges = [], pages = [];
+        let launched;
+        let launchedAttempt;
+        let returned = false;
+        const nudges = [];
+        const pages = [];
         // Finding 1: only rows of the launched attempt count; a row without an attempt belongs to it (derive.ts attemptHarvests).
         const ofLaunched = (d) => launched !== undefined && (ordinal(d.attempt) ?? launchedAttempt) === launchedAttempt;
         for (const r of own) {
@@ -389,15 +392,16 @@ function undispatchedProjectionLine(p) {
     ].join(" · ");
 }
 /**
- * Rows the projection panel paints. A never-dispatched clause is shorter than the field line it
- * replaces; the shell's content counter is the panel's wrapped height, and the pinned run frames
- * record that counter. Blank rows keep the block as tall as the field lines were.
+ * Rows the projection panel paints: each task's clause at its own wrapped height (OBS-1193). A
+ * never-dispatched clause is shorter than the field line it replaces, so the block is shorter too;
+ * the shell's content counter reads that real height and the pinned run frames record it.
  */
 function projectionBlockRows(projections, wrap) {
-    const shown = projections.flatMap((p) => wrap(projectionLine(p)).map((line, i) => ({ key: `${p.taskId}:${i}`, line, strong: p.stalled !== undefined && i === 0 })));
-    const prior = projections.flatMap((p) => wrap(recordedProjectionLine(p)));
-    const pad = Math.max(0, prior.length - shown.length);
-    return [...shown, ...Array.from({ length: pad }, (_, i) => ({ key: `projection-pad:${i}`, line: " ", strong: false }))];
+    return projections.flatMap((p) => wrap(projectionLine(p)).map((line, i) => ({
+        key: `${p.taskId}:${i}`,
+        line,
+        strong: p.stalled !== undefined && i === 0,
+    })));
 }
 /** The Run body: the approved board (BD-1) over the fold, then the selected task's detail panels. */
 export function RunView({ snapshot, rows, page, graph, decisions, session, columns, run, now = Date.now }) {

package/dist/tui/cockpit/setup-cockpit.d.ts

@@ -73,6 +73,8 @@ export type ParkedDecision = {
     readonly tombstone: boolean;
     /** OBS-1178: the park's `<line>@<ts>` token — the confirmed write binds to it via `--park`. */
     readonly park?: string;
+    /** OBS-1202: a stall park's recorded reap failure — the one stall park recheck may release. */
+    readonly reapFailure?: string;
 };
 /** The parks a verb can release — the rows the surface draws live verbs on. */
 export declare function actionableDecisions(decisions: readonly ParkedDecision[]): readonly ParkedDecision[];

package/dist/tui/cockpit/setup-cockpit.js

@@ -607,6 +607,7 @@ export function deriveParkedDecisions(journal) {
             failedGate,
             tombstone: isTombstonePark(kind, reason),
             ...(typeof parked?.ts === "string" ? { park: bindingToken({ line: lines[parkedIndex], ts: parked.ts }) } : {}),
+            ...(kind === "stall" && typeof parked?.data.reapFailure === "string" ? { reapFailure: parked.data.reapFailure } : {}),
         });
     }
     return decisions;
@@ -623,6 +624,9 @@ export function initialSetupDecisionsSession() {
 export function setupDecisionVerbs(decision) {
     if (decision.tombstone)
         return [];
+    // OBS-1202: the production table's census-recovery row; an ordinary stall stays approve-only.
+    if (decision.kind === "stall" && decision.reapFailure !== undefined)
+        return ["approve", "recheck"];
     if (decision.kind !== "gate-fail")
         return ["approve"];
     if (decision.failedGate === undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.6.2",
+  "version": "2.6.4",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -81,6 +81,7 @@
         "scripts/emit-schema.ts",
         "scripts/probe-rig.mjs",
         "scripts/run-ci-vitest.sh",
+        "scripts/vitest-lease.ts",
         "specs/export-selftest.spec.md"
       ],
       "prefixes": [

package/schema/config.schema.json

@@ -10,7 +10,6 @@
           "type": "boolean"
         },
         "repairSelection": {
-          "default": false,
           "type": "boolean"
         },
         "taskExecutionLimitMs": {
@@ -619,6 +618,14 @@
           "exclusiveMinimum": 0,
           "maximum": 9007199254740991
         },
+        "evidenceQuotaBytes": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 9007199254740991
+        },
+        "repairSelection": {
+          "type": "boolean"
+        },
         "byShape": {
           "type": "object",
           "propertyNames": {

package/skills/tickmarkr-auto/SKILL.md

@@ -92,7 +92,7 @@ After sending, **confirm delivery** by reading the target pane and verifying the
 1. **Prepare** — confirm the target list. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
-4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every green clause for you. Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
-5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
+4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every execution clause for you; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
+5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout; redirect explicitly beside the spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.

package/skills/tickmarkr-loop/SKILL.md

@@ -88,8 +88,8 @@ When spawning consultants (agents gathering synthesis input for decisions like S
 1. **Prepare** — start from the requested spec. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec>`. Correct compilation errors in the spec, never in the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review the routing table, capability-floor warnings, and every human gate, including work that each gate blocks.
-4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every green clause for you. Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions.
-5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
+4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every execution clause for you; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions.
+5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout. Redirect it explicitly beside the source spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records. Then [stand down](#stand-down-mission-end-and-retirement).
 
 ## Cockpit, parked decisions and printed twins
@@ -122,14 +122,26 @@ own bound failure token: status prints `failed — T3 — failure <line>@<ts>`,
 `tickmarkr approve <runId> T3 --recheck --park <line>@<ts>` re-gates its landed commits. Preserve resume refusals and repair the named source/config issue
 (including deny/prefer conflicts); never edit the compiled graph to force a result. Resume
 makes CURRENT TIP PENDING; historical GATES RAN does not prove completion. The completed
-case has 3/3 recorded merges, a latest run-end, a nonfailed known tip result and empty
-`failed`, `human`, `blocked`, `pending` buckets. A mismatched graph is “not comparable.”
+case has 3/3 recorded merges, a latest run-end, a nonfailed known tip result, empty
+`failed`, `human`, `blocked`, `pending` buckets, and CURRENT status reading `outstanding 0`
+— owed checks outstanding empty AND known. Replay D-660 before calling it green: the same
+3/3 with every bucket empty, after T2's review was waived, reads `outstanding 1 (T2 review)`;
+`resume` exits 0 and its final line says `execution complete; outstanding 1 (T2 review)`, not
+`verified`. It is green only once `tickmarkr verify --record <runId>` discharges that check and
+CURRENT status reads `outstanding 0` — even after run-end, whose record still carries 1.
+`outstanding unknown` (a legacy waiver) is never green. A mismatched graph is “not comparable.”
 
 Run offers only validated park verbs: human/attempt-cap/other non-gate parks allow approve;
 infra allows approve or `--recheck`; review gate-fail allows `--waive`, `--uphold` or
 `--recheck`; other gate-fail allows waive/recheck. Waive satisfies only the identified
 failed gate, uphold funds a fixed attempt carrying review findings, and recheck reruns the
-declared battery without satisfying a gate. Attempt-cap approval resets the budget while
+declared battery without satisfying a gate. A stall park that recorded a `reapFailure`
+(unreadable or surviving worker census) allows approve or `--recheck --park <line>@<ts>`:
+recheck re-verifies that attempt's owned census and gates its harvested commits with no
+worker only with an explicitly recorded empty survivors array (`[]`) — a missing,
+unreadable or surviving census
+re-parks the stall under a new token — while plain approve dispatches a worker. An
+ordinary stall park (no `reapFailure`) stays approve-only; `--recheck` refuses it. Attempt-cap approval resets the budget while
 retaining routing exclusions. Tombstones and failures without identified gate evidence
 are diagnostic-only. Decisions cannot be undone; stale or duplicate decisions refuse.
 

package/skills/tickmarkr-overseer/scripts/classify-vitest-log.sh

@@ -44,7 +44,10 @@ awk -v esc="$esc" '
     gsub(/\^\[\[[0-9;]*m/, "", line); gsub(esc "\\[[0-9;]*m", "", line)
     sub(/^[^\t]*\t[^\t]*\t[0-9T:.-]+Z[ ]?/, "", line)
   }
-  line ~ /Test timed out|Error: Hook timed out/ { timedout++ }
+  # The Vitest timeout message carries its millisecond count; a test that PRINTS a fingerprint normalized
+  # to #ms (the daemon OBS-1106 notifications) is output, not a timed-out test. A real timeout also fails
+  # its test, so the summary failed count still reds it.
+  line ~ /(Test|Hook) timed out in [0-9]+ ?ms/ { timedout++ }
   line ~ /ERROR: Coverage for .* does not meet .*threshold/ { coverage++ }
   line ~ /^npm (error|ERR!) signal / { signals++ }
   line ~ /^(⎯)+ Unhandled Errors (⎯)+[ \t]*$/ { if (armed) close_block(); opening = 1; next }