tickmarkr 2.6.3 → 2.6.4

package/dist/run/journal.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
@@ -6,9 +7,10 @@ import { z } from "zod";
 import { channelKey, shq, TokenUsageSchema } from "../adapters/types.js";
 import { graphDefinitionHash, stateDirName, taskContentDigest, taskDefinitionFingerprint, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES, TIERS } from "../graph/schema.js";
-import { channelRouteIdentity } from "../route/preference.js";
+import { channelRouteIdentity, modelProvider } from "../route/preference.js";
 import { buildProfile, classify } from "../route/profile.js";
 import { DecisionEventSchema, trackJournalRows, } from "./protocol.js";
+import { PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER } from "./git.js";
 import { normalizeGateOutcome } from "./outcome.js";
 import { redactSecrets } from "./redact.js";
 export function phaseForGate(gate) {
@@ -1936,7 +1938,11 @@ export class Journal {
         const reducedData = event === "run-end"
             ? (() => {
                 const preservedRefs = [...preservedRefsByTask(priorEvents)].flatMap(([preservedTaskId, refs]) => refs.map(({ ref, diffCommand }) => ({ taskId: preservedTaskId, ref, diffCommand })));
-                return preservedRefs.length > 0 ? { ...inputData, preservedRefs } : inputData;
+                const reduced = preservedRefs.length > 0 ? { ...inputData, preservedRefs } : inputData;
+                // C1: the terminal record carries the owed-check fold as of this append, revalidated from
+                // each discharge's artifact — a reopened journal re-reduces, it never copies a prior total.
+                // Canonical (validated) rows are strict and keep their schema; the live producer is the tuple.
+                return decisionRow ? reduced : { ...reduced, owedChecks: foldOwedChecks(priorEvents, join(this.dir, "..", "..", "..")) };
             })()
             : event === "resume-restore" && rowTaskId && upheldFeedbackByTask(effectiveEvents(priorEvents)).has(rowTaskId)
                 ? {
@@ -2383,3 +2389,332 @@ export class Journal {
             .filter((row) => row && typeof row === "object" && "kind" in row && row.kind === "judge");
     }
 }
+// ── C1 (v2.6.4): owed checks ─────────────────────────────────────────────────────────────────────
+// A waiver accepts risk on ONE immutable subject. The same task-approved row that satisfies the gate
+// carries the obligation it leaves behind: run, task, gate, the exact base..head range and its
+// canonical subject, the acceptance criteria, the run-derived lifetime patch authors, the cause and
+// the evidence that would discharge it. The fold below is the only reader. It keeps every waiver as
+// accepted-risk history, subtracts a discharge only while its proof still revalidates, and answers
+// "unknown" — never zero — for a waiver without a well-formed obligation or a proof that no longer holds.
+export const OWED_CHECK_VERSION = 1;
+export const OWED_DISCHARGE_EVENT = "owed-check-discharged";
+const owedGit = (cwd, args, input) => execFileSync("git", args, {
+    cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024, ...(input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input }),
+});
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+export const owedCriteria = (acceptance) => sha256(JSON.stringify(acceptance));
+/** The daemon's canonical gate subject for base..head (daemon.ts gateCommitSubject), byte for byte. */
+export const owedSubject = (cwd, base, head) => sha256(owedGit(cwd, ["log", "--reverse", "--format=%T%x00%an%x00%ae%x00%cn%x00%ce%x00%B%x1e", `${base}..${head}`]));
+// Ownership joins on --stable ids (whitespace-blind: a re-indented carry keeps its author, which only
+// widens exclusions). Range identity uses --verbatim: re-indented content is a different program.
+const patchIdOf = (cwd, diff, mode = "--stable") => owedGit(cwd, ["patch-id", mode], diff).trim().split(/\s+/)[0] || undefined;
+/** Ordered verbatim patch ids of the commits in base..head; an empty commit authored no patch. */
+export const rangePatches = (cwd, base, head) => owedGit(cwd, ["rev-list", "--reverse", `${base}..${head}`]).trim().split("\n").filter(Boolean)
+    .map((commit) => patchIdOf(cwd, owedGit(cwd, ["show", "--format=", "--binary", commit]), "--verbatim"))
+    .filter((id) => id !== undefined);
+/** Verbatim patch identity of the whole change base..head introduces. */
+export const rangePatch = (cwd, base, head) => patchIdOf(cwd, owedGit(cwd, ["diff", "--binary", base, head]), "--verbatim") ?? "empty";
+const COMMIT_ID = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+/**
+ * `head` is the task's own recorded integration merge of the obligation's range — exactly. Its first
+ * parent is `mergeBase`; its second parent replays the waived history source tree for source tree from
+ * a base with the waived base's tree (a carry may mint new commit objects, never new content — and
+ * patch ids alone ignore where a hunk lands); its tree is git's own clean merge of the two (no
+ * resolution, no amend); and it introduced the same ordered verbatim patch series and total patch.
+ * Squashed, reordered, relocated, re-indented, reverted or conflict-resolved history fails one of
+ * these and is refused as ambiguous; containment never counts.
+ * Both verify (before discharging) and the fold (re-reading every discharge) decide through here.
+ */
+export function integrationMapped(cwd, events, o, mergeBase, head) {
+    if (typeof mergeBase !== "string" || typeof head !== "string" || !COMMIT_ID.test(mergeBase) || !COMMIT_ID.test(head))
+        return false;
+    if (!events.some((e) => e.event === "merge" && e.taskId === o.taskId && e.data.commit === head))
+        return false;
+    try {
+        const parents = owedGit(cwd, ["show", "-s", "--format=%P", head]).trim().split(" ");
+        if (parents.length !== 2 || parents[0] !== mergeBase)
+            return false;
+        const [, carried] = parents;
+        const tree = (rev) => owedGit(cwd, ["rev-parse", `${rev}^{tree}`]).trim();
+        const trees = (from, to) => owedGit(cwd, ["log", "--reverse", "--format=%T", `${from}..${to}`]).trim();
+        if (tree(owedGit(cwd, ["merge-base", mergeBase, carried]).trim()) !== tree(o.base) || trees(mergeBase, carried) !== trees(o.base, o.head))
+            return false;
+        // A conflicted merge-tree exits 1 and throws; a clean one prints its tree first.
+        if (owedGit(cwd, ["merge-tree", "--write-tree", mergeBase, carried]).trim().split("\n")[0] !== tree(head))
+            return false;
+        const series = rangePatches(cwd, mergeBase, carried);
+        return series.length === o.patches.length && series.every((id, i) => id === o.patches[i])
+            && rangePatch(cwd, mergeBase, head) === o.patch;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Lifetime patch authors of base..head, read from the run: the daemon's subjectAuthors fold
+ * (daemon.ts, not exported and not this task's to edit) restated synchronously so the waive row is
+ * written without yielding. Recreation rows name SOURCE hashes, so ownership joins by stable patch
+ * identity across changed commit objects; a gate-only restore (resume-restore's seat, a recreation
+ * after work started) never becomes an author. Unreadable history names an unknown author.
+ */
+export function owedAuthors(events, taskId, cwd, base, head) {
+    const cache = new Map();
+    const patches = (commits) => {
+        const ids = new Set();
+        for (const commit of commits) {
+            if (!cache.has(commit))
+                cache.set(commit, patchIdOf(cwd, owedGit(cwd, ["show", "--format=", "--binary", commit])));
+            const id = cache.get(commit);
+            if (id)
+                ids.add(id);
+        }
+        return ids;
+    };
+    let current;
+    let previous;
+    let awaitingCarry = false;
+    const owners = new Map();
+    const preservedOwner = new Map();
+    const attribute = (ids, attempt) => {
+        for (const id of ids) {
+            if (attempt?.incoming.has(id))
+                continue;
+            const authors = owners.get(id) ?? new Set();
+            authors.add(preservedOwner.get(id) ?? attempt?.author ?? "unknown author (missing task-dispatch assignment)");
+            owners.set(id, authors);
+        }
+    };
+    try {
+        for (const row of events) {
+            if (row.taskId !== taskId)
+                continue;
+            const preserved = [row.data.ref, row.data.preservedRef].find((v) => typeof v === "string" && v.startsWith("refs/tickmarkr/preserved/"));
+            if (preserved) {
+                const [commit, subject, trailer] = owedGit(cwd, ["show", "-s", `--format=%H%n%s%n%(trailers:key=${PRESERVE_PRODUCER_TRAILER},valueonly)`, `${preserved}^{commit}`]).trim().split("\n");
+                if (commit && subject === PRESERVE_COMMIT_SUBJECT) {
+                    const owner = typeof row.data.producer === "string" ? row.data.producer
+                        : trailer?.trim().replace(/ attempt \d+$/, "") || "unknown author (legacy unattributed preservation)";
+                    for (const id of patches([commit])) {
+                        const prior = preservedOwner.get(id);
+                        if (prior === undefined || prior === "unknown" || prior.startsWith("unknown author"))
+                            preservedOwner.set(id, owner);
+                    }
+                }
+            }
+            if (row.event === "task-dispatch") {
+                previous = current;
+                const a = row.data.assignment;
+                current = { author: typeof a?.adapter === "string" && typeof a?.model === "string"
+                        ? `${a.adapter}:${a.model}` : "unknown author (missing task-dispatch assignment)", incoming: new Set() };
+                awaitingCarry = true;
+            }
+            else if (row.event === "worktree-recreation") {
+                const carried = patches(Array.isArray(row.data.carried) ? row.data.carried : []);
+                attribute(carried, awaitingCarry ? previous : current);
+                if (awaitingCarry && current)
+                    current.incoming = carried;
+                awaitingCarry = false;
+            }
+            else if (["worker-launch", "worker-result", "gate-result", "task-human"].includes(row.event)) {
+                awaitingCarry = false;
+            }
+        }
+        const subject = patches(owedGit(cwd, ["rev-list", "--reverse", `${base}..${head}`]).trim().split("\n").filter(Boolean));
+        attribute(subject, current);
+        return [...new Set([...subject].flatMap((id) => [...(owners.get(id) ?? [])]))].sort();
+    }
+    catch (error) {
+        return [`unknown author (${String(error).split("\n")[0]})`];
+    }
+}
+/**
+ * The obligation a waive of `gate` leaves on the task branch's current range. Synchronous on purpose:
+ * approve writes it into the waive row under the approval serialization without yielding, so a live
+ * daemon's boundary sees the same single append it always did. Anything not bound exactly — the
+ * waived row measured another subject, unreadable refs, unresolved authors, unreadable criteria — is
+ * recorded, never guessed, as known: false.
+ */
+export function captureOwedCheck(input) {
+    const { cwd, runId, taskId, gate, events } = input;
+    let base = "unknown", head = "unknown", subject = "unknown", patch = "unknown";
+    let patches = [];
+    let authors = [];
+    let unknownReason;
+    try {
+        head = owedGit(cwd, ["rev-parse", "--verify", `${input.taskRef}^{commit}`]).trim();
+        base = owedGit(cwd, ["merge-base", input.integrationRef, head]).trim();
+        subject = owedSubject(cwd, base, head);
+        const measured = [...events].reverse().find((e) => e.taskId === taskId && e.event === "gate-result" && e.data.gate === gate);
+        if (measured?.data.commit !== subject) {
+            throw new Error(`the waived ${gate} row measured ${String(measured?.data.commit ?? "no subject")}, not ${input.taskRef}'s range`);
+        }
+        patches = rangePatches(cwd, base, head);
+        patch = rangePatch(cwd, base, head);
+        authors = owedAuthors(events, taskId, cwd, base, head);
+        if (!authors.length || authors.some((a) => a.startsWith("unknown")))
+            throw new Error(`unresolved patch authors: ${authors.join(", ") || "none"}`);
+    }
+    catch (error) {
+        unknownReason = (error instanceof Error ? error.message : String(error)).split("\n")[0];
+    }
+    if (!Array.isArray(input.acceptance))
+        unknownReason ??= "task acceptance criteria unreadable";
+    const files = Array.isArray(input.files) && input.files.every((f) => typeof f === "string") ? input.files : undefined;
+    if (!files)
+        unknownReason ??= "task file scope unreadable";
+    if (!input.declared?.length)
+        unknownReason ??= "declared channels unreadable";
+    const criteria = Array.isArray(input.acceptance) ? owedCriteria(input.acceptance) : "unknown";
+    return {
+        version: OWED_CHECK_VERSION,
+        id: sha256(JSON.stringify([runId, taskId, gate, base, head, subject, criteria])).slice(0, 16),
+        runId, taskId, gate, base, head, subject, patch, patches, criteria, files: files ?? [], authors,
+        declared: [...(input.declared ?? [])].map(({ key, vendor }) => ({ key, vendor })), cause: input.cause,
+        evidence: `tickmarkr verify --base ${base} --task ${taskId} --record ${runId}: ${gate} passing on ${base}..${head} or on its recorded integration merge, reviewed outside the authors' vendors`,
+        disposition: "accepted-risk",
+        known: unknownReason === undefined,
+        ...(unknownReason === undefined ? {} : { unknownReason }),
+    };
+}
+/** A bound fact: a non-empty string that capture did not record as unknown. */
+const isBound = (v) => typeof v === "string" && v !== "" && !v.startsWith("unknown");
+/** Every required field present and well-typed; anything else is malformed evidence, never a known check. */
+const isOwedCheck = (value, taskId, gate) => {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const o = value;
+    return o.version === OWED_CHECK_VERSION && o.known === true && o.disposition === "accepted-risk"
+        && o.taskId === taskId && o.gate === gate && GATE_NAMES.includes(o.gate)
+        && [o.id, o.runId, o.taskId, o.base, o.head, o.subject, o.patch, o.criteria].every(isBound)
+        && typeof o.cause === "string" && typeof o.evidence === "string"
+        && Array.isArray(o.patches) && o.patches.every(isBound)
+        && Array.isArray(o.authors) && o.authors.length > 0 && o.authors.every(isBound)
+        && Array.isArray(o.files) && o.files.every((f) => typeof f === "string")
+        && Array.isArray(o.declared) && o.declared.length > 0 && o.declared.every(isChannelFact);
+};
+const providerOf = (fact) => modelProvider(fact.key.slice(fact.key.indexOf(":") + 1), fact.vendor);
+/** A resolved channel: an `adapter:model` key and a bound vendor — never an empty or placeholder claim. */
+const isChannelFact = (f) => typeof f === "object" && f !== null
+    && typeof f.key === "string" && /^[^:\s]+:\S+$/.test(f.key) && isBound(f.vendor);
+/**
+ * The trusted channel identities, key → vendors: what this repository's adapters declared under its config
+ * when the waive was written, recorded on the obligation by approve. Declaration, not doctor health — a
+ * later logout does not revoke a proof, but a seat not declared (or declared under another vendor) never
+ * resolved. Read from the row, the fold resolves identically in every process and every checkout.
+ */
+const declaredVendors = (o) => {
+    const vendors = new Map();
+    for (const c of o.declared)
+        vendors.set(c.key, (vendors.get(c.key) ?? new Set()).add(c.vendor));
+    return vendors;
+};
+/** Why a discharge row no longer proves its obligation, re-read from its artifact; undefined when it does. */
+function dischargeProblem(row, o, events, cwd) {
+    const d = row.data;
+    if (row.taskId !== o.taskId)
+        return "discharge names another task";
+    if (d.criteria !== o.criteria)
+        return "discharge proved other criteria";
+    const exact = d.mapping === "exact" && d.mergeBase === o.base && d.head === o.head;
+    // The integration mapping is re-proved from git on every fold, never taken from the row's claims.
+    const integration = d.mapping === "integration" && integrationMapped(cwd, events, o, d.mergeBase, d.head);
+    if (!exact && !integration)
+        return "discharge range does not bind the obligation";
+    let artifact;
+    try {
+        const bytes = readFileSync(String(d.artifactPath));
+        if (createHash("sha256").update(bytes).digest("hex") !== d.artifactSha256)
+            return "artifact hash mismatch";
+        artifact = JSON.parse(bytes.toString("utf8")) ?? {};
+    }
+    catch {
+        return "artifact unavailable";
+    }
+    if (artifact.head !== d.head || artifact.mergeBase !== d.mergeBase)
+        return "artifact measured another range";
+    if (artifact.green !== true)
+        return "artifact verdict is not green";
+    // The criteria the hash-bound evidence itself measured: the row's claim alone only repeats the obligation.
+    if (artifact.criteria !== o.criteria)
+        return "artifact measured other criteria";
+    // The scope the waived task declared, exactly: a wider allowlist (--files '*') is weakened evidence.
+    if (JSON.stringify(artifact.files) !== JSON.stringify(o.files))
+        return "artifact gated another file scope";
+    const rows = (Array.isArray(artifact.gateRows) ? artifact.gateRows : []);
+    const gateRow = rows.find((r) => r?.gate === o.gate && r.pass === true && r.meta?.skipped !== true);
+    if (!gateRow)
+        return `artifact holds no passing ${o.gate} row`;
+    if (o.gate === "review") {
+        const reviewer = d.reviewer;
+        const authors = Array.isArray(d.authorChannels) ? d.authorChannels : [];
+        // The row's reviewer must be the seat the hash-bound review row recorded — key, vendor and provider.
+        if (!isChannelFact(reviewer) || gateRow.meta?.reviewer !== reviewer.key || gateRow.meta.vendor !== reviewer.vendor
+            || gateRow.meta.provider !== providerOf(reviewer))
+            return "unresolved reviewer";
+        // ...and a channel the waive recorded as declared under exactly that vendor: agreement between the row
+        // and the artifact only repeats a claim, so identity and vendor resolve against the obligation's own.
+        const declared = declaredVendors(o);
+        const resolves = (f) => { const v = declared.get(f.key); return v?.size === 1 && v.has(f.vendor); };
+        // An author key stays excluded whatever vendor any row claims for it.
+        if (o.authors.includes(reviewer.key))
+            return "same-vendor reviewer (the reviewer is a recorded patch author)";
+        if (!resolves(reviewer))
+            return "unresolved reviewer (no declared channel with that identity and vendor)";
+        if (!authors.every(isChannelFact) || !o.authors.every((key) => authors.some((a) => a.key === key)))
+            return "unresolved author channel";
+        if (authors.some((a) => authors.some((b) => a.key === b.key && a.vendor !== b.vendor)))
+            return "unresolved author channel (inconsistent vendor claims)";
+        if (!authors.every(resolves))
+            return "unresolved author channel (no declared channel with that identity and vendor)";
+        if (authors.some((a) => a.vendor === reviewer.vendor || providerOf(a) === providerOf(reviewer)))
+            return "same-vendor reviewer";
+    }
+    return undefined;
+}
+/**
+ * The CURRENT owed-check fold: accepted-risk history, outstanding debt, and whether it is known.
+ * `cwd` is any checkout of the run's repository (integration discharges are re-proved from git).
+ * It never throws: a fold that cannot be computed is unknown debt, not a crash and never zero.
+ */
+export function foldOwedChecks(events, cwd) {
+    try {
+        return foldOwedChecksOrThrow(events, cwd);
+    }
+    catch (error) {
+        return { known: false, debt: "unknown", outstanding: [], acceptedRisk: [], discharged: [], unknown: [{ reason: `owed-check fold failed: ${String(error).split("\n")[0]}` }] };
+    }
+}
+function foldOwedChecksOrThrow(events, cwd) {
+    const accepted = new Map();
+    const discharged = new Set();
+    const unknown = [];
+    for (const e of effectiveEvents(events)) {
+        if (e.event === "task-approved" && e.data.release === GATE_SATISFIED_RELEASE) {
+            const o = e.data.obligation;
+            if (isOwedCheck(o, e.taskId, e.data.gate))
+                accepted.set(o.id, o);
+            else {
+                const recorded = typeof o === "object" && o !== null ? o.unknownReason : undefined;
+                unknown.push({ taskId: e.taskId, gate: String(e.data.gate), reason: o === undefined ? "legacy waiver without an owed-check obligation"
+                        : typeof recorded === "string" ? recorded : "malformed owed-check obligation" });
+            }
+        }
+        else if (e.event === OWED_DISCHARGE_EVENT) {
+            const ids = Array.isArray(e.data.ids) ? e.data.ids : [];
+            const problems = ids.map((id) => {
+                const o = accepted.get(String(id));
+                return o ? dischargeProblem(e, o, events, cwd) : "discharge names no recorded obligation";
+            });
+            const problem = ids.length ? problems.find((p) => p !== undefined) : "discharge names no obligation";
+            if (problem)
+                unknown.push({ taskId: e.taskId, reason: problem });
+            else
+                for (const id of ids)
+                    discharged.add(String(id));
+        }
+    }
+    const acceptedRisk = [...accepted.values()];
+    const outstanding = acceptedRisk.filter((o) => !discharged.has(o.id));
+    const known = unknown.length === 0;
+    return { known, debt: known ? outstanding.length : "unknown", outstanding, acceptedRisk, discharged: [...discharged], unknown };
+}

package/dist/tui/cockpit/live-store.d.ts

@@ -1,6 +1,8 @@
 import { type JournalEvent } from "../../run/journal.js";
 import { type OperatorRecord } from "../../run/operator-state.js";
 export declare const OBSERVATION_INTERVAL_MS = 1000;
+/** Stat-to-fstat observations one poll spends on a journal a writer keeps appending to. */
+export declare const APPEND_RACE_OBSERVATIONS = 3;
 export declare const STORE_LIMITS: {
     readonly graphBytes: number;
     readonly history: 256;
@@ -61,12 +63,16 @@ export declare class JournalTail {
     private bytesRead;
     private lastSuccessfulReadAt?;
     private failure?;
+    private stale;
     constructor(source: string, hooks?: {
         record?: (record: OperatorRecord) => void;
         reset?: () => void;
     });
     private reset;
+    /** A same-inode append between stat and fstat is retried; exhaustion keeps the last good snapshot, pending. */
     poll(now?: number): TailSnapshot;
+    /** One stat-to-fstat observation. False when an append raced it; nothing was consumed or reset. */
+    private observe;
     private appendCarry;
     snapshot(): TailSnapshot;
     /** Demand paging scans with fixed buffers, independent of the retained history; no growing line index. */

package/dist/tui/cockpit/live-store.js

@@ -7,6 +7,8 @@ import { isPidLive, STALE_MS } from "../../run/lock.js";
 import { readTierLiveness, SUPERVISION_TIERS } from "../../run/supervision.js";
 import { OperatorStateFold } from "../../run/operator-state.js";
 export const OBSERVATION_INTERVAL_MS = 1_000;
+/** Stat-to-fstat observations one poll spends on a journal a writer keeps appending to. */
+export const APPEND_RACE_OBSERVATIONS = 3;
 // Graph declarations have a separate 16 MiB bound; journal retention remains unchanged.
 export const STORE_LIMITS = { graphBytes: 16 * 1024 * 1024, history: 256, historyBytes: 2 * 1024 * 1024, recordBytes: 1024 * 1024, readBytes: 1024 * 1024, subscribers: 64, metrics: 12, errors: 32 };
 const errorText = (e) => e instanceof Error ? e.message : String(e);
@@ -48,6 +50,7 @@ export class JournalTail {
     bytesRead = 0;
     lastSuccessfulReadAt;
     failure;
+    stale = false;
     constructor(source, hooks = {}) {
         this.source = source;
         this.hooks = hooks;
@@ -65,18 +68,45 @@ export class JournalTail {
         this.generation++;
         this.hooks.reset?.();
     }
+    /** A same-inode append between stat and fstat is retried; exhaustion keeps the last good snapshot, pending. */
     poll(now = Date.now()) {
+        try {
+            for (let observation = 1; !this.observe(); observation++) {
+                if (observation === APPEND_RACE_OBSERVATIONS) {
+                    this.stale = true;
+                    this.failure = undefined;
+                    return this.snapshot();
+                }
+            }
+            this.stale = false;
+            this.failure = undefined;
+            this.lastSuccessfulReadAt = now;
+        }
+        catch (e) {
+            this.failure = { source: this.source, error: errorText(e) };
+        }
+        return this.snapshot();
+    }
+    /** One stat-to-fstat observation. False when an append raced it; nothing was consumed or reset. */
+    observe() {
         let fd;
         try {
             const st = statSync(this.source, { bigint: true });
             if (!st.isFile())
                 throw new Error("journal source is not a regular file");
-            if (!this.st || fileIdentity(st) !== fileIdentity(this.st) || st.size < this.st.size || (st.size === this.st.size && stamp(st) !== stamp(this.st)))
-                this.reset();
-            if (Number(st.size) > this.offset) {
+            const replaced = !this.st || fileIdentity(st) !== fileIdentity(this.st) || st.size < this.st.size || (st.size === this.st.size && stamp(st) !== stamp(this.st));
+            if (Number(st.size) > (replaced ? 0 : this.offset)) {
                 fd = openSync(this.source, "r");
-                if (stamp(fstatSync(fd, { bigint: true })) !== stamp(st))
+                const opened = fstatSync(fd, { bigint: true });
+                if (stamp(opened) !== stamp(st)) {
+                    if (fileIdentity(opened) === fileIdentity(st) && opened.size > st.size)
+                        return false;
                     throw new Error("journal changed before read; retry observation");
+                }
+            }
+            if (replaced)
+                this.reset();
+            if (fd !== undefined) {
                 let remaining = STORE_LIMITS.readBytes;
                 const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, Number(st.size) - this.offset));
                 while (this.offset < Number(st.size) && remaining > 0) {
@@ -113,17 +143,12 @@ export class JournalTail {
                 }
             }
             this.st = st;
-            this.failure = undefined;
-            this.lastSuccessfulReadAt = now;
-        }
-        catch (e) {
-            this.failure = { source: this.source, error: errorText(e) };
+            return true;
         }
         finally {
             if (fd !== undefined)
                 closeSync(fd);
         }
-        return this.snapshot();
     }
     appendCarry(bytes) {
         this.carryBytes += bytes.length;
@@ -137,7 +162,7 @@ export class JournalTail {
             history: this.history.slice(), errors: this.errors.slice(), malformedCount: this.malformedCount,
             pending: this.carryBytes ? { line: this.line + 1, bytes: this.carryBytes } : undefined,
             backlogBytes: Math.max(0, Number(this.st?.size ?? 0) - this.offset),
-            status: this.failure ? "unreadable" : this.malformedCount ? "corrupt" : this.carryBytes ? "pending" : "readable",
+            status: this.failure ? "unreadable" : this.malformedCount ? "corrupt" : this.carryBytes || this.stale ? "pending" : "readable",
             error: this.failure, lastSuccessfulReadAt: this.lastSuccessfulReadAt, bytesRead: this.bytesRead,
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.6.3",
+  "version": "2.6.4",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -92,7 +92,7 @@ After sending, **confirm delivery** by reading the target pane and verifying the
 1. **Prepare** — confirm the target list. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
-4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every green clause for you. Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
-5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
+4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every execution clause for you; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
+5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout; redirect explicitly beside the spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.

package/skills/tickmarkr-loop/SKILL.md

@@ -88,8 +88,8 @@ When spawning consultants (agents gathering synthesis input for decisions like S
 1. **Prepare** — start from the requested spec. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec>`. Correct compilation errors in the spec, never in the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review the routing table, capability-floor warnings, and every human gate, including work that each gate blocks.
-4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every green clause for you. Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions.
-5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
+4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every execution clause for you; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions.
+5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout. Redirect it explicitly beside the source spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records. Then [stand down](#stand-down-mission-end-and-retirement).
 
 ## Cockpit, parked decisions and printed twins
@@ -122,8 +122,14 @@ own bound failure token: status prints `failed — T3 — failure <line>@<ts>`,
 `tickmarkr approve <runId> T3 --recheck --park <line>@<ts>` re-gates its landed commits. Preserve resume refusals and repair the named source/config issue
 (including deny/prefer conflicts); never edit the compiled graph to force a result. Resume
 makes CURRENT TIP PENDING; historical GATES RAN does not prove completion. The completed
-case has 3/3 recorded merges, a latest run-end, a nonfailed known tip result and empty
-`failed`, `human`, `blocked`, `pending` buckets. A mismatched graph is “not comparable.”
+case has 3/3 recorded merges, a latest run-end, a nonfailed known tip result, empty
+`failed`, `human`, `blocked`, `pending` buckets, and CURRENT status reading `outstanding 0`
+— owed checks outstanding empty AND known. Replay D-660 before calling it green: the same
+3/3 with every bucket empty, after T2's review was waived, reads `outstanding 1 (T2 review)`;
+`resume` exits 0 and its final line says `execution complete; outstanding 1 (T2 review)`, not
+`verified`. It is green only once `tickmarkr verify --record <runId>` discharges that check and
+CURRENT status reads `outstanding 0` — even after run-end, whose record still carries 1.
+`outstanding unknown` (a legacy waiver) is never green. A mismatched graph is “not comparable.”
 
 Run offers only validated park verbs: human/attempt-cap/other non-gate parks allow approve;
 infra allows approve or `--recheck`; review gate-fail allows `--waive`, `--uphold` or