tickmarkr 2.6.3 → 2.6.5

package/README.md

@@ -183,8 +183,16 @@ can enact the release at its next task boundary; a different live run must end b
 one resumes. Keep any resume refusal and its remediation visible, including a deny/prefer
 config conflict; repair the source/config as directed, never edit the compiled graph to
 force success. After resume, CURRENT TIP is PENDING until fresh evidence arrives. Completion
-requires the latest run-end, a nonfailed known tip result, and empty `failed`, `human`,
-`blocked` and `pending` buckets; the completed case has 3/3 recorded merges. An unrelated
+requires the latest run-end, a nonfailed known tip result, empty `failed`, `human`,
+`blocked` and `pending` buckets, and owed checks outstanding empty AND known in CURRENT
+`tickmarkr status <runId>` (`outstanding 0`); the completed case has 3/3 recorded merges.
+Empty buckets alone are not completion (D-660): 3/3 merged with every bucket empty and the
+tip passed, after the operator waived T2's review, leaves one accepted-risk review check owed.
+`run`/`resume` exit 0 on execution alone, their final line says
+`execution complete; outstanding 1 (T2 review)` rather than `verified`, and status reads
+`outstanding 1`. That run completes only when `tickmarkr verify --record <runId>` discharges
+the check and CURRENT status reads `outstanding 0` — a discharge after run-end counts, while the
+run-end record keeps its old count; `outstanding unknown` never completes. An unrelated
 graph says “not comparable” and supplies no borrowed denominator. Historical GATES RAN
 does not establish current completion.
 

package/dist/adapters/catalog-remote.d.ts

@@ -18,6 +18,8 @@ export interface CatalogReadResult {
     source: "cache" | "vendored";
     stale: boolean;
     warning?: string;
+    /** v2.6.5 T9: `adapter:model` keys a failed post-discovery refresh left at UNKNOWN coverage, never "uncovered". */
+    coverageUnknown?: readonly string[];
 }
 export interface CatalogModelEvidence {
     modelId: string;
@@ -62,6 +64,27 @@ export interface RefreshCatalogResult {
     warning?: string;
     legs: CatalogLegResult[];
 }
+/**
+ * v2.6.5 T9 (H): records persisted from cited sources, never inferred from a model name or an API
+ * price. Prices are normal API USD per million tokens — a subscription seat is never billed from them.
+ * The tier is CONTINUITY of the shipped alias seeds (config.ts DEFAULT_CONFIG: sonnet=mid,
+ * opus=frontier), not a benchmark ruling: doctor prints it as an inference for operator confirmation
+ * and the configured (Fleet-confirmed) tier stays the routing authority.
+ */
+export interface SourcedIdentityRecord {
+    identity: string;
+    alias: "sonnet" | "opus";
+    inputCostPerMtok: number;
+    outputCostPerMtok: number;
+    contextWindow: number;
+    outputWindow: number;
+    tier: "mid" | "frontier";
+    tierBasis: string;
+    sources: readonly string[];
+    fetchedAt: string;
+}
+export declare const SOURCED_IDENTITY_RECORDS: readonly SourcedIdentityRecord[];
+export declare const sourcedIdentityRecord: (identity: string | undefined) => SourcedIdentityRecord | undefined;
 export declare const formatCatalogRefreshLegs: (legs: readonly CatalogLegResult[]) => string;
 export declare const catalogCachePath: (repoRoot: string) => string;
 /**

package/dist/adapters/catalog-remote.js

@@ -13,6 +13,40 @@ export const CATALOG_CACHE_MAX_AGE_MS = 7 * 86_400_000;
 export const CATALOG_REFRESH_TIMEOUT_MS = 10_000;
 const ARTIFICIAL_ANALYSIS_PAGE_SIZE = 100;
 const ARTIFICIAL_ANALYSIS_MAX_PAGES = 100;
+export const SOURCED_IDENTITY_RECORDS = [
+    {
+        identity: "claude-sonnet-5-5",
+        alias: "sonnet",
+        inputCostPerMtok: 2,
+        outputCostPerMtok: 10,
+        contextWindow: 1_000_000,
+        outputWindow: 128_000,
+        tier: "mid",
+        tierBasis: "continuity of the existing sonnet=mid configuration, not derived from the name or price",
+        sources: [
+            "https://raw.githubusercontent.com/anomalyco/models.dev/dev/providers/anthropic/models/claude-sonnet-5-5.toml",
+            "https://raw.githubusercontent.com/anomalyco/models.dev/dev/models/anthropic/claude-sonnet-5-5.toml",
+            "https://platform.claude.com/docs/en/models/sonnet-5-5/overview",
+        ],
+        fetchedAt: "2026-09-30",
+    },
+    {
+        identity: "claude-opus-5-5",
+        alias: "opus",
+        inputCostPerMtok: 4,
+        outputCostPerMtok: 20,
+        contextWindow: 1_000_000,
+        outputWindow: 128_000,
+        tier: "frontier",
+        tierBasis: "continuity of the existing opus=frontier configuration, not derived from the name or price",
+        sources: [
+            "https://raw.githubusercontent.com/anomalyco/models.dev/dev/providers/anthropic/models/claude-opus-5-5.toml",
+            "https://raw.githubusercontent.com/anomalyco/models.dev/dev/models/anthropic/claude-opus-5-5.toml",
+        ],
+        fetchedAt: "2026-09-30",
+    },
+];
+export const sourcedIdentityRecord = (identity) => SOURCED_IDENTITY_RECORDS.find((r) => r.identity === identity);
 const VENDORED_CATALOG = {
     schemaVersion: 1,
     // Package fallback copied from https://models.dev/api.json on 2026-08-05. It is deliberately
@@ -26,6 +60,10 @@ const VENDORED_CATALOG = {
                 "claude-fable-5-1": { id: "claude-fable-5-1", cost: { input: 10, output: 50 }, limit: { context: 1_000_000, output: 128_000 }, reasoning: true, tool_call: true, structured_output: true, attachment: true },
                 "claude-opus-4-8": { id: "claude-opus-4-8", cost: { input: 5, output: 25 }, limit: { context: 1_000_000, output: 128_000 }, reasoning: true, tool_call: true, structured_output: true, attachment: true },
                 "claude-sonnet-5": { id: "claude-sonnet-5", cost: { input: 2, output: 10 }, limit: { context: 1_000_000, output: 128_000 }, reasoning: true, tool_call: true, structured_output: true, attachment: true },
+                // v2.6.5 T9: the sourced 5-5 records above, so a refresh-less resolution still covers them.
+                ...Object.fromEntries(SOURCED_IDENTITY_RECORDS.map((r) => [r.identity, {
+                        id: r.identity, cost: { input: r.inputCostPerMtok, output: r.outputCostPerMtok }, limit: { context: r.contextWindow, output: r.outputWindow }, reasoning: true, tool_call: true, structured_output: true, attachment: true,
+                    }])),
                 "claude-haiku-4-5-20251001": { id: "claude-haiku-4-5-20251001", cost: { input: 1, output: 5 }, limit: { context: 200_000, output: 64_000 }, reasoning: true, tool_call: true, structured_output: true, attachment: true },
             },
         },

package/dist/adapters/claude-code.d.ts

@@ -2,7 +2,7 @@ import { type AuthHealth, type TrustDialog, type WorkerAdapter } from "./types.j
 export declare const CLAUDE_ALIAS_IDENTITY_STAMPS: {
     readonly fable: "claude-fable-5-1";
     readonly opus: "claude-opus-4-8";
-    readonly sonnet: "claude-sonnet-5";
+    readonly sonnet: "claude-sonnet-5-5";
     readonly haiku: "claude-haiku-4-5-20251001";
 };
 export type ClaudeAlias = keyof typeof CLAUDE_ALIAS_IDENTITY_STAMPS;

package/dist/adapters/claude-code.js

@@ -32,7 +32,10 @@ export const CLAUDE_ALIAS_IDENTITY_STAMPS = {
     // OBS-871, 2026-09-03: Fable's floating alias now resolves to the 5.1 benchmark identity.
     fable: "claude-fable-5-1",
     opus: "claude-opus-4-8",
-    sonnet: "claude-sonnet-5",
+    // v2.6.5 T9 (H, PREMISES-v265 P31): the author's live probeClaudeAliasIdentity call on 2026-09-30
+    // resolved sonnet to claude-sonnet-5-5. Its sourced price/window and continuity tier basis live in
+    // SOURCED_IDENTITY_RECORDS (catalog-remote.ts); this re-stamp re-dates no tier and adopts nothing.
+    sonnet: "claude-sonnet-5-5",
     haiku: "claude-haiku-4-5-20251001",
 };
 // v1.75 T2 / OBS-137: current Claude Code workspace-trust prompt (2.1.218). The full question

package/dist/adapters/codex-commit-check.d.ts

@@ -0,0 +1,25 @@
+import type { AuthHealth, WorkerAdapter } from "./types.js";
+export type CodexCommitStatus = "protected" | "allowed" | "unknown";
+export interface CodexCommitProbe {
+    worktree: string;
+    commonDir: string;
+    control: string;
+    lock: string;
+    token: string;
+    signal?: AbortSignal;
+}
+/** Runs the write script inside the Codex sandbox and resolves its stdout. Injected in tests. */
+export type CodexSandbox = (probe: CodexCommitProbe) => Promise<string>;
+export interface CodexCommitResult {
+    status: CodexCommitStatus;
+    detail: string;
+}
+export declare const codexSandboxArgs: (p: CodexCommitProbe) => string[];
+export declare const codexSandbox: CodexSandbox;
+export declare function probeCodexCommit(repoRoot: string, sandbox?: CodexSandbox, signal?: AbortSignal): Promise<CodexCommitResult>;
+/** Doctor's one call: gated on the REAL codex adapter object (a codex-id stub gets no probe and no output
+ *  unless a test injects a sandbox — the kimiTurnEnabled rule). Mutates only the health record doctor owns. */
+export declare function recordCodexCommit(adapters: WorkerAdapter[], health: Record<string, AuthHealth>, cwd: string, sandbox?: CodexSandbox): Promise<void>;
+/** Plan's headline beneath a Codex worker row; null for every other worker and for an allowed probe.
+ *  An absent field is unknown, but only the real adapter earns the line — stubs stay byte-identical. */
+export declare function codexCommitHeadline(worker: string, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): string | null;

package/dist/adapters/codex-commit-check.js

@@ -0,0 +1,108 @@
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdtempSync, readFileSync, rmdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { promisify } from "node:util";
+import { codex } from "./codex.js";
+const exec = promisify(execFile);
+const git = async (cwd, ...args) => (await exec("git", args, { cwd })).stdout.trim();
+// $1 control, $2 lock, $3 token. noclobber (set -C) creates the lock the way git does — never over an existing one.
+const SCRIPT = `printf %s "$3" > "$1" && echo control=ok || echo control=fail
+e=$( (set -C; printf %s "$3" > "$2") 2>&1 ) && echo lock=ok || echo "lock=fail $e"`;
+// The grant names the git common dir (the worker launch grant) AND the exact linked metadata directory that
+// holds index.lock, so a denial is protection despite an exact grant — never a grant this probe forgot.
+export const codexSandboxArgs = (p) => [
+    "sandbox", "-c", 'sandbox_mode="workspace-write"',
+    "-c", `sandbox_workspace_write.writable_roots=${JSON.stringify([p.commonDir, dirname(p.lock)])}`,
+    "--", "sh", "-c", SCRIPT, "sh", p.control, p.lock, p.token,
+];
+export const codexSandbox = async (p) => (await exec("codex", codexSandboxArgs(p), { cwd: p.worktree, timeout: 20_000, signal: p.signal })).stdout;
+const holds = (path, token) => {
+    try {
+        return readFileSync(path, "utf8") === token;
+    }
+    catch {
+        return false;
+    }
+};
+const unknown = (detail) => ({ status: "unknown", detail });
+export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal) {
+    const token = randomUUID();
+    const parent = mkdtempSync(join(tmpdir(), "tickmarkr-codex-commit-"));
+    // git names the fixture's metadata directory after the checkout's basename; a unique one makes that
+    // directory — and so the lock path — known BEFORE `worktree add`, which can fail after creating it
+    const worktree = join(parent, `tickmarkr-probe-${token}`);
+    let lock;
+    try {
+        const commonDir = await git(repoRoot, "rev-parse", "--path-format=absolute", "--git-common-dir");
+        lock = join(commonDir, "worktrees", basename(worktree), "index.lock");
+        await git(repoRoot, "worktree", "add", "--detach", worktree, "HEAD");
+        if (join(await git(worktree, "rev-parse", "--absolute-git-dir"), "index.lock") !== lock)
+            return unknown("the fixture worktree metadata is not where git was expected to put it");
+        const control = join(worktree, "tickmarkr-codex-commit-control");
+        if (existsSync(lock))
+            return unknown("a foreign index.lock already holds the fixture worktree");
+        const out = await sandbox({ worktree, commonDir, control, lock, token, signal });
+        // Every verdict needs the sandbox's own report AND the bytes on disk to agree; anything else is unknown.
+        if (!/^control=ok$/m.test(out) || !holds(control, token))
+            return unknown("the sandbox did not write the ordinary control file");
+        if (/^lock=ok$/m.test(out) && holds(lock, token))
+            return { status: "allowed", detail: "the sandbox wrote index.lock" };
+        if (/^lock=fail .*(not permitted|permission denied)/mi.test(out) && !existsSync(lock)) {
+            return { status: "protected", detail: "the sandbox wrote an ordinary worktree file but denied index.lock" };
+        }
+        return unknown("the sandbox result for index.lock was unreadable");
+    }
+    catch (e) {
+        return unknown(signal?.aborted ? "probe cancelled" : `probe did not run (${(e instanceof Error ? e.message : String(e)).split("\n")[0]})`);
+    }
+    finally {
+        // only the lock this probe wrote (its token) is ours to remove; a foreign one is never touched
+        if (lock && holds(lock, token))
+            rmSync(lock, { force: true });
+        // a foreign lock lives in the fixture's metadata directory, which `worktree remove` would delete with
+        // it: drop only the checkout and leave that metadata to the lock's owner. Never a repository-wide
+        // prune — that would take an earlier probe's preserved foreign lock (or anyone's prunable worktree).
+        const foreign = lock !== undefined && existsSync(lock);
+        if (lock && !foreign) {
+            await git(repoRoot, "worktree", "remove", "--force", worktree).catch(() => undefined);
+            // a failed `worktree add` leaves metadata git no longer removes by path: drop this probe's own directory
+            rmSync(dirname(lock), { recursive: true, force: true });
+            try {
+                rmdirSync(dirname(dirname(lock)));
+            }
+            catch { /* other worktrees live there */ }
+        }
+        rmSync(parent, { recursive: true, force: true });
+    }
+}
+const NOTE = {
+    protected: "linked-worktree git metadata protected",
+    allowed: "linked-worktree commit probe: index.lock writable",
+    unknown: "linked-worktree commit probe unknown",
+};
+/** Doctor's one call: gated on the REAL codex adapter object (a codex-id stub gets no probe and no output
+ *  unless a test injects a sandbox — the kimiTurnEnabled rule). Mutates only the health record doctor owns. */
+export async function recordCodexCommit(adapters, health, cwd, sandbox) {
+    const adapter = adapters.find((a) => a.id === codex.id);
+    const h = health[codex.id];
+    if (!adapter || (adapter !== codex && !sandbox) || !h?.installed)
+        return;
+    const r = await probeCodexCommit(cwd, sandbox);
+    const say = `${NOTE[r.status]} — ${r.detail}${r.status === "protected" ? "; a Codex worker cannot commit in its worktree" : ""}`;
+    health[codex.id] = { ...h, codexCommit: r.status, note: `${h.note ? `${h.note}; ` : ""}${say}` };
+}
+/** Plan's headline beneath a Codex worker row; null for every other worker and for an allowed probe.
+ *  An absent field is unknown, but only the real adapter earns the line — stubs stay byte-identical. */
+export function codexCommitHeadline(worker, adapters, health) {
+    if (worker !== codex.id || !adapters.includes(codex))
+        return null;
+    const status = health[codex.id]?.codexCommit ?? "unknown";
+    if (status === "protected") {
+        return "    worker restriction: codex linked-worktree git metadata is protected (doctor probe) — this worker cannot commit its own work; routing consequence: steer this task to an eligible non-Codex worker";
+    }
+    return status === "unknown"
+        ? "    worker restriction: unknown — the codex linked-worktree commit probe has no verdict; run tickmarkr doctor"
+        : null;
+}

package/dist/adapters/codex.d.ts

@@ -1,7 +1,8 @@
-import { type TrustDialog, type TrustVerdict, type WorkerAdapter } from "./types.js";
+import { type ModelRetirement, type TrustDialog, type TrustVerdict, type WorkerAdapter } from "./types.js";
 export declare function readCodexModelsCache(path?: string): {
     models: string[];
     fetchedAt?: string;
+    retirements?: Record<string, ModelRetirement | null>;
 };
 export declare const CODEX_TRUST_DIALOG: TrustDialog;
 export declare const CODEX_INPUT_BOX: import("./types.js").InputBox;

package/dist/adapters/codex.js

@@ -61,20 +61,39 @@ function codexSessionDayDirs(sessions, sinceMs) {
 // Fails OPEN to { models: [] } on missing/corrupt cache. Version drift observed (installed CLI
 // 0.143.0 vs cache client_version 0.144.0, 2026-07-10) — hence the defensive try/catch and no shape
 // assumptions. CODEX_HOME is codex's own relocation env. fetchedAt is the honest codex knowledge age.
+// v2.6.4 T2 (B1a): each listed entry's `upgrade` is the CLI's own retirement notice (0.159.0 cache,
+// 2026-09-29: gpt-5.5 → {model: gpt-5.6-sol, retirement_at: 2026-10-14T19:00:00Z}; every other listed
+// id carries upgrade: null). null records known clean; a malformed or absent `upgrade` records nothing,
+// so that id stays unknown. An unreadable cache returns no retirements at all (unknown, never clean).
 export function readCodexModelsCache(path) {
     const p = path ?? join(process.env.CODEX_HOME || join(homedir(), ".codex"), "models_cache.json");
     try {
         const d = JSON.parse(readFileSync(p, "utf8"));
-        const models = (d.models ?? [])
-            .filter((m) => m?.visibility === "list" && typeof m.slug === "string" && m.slug.length > 0)
-            .map((m) => m.slug)
-            .filter((id) => MODEL_ID_RE.test(id));
-        return { models, fetchedAt: typeof d.fetched_at === "string" ? d.fetched_at : undefined };
+        const listed = (d.models ?? [])
+            .filter((m) => m?.visibility === "list" && typeof m.slug === "string" && m.slug.length > 0 && MODEL_ID_RE.test(m.slug));
+        const retirements = {};
+        for (const m of listed) {
+            const notice = codexRetirement(m.upgrade);
+            if (notice !== undefined)
+                retirements[m.slug] = notice;
+        }
+        return { models: listed.map((m) => m.slug), fetchedAt: typeof d.fetched_at === "string" ? d.fetched_at : undefined, retirements };
     }
     catch {
         return { models: [] };
     }
 }
+function codexRetirement(upgrade) {
+    if (upgrade === null)
+        return null;
+    const u = upgrade;
+    if (typeof u?.retirement_at !== "string" || !Number.isFinite(Date.parse(u.retirement_at)))
+        return undefined;
+    if (u.model === undefined)
+        return { retiresAt: u.retirement_at };
+    // the successor id comes from an external file and is rendered in lints — same charset gate as slugs
+    return typeof u.model === "string" && MODEL_ID_RE.test(u.model) ? { retiresAt: u.retirement_at, successor: u.model } : undefined;
+}
 // tickmarkr worktrees keep their gitdir under the MAIN repo's .git/worktrees/<name> — outside the
 // workspace-write sandbox root — so git commit dies on index.lock (incident run-20260709-104447
 // P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the pane shell at the
@@ -272,6 +291,8 @@ export const codex = {
     // v1.5 MODEL-05: codex reads an offline cache, so "now" would re-stamp an ancient cache fresh and the
     // 30-day staleness lint could never fire. Surface the cache's own fetched_at so doctor stamps the real age.
     listModelsFetchedAt: () => readCodexModelsCache().fetchedAt,
+    // v2.6.4 T2 (B1a): the cache's per-model retirement notices, persisted beside models in doctor.json.
+    listModelsRetirements: () => readCodexModelsCache().retirements,
     collectUsage(cwd, sinceMs) {
         try {
             const real = realpathSync(cwd);

package/dist/adapters/model-discovery-check.d.ts

@@ -0,0 +1,33 @@
+import type { TickmarkrConfig } from "../config/config.js";
+import { type CatalogFetcher, type CatalogReadResult } from "./catalog-remote.js";
+import { type ClaudeAlias } from "./claude-code.js";
+import type { AuthHealth, WorkerAdapter } from "./types.js";
+export interface ModelDiscoveryCheckInput {
+    cwd: string;
+    cfg: TickmarkrConfig;
+    adapters: WorkerAdapter[];
+    /** This doctor's fresh health, BEFORE it is written: the doctor.json on disk is the prior discovery. */
+    health: Record<string, AuthHealth>;
+    catalog: CatalogReadResult;
+    resolved: Partial<Record<ClaudeAlias, string | undefined>>;
+    /** False when this doctor already refreshed, was handed a catalog, or may not touch the network. */
+    mayRefresh: boolean;
+    fetcher?: CatalogFetcher;
+    now?: () => Date;
+}
+/**
+ * Doctor's post-discovery coverage check. A model this discovery ADDED (absent from the prior
+ * doctor.json) that the catalog does not cover earns at most ONE refresh, even under a fresh cache;
+ * a model already seen never re-fetches, so a permanently uncovered model cannot become a per-run
+ * fetch. A failed refresh leaves coverage unknown — never "uncovered" — until a successful refresh. Advisory: no config, tier or
+ * routing write; sourced identity records print as inference for confirmation.
+ */
+export declare function checkModelDiscovery(input: ModelDiscoveryCheckInput): Promise<{
+    catalog: CatalogReadResult;
+    findings: string[];
+}>;
+/**
+ * plan's headline: drift read from the identity doctor PERSISTED for each configured claude alias.
+ * Matching identities stay silent; an alias doctor never resolved stays unknown, never clean.
+ */
+export declare function aliasIdentityHeadlines(cfg: TickmarkrConfig, health: Record<string, AuthHealth>): string[];

package/dist/adapters/model-discovery-check.js

@@ -0,0 +1,123 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { stateDirName } from "../graph/graph.js";
+import { observedIdentity } from "../route/preference.js";
+import { CATALOG_REFRESH_TIMEOUT_MS, formatCatalogRefreshLegs, refreshCatalogCommand, resolveCatalogModel, sourcedIdentityRecord, } from "./catalog-remote.js";
+import { CLAUDE_ALIAS_IDENTITY_STAMPS } from "./claude-code.js";
+import { readDoctor } from "./registry.js";
+const seen = (health, adapter) => {
+    const h = health?.[adapter];
+    return new Set([...(h?.models ?? []), ...Object.values(h?.modelAuth ?? {}).flatMap((v) => (v.identity ? [v.identity] : []))]);
+};
+// A failed refresh's unknown outlives that doctor: keyed to the models.dev spine stamp it failed against,
+// so any later successful refresh (doctor's guard, fleet, catalog refresh) supersedes it by moving the stamp.
+const unknownPath = (cwd) => join(cwd, stateDirName(cwd), "catalog-coverage-unknown.json");
+const spineStamp = (c) => c.source === "cache" ? c.catalog.legFetchedAt?.modelsDev ?? c.catalog.fetchedAt : null;
+function persistedUnknown(cwd, catalog) {
+    try {
+        const v = JSON.parse(readFileSync(unknownPath(cwd), "utf8"));
+        return v.modelsDevAt === spineStamp(catalog) && Array.isArray(v.keys) ? v.keys.filter((k) => typeof k === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Doctor's post-discovery coverage check. A model this discovery ADDED (absent from the prior
+ * doctor.json) that the catalog does not cover earns at most ONE refresh, even under a fresh cache;
+ * a model already seen never re-fetches, so a permanently uncovered model cannot become a per-run
+ * fetch. A failed refresh leaves coverage unknown — never "uncovered" — until a successful refresh. Advisory: no config, tier or
+ * routing write; sourced identity records print as inference for confirmation.
+ */
+export async function checkModelDiscovery(input) {
+    const { cfg, health } = input;
+    const prior = readDoctor(input.cwd);
+    const findings = [];
+    // Discovery is every listed model and resolved alias identity, classified or not: an operator's tier
+    // classification never establishes catalog coverage. A claude alias is checked as the identity it
+    // resolved to; one with no resolved identity has nothing a refresh could cover (its row says unknown).
+    const resolvedOf = (adapter, model) => adapter === "claude-code" && model in CLAUDE_ALIAS_IDENTITY_STAMPS ? input.resolved[model] ?? null : undefined;
+    const added = input.adapters.filter((a) => health[a.id]?.installed).flatMap((a) => {
+        const before = seen(prior, a.id);
+        return [...seen(health, a.id)].filter((model) => !before.has(model) && resolvedOf(a.id, model) !== null)
+            .map((model) => ({ adapter: a.id, model, resolvedModel: resolvedOf(a.id, model) ?? undefined }));
+    });
+    const covered = (catalog, row) => resolveCatalogModel(catalog.catalog, { provider: cfg.tiers[row.adapter]?.vendor ?? undefined, model: row.model, resolvedModel: row.resolvedModel }) !== undefined;
+    let catalog = input.catalog;
+    const unknown = persistedUnknown(input.cwd, catalog);
+    if (unknown.length)
+        catalog = { ...catalog, coverageUnknown: unknown };
+    const uncovered = added.filter((row) => !covered(catalog, row));
+    if (uncovered.length && input.mayRefresh) {
+        const refreshed = await refreshCatalogCommand({
+            repoRoot: input.cwd, fetcher: input.fetcher, timeoutMs: CATALOG_REFRESH_TIMEOUT_MS, now: input.now,
+        });
+        const names = (rows) => rows.map((r) => `${r.adapter}:${r.model}`).join(", ");
+        if (refreshed.legs.some((leg) => leg.leg === "models.dev" && leg.status === "updated")) {
+            catalog = refreshed.catalog;
+            const still = uncovered.filter((row) => !covered(catalog, row));
+            findings.push(`catalog coverage refreshed once after discovery added ${uncovered.length} uncovered model(s) (${names(uncovered)})${still.length ? `; still uncovered: ${names(still)}` : "; now covered"} — ${formatCatalogRefreshLegs(refreshed.legs)} (advisory — routing unchanged)`);
+        }
+        else {
+            const keys = [...new Set([...unknown, ...uncovered.map((r) => `${r.adapter}:${r.model}`)])];
+            catalog = { ...catalog, coverageUnknown: keys };
+            mkdirSync(join(input.cwd, stateDirName(input.cwd)), { recursive: true });
+            writeFileSync(unknownPath(input.cwd), JSON.stringify({ modelsDevAt: spineStamp(refreshed.catalog), keys }) + "\n");
+            findings.push(`catalog coverage unknown for ${names(uncovered)} — the one post-discovery refresh failed: ${formatCatalogRefreshLegs(refreshed.legs)} (advisory — routing unchanged)`);
+        }
+    }
+    findings.push(...identityRecordFindings(cfg, health, input.resolved));
+    return { catalog, findings };
+}
+/**
+ * Sourced tier/price/window per resolved alias; unknown and unsourced identities claim nothing. An alias
+ * the probe proved unauthed is not listed as unknown: its model-status row already names why.
+ */
+function identityRecordFindings(cfg, health, resolved) {
+    const configured = cfg.tiers["claude-code"]?.models ?? {};
+    const unknown = [];
+    const rows = [];
+    for (const [alias, identity] of Object.entries(resolved)) {
+        if (!identity) {
+            if (health["claude-code"]?.modelAuth?.[alias]?.authed !== false)
+                unknown.push(alias);
+            continue;
+        }
+        const record = sourcedIdentityRecord(identity);
+        if (!record || record.alias !== alias) {
+            // A record of another alias family is a disagreement, never a record this alias may borrow.
+            rows.push(`identity record: claude-code:${alias} → ${identity} ${record ? `disagrees with the ${alias} family` : "has no sourced record"} — tier/price/window unknown`);
+            continue;
+        }
+        rows.push(`identity record: claude-code:${alias} → ${identity} · $${record.inputCostPerMtok}/$${record.outputCostPerMtok} per Mtok (API) · window ${record.contextWindow}/${record.outputWindow} · sourced ${record.fetchedAt} (${record.sources.join(", ")})`
+            + ` · INFERRED tier ${record.tier} by ${record.tierBasis} — inference for operator confirmation (tickmarkr fleet); doctor writes no configuration`
+            + ` · routing authority: configured claude-code:${alias}=${configured[alias] ?? "unclassified"}`);
+    }
+    if (unknown.length)
+        rows.unshift(`identity record: claude-code:${unknown.join(", ")} identity unknown — no sourced tier/price/window applies`);
+    return rows;
+}
+/**
+ * plan's headline: drift read from the identity doctor PERSISTED for each configured claude alias.
+ * Matching identities stay silent; an alias doctor never resolved stays unknown, never clean.
+ */
+export function aliasIdentityHeadlines(cfg, health) {
+    if (!health["claude-code"]?.installed)
+        return [];
+    const configured = cfg.tiers["claude-code"]?.models ?? {};
+    const unknown = [];
+    const lines = [];
+    for (const [alias, stamped] of Object.entries(CLAUDE_ALIAS_IDENTITY_STAMPS)) {
+        if (!(alias in configured))
+            continue;
+        const identity = observedIdentity(health, "claude-code", alias);
+        if (!identity)
+            unknown.push(alias);
+        else if (identity !== stamped) {
+            lines.push(`alias drift: claude-code:${alias} serves ${identity} (persisted by doctor), stamped identity ${stamped} — reclassify per benchmark policy (advisory — routing unchanged)`);
+        }
+    }
+    if (unknown.length)
+        lines.push(`alias identity unknown: claude-code:${unknown.join(", ")} — doctor persisted no resolved identity (run tickmarkr doctor)`);
+    return lines;
+}

package/dist/adapters/model-lints.d.ts

@@ -27,7 +27,7 @@ declare const RANKED_BASES: readonly ["agentic-coding", "intelligence"];
 type RankedBasis = typeof RANKED_BASES[number];
 export type CatalogSuggestionBasis = RankedBasis | "price";
 export interface CatalogModelAdvisory {
-    coverage: "covered" | "uncovered";
+    coverage: "covered" | "uncovered" | "unknown";
     evidence?: CatalogModelEvidence;
     suggestion?: {
         tier: Tier;
@@ -81,6 +81,7 @@ export declare function modelLints(cfg: TickmarkrConfig, health: Record<string,
     tty?: boolean;
     stateDir?: string;
     overlayPreferShapes?: ReadonlySet<string>;
+    now?: Date;
 }): string[];
 export declare function formatModelAuthLine(excluded: {
     key: string;

package/dist/adapters/model-lints.js

@@ -183,6 +183,10 @@ export function catalogModelAdvisory(cfg, catalog, adapter, model, resolvedModel
     const row = { adapter, model, resolvedModel };
     const evidence = catalogEvidenceFor(cfg, catalog, row);
     if (!evidence) {
+        // v2.6.5 T9: a failed post-discovery refresh proves nothing about coverage — unknown, never "uncovered".
+        if ([model, resolvedModel].some((m) => m !== undefined && catalog.coverageUnknown?.includes(`${adapter}:${m}`))) {
+            return { coverage: "unknown", display: `${model} — catalog coverage unknown (post-discovery refresh failed); no tier suggestion` };
+        }
         return {
             coverage: "uncovered",
             display: `${model} — uncovered by ${catalog.source === "cache" ? "cached catalogs" : "vendored catalog"}; no tier suggestion`,
@@ -478,10 +482,55 @@ export function preferEntryLints(cfg, health, mapShapes = new Set()) {
     sweep("consult.prefer", cfg.consult.prefer);
     return lints;
 }
+// v2.6.4 T2 (B1a): doctor.json is read without a schema (compat), so a stored notice is re-checked here —
+// anything but null (known clean) or a dated notice reads as unknown, never as clean.
+function storedRetirement(record, model) {
+    if (!record || typeof record !== "object")
+        return undefined;
+    const r = record[model];
+    if (r === null)
+        return null;
+    const n = r;
+    if (typeof n?.retiresAt !== "string" || !Number.isFinite(Date.parse(n.retiresAt)))
+        return undefined;
+    if (n.successor === undefined)
+        return { retiresAt: n.retiresAt };
+    return typeof n.successor === "string" && MODEL_ID_RE.test(n.successor) ? { retiresAt: n.retiresAt, successor: n.successor } : undefined;
+}
+// Configured AND listed models only — a configured id the CLI stopped listing already carries the
+// tombstone advisory. The CLI's notice is quoted as-is: its successor is the CLI's upgrade target, never
+// a tier or benchmark claim, and no model name or visibility is read as one. Advisory: routing unchanged.
+function retirementLints(id, listedConfigured, record, nowMs) {
+    const lints = [];
+    const unknown = [];
+    for (const model of listedConfigured) {
+        const notice = storedRetirement(record, model);
+        if (notice === undefined) {
+            unknown.push(model);
+            continue;
+        }
+        if (!notice)
+            continue; // listed with no notice: known clean
+        const successor = notice.successor
+            ? `successor ${notice.successor} (named by the CLI — not a tier claim; classify it per benchmark policy)`
+            : "no successor named";
+        lints.push(nowMs >= Date.parse(notice.retiresAt)
+            ? `${id}: ${model} retired ${notice.retiresAt} per the CLI's notice; ${successor} — tombstone it (${model}: null overlay) or verify the id (advisory — routing unchanged)`
+            : `${id}: ${model} retires ${notice.retiresAt} per the CLI's notice; ${successor} — tombstone it (${model}: null overlay) before then (advisory — routing unchanged)`);
+    }
+    if (unknown.length) {
+        const why = record && typeof record === "object"
+            ? "the CLI's notice is absent or unreadable"
+            : "doctor record carries no CLI retirement notices; rerun tickmarkr doctor";
+        lints.push(`${id}: retirement unknown for ${unknown.join(", ")} — ${why}`);
+    }
+    return lints;
+}
 // Diffs detected models (doctor.json) against configured tiers, both directions, per installed adapter.
 // No `  ! ` prefix here — the consumer (doctor rows / plan lints) owns that. Pre-v1.5 doctor.json (models:[], no
 // modelsDetectedAt) is the compat baseline: `?.`/`?? []` everywhere, no zod (would reject old files).
 export function modelLints(cfg, health, adapters, opts) {
+    const nowMs = (opts?.now ?? new Date()).getTime();
     const cap = opts?.tty ? TTY_LINT_CAP : LINT_CAP;
     const doctorRef = opts?.tty ? doctorJsonRef(opts.stateDir ?? DEFAULT_STATE_DIR) : "";
     const lints = [];
@@ -517,6 +566,8 @@ export function modelLints(cfg, health, adapters, opts) {
                 lints.push(`${id}: tiers lists ${model} — CLI no longer reports it; tombstone it (${model}: null overlay) or verify the id`);
             }
         }
+        if (adapter.listModelsRetirements)
+            lints.push(...retirementLints(id, configured.filter((m) => detected.includes(m)), h?.modelRetirements, nowMs));
         const extra = collapseUnclassified(detected, new Set(configured));
         if (extra.length) {
             const shown = extra.slice(0, cap).map((row) => row.model).join(", ");
@@ -525,7 +576,7 @@ export function modelLints(cfg, health, adapters, opts) {
         }
         const at = h?.modelsDetectedAt;
         if (at) {
-            const days = Math.floor((Date.now() - Date.parse(at)) / DAY_MS); // completed days — never overstate age
+            const days = Math.floor((nowMs - Date.parse(at)) / DAY_MS); // completed days — never overstate age
             if (days >= MODEL_STALE_DAYS)
                 lints.push(`${id}: model knowledge is ${days} days old — rerun tickmarkr doctor`);
         }

package/dist/adapters/model-windows.d.ts

@@ -15,7 +15,8 @@ export type ModelWindowResolution = {
 };
 /**
  * Validate cited model-window claims before production code can consume them.
- * These values are vendor-published claims, not measurements made by tickmarkr.
+ * These values are vendor-published claims (a vendor page, or a vendor CLI's own model cache), not
+ * measurements made by tickmarkr.
  */
 export declare function loadModelWindowClaims(input: unknown): readonly ModelWindowClaim[];
 /** The closed, production-readable catalog of cited context-window claims. */