tickmarkr 2.6.3 → 2.6.5

package/dist/run/journal.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
@@ -6,9 +7,10 @@ import { z } from "zod";
 import { channelKey, shq, TokenUsageSchema } from "../adapters/types.js";
 import { graphDefinitionHash, stateDirName, taskContentDigest, taskDefinitionFingerprint, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES, TIERS } from "../graph/schema.js";
-import { channelRouteIdentity } from "../route/preference.js";
+import { channelRouteIdentity, modelProvider } from "../route/preference.js";
 import { buildProfile, classify } from "../route/profile.js";
 import { DecisionEventSchema, trackJournalRows, } from "./protocol.js";
+import { PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER } from "./git.js";
 import { normalizeGateOutcome } from "./outcome.js";
 import { redactSecrets } from "./redact.js";
 export function phaseForGate(gate) {
@@ -1936,7 +1938,11 @@ export class Journal {
         const reducedData = event === "run-end"
             ? (() => {
                 const preservedRefs = [...preservedRefsByTask(priorEvents)].flatMap(([preservedTaskId, refs]) => refs.map(({ ref, diffCommand }) => ({ taskId: preservedTaskId, ref, diffCommand })));
-                return preservedRefs.length > 0 ? { ...inputData, preservedRefs } : inputData;
+                const reduced = preservedRefs.length > 0 ? { ...inputData, preservedRefs } : inputData;
+                // C1: the terminal record carries the owed-check fold as of this append, revalidated from
+                // each discharge's artifact — a reopened journal re-reduces, it never copies a prior total.
+                // Canonical (validated) rows are strict and keep their schema; the live producer is the tuple.
+                return decisionRow ? reduced : { ...reduced, owedChecks: foldOwedChecks(priorEvents, join(this.dir, "..", "..", "..")) };
             })()
             : event === "resume-restore" && rowTaskId && upheldFeedbackByTask(effectiveEvents(priorEvents)).has(rowTaskId)
                 ? {
@@ -2383,3 +2389,347 @@ export class Journal {
             .filter((row) => row && typeof row === "object" && "kind" in row && row.kind === "judge");
     }
 }
+// ── C1 (v2.6.4): owed checks ─────────────────────────────────────────────────────────────────────
+// A waiver accepts risk on ONE immutable subject. The same task-approved row that satisfies the gate
+// carries the obligation it leaves behind: run, task, gate, the exact base..head range and its
+// canonical subject, the acceptance criteria, the run-derived lifetime patch authors, the cause and
+// the evidence that would discharge it. The fold below is the only reader. It keeps every waiver as
+// accepted-risk history, subtracts a discharge only while its proof still revalidates, and answers
+// "unknown" — never zero — for a waiver without a well-formed obligation or a proof that no longer holds.
+export const OWED_CHECK_VERSION = 1;
+export const OWED_DISCHARGE_EVENT = "owed-check-discharged";
+const owedGit = (cwd, args, input) => execFileSync("git", args, {
+    cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024, ...(input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input }),
+});
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+export const owedCriteria = (acceptance) => sha256(JSON.stringify(acceptance));
+/** The daemon's canonical gate subject for base..head (daemon.ts gateCommitSubject), byte for byte. */
+export const owedSubject = (cwd, base, head) => sha256(owedGit(cwd, ["log", "--reverse", "--format=%T%x00%an%x00%ae%x00%cn%x00%ce%x00%B%x1e", `${base}..${head}`]));
+// Ownership joins on --stable ids (whitespace-blind: a re-indented carry keeps its author, which only
+// widens exclusions). Range identity uses --verbatim: re-indented content is a different program.
+const patchIdOf = (cwd, diff, mode = "--stable") => owedGit(cwd, ["patch-id", mode], diff).trim().split(/\s+/)[0] || undefined;
+/** Ordered verbatim patch ids of the commits in base..head; an empty commit authored no patch. */
+export const rangePatches = (cwd, base, head) => owedGit(cwd, ["rev-list", "--reverse", `${base}..${head}`]).trim().split("\n").filter(Boolean)
+    .map((commit) => patchIdOf(cwd, owedGit(cwd, ["show", "--format=", "--binary", commit]), "--verbatim"))
+    .filter((id) => id !== undefined);
+/** Verbatim patch identity of the whole change base..head introduces. */
+export const rangePatch = (cwd, base, head) => patchIdOf(cwd, owedGit(cwd, ["diff", "--binary", base, head]), "--verbatim") ?? "empty";
+const COMMIT_ID = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+/**
+ * `head` is the task's own recorded integration merge of the obligation's range — exactly. Its first
+ * parent is `mergeBase`; its second parent replays the waived history source tree for source tree from
+ * a base with the waived base's tree (a carry may mint new commit objects, never new content — and
+ * patch ids alone ignore where a hunk lands); its tree is git's own clean merge of the two (no
+ * resolution, no amend); and it introduced the same ordered verbatim patch series and total patch.
+ * Squashed, reordered, relocated, re-indented, reverted or conflict-resolved history fails one of
+ * these and is refused as ambiguous; containment never counts.
+ * Both verify (before discharging) and the fold (re-reading every discharge) decide through here.
+ */
+export function integrationMapped(cwd, events, o, mergeBase, head, memo) {
+    if (typeof mergeBase !== "string" || typeof head !== "string" || !COMMIT_ID.test(mergeBase) || !COMMIT_ID.test(head))
+        return false;
+    if (!events.some((e) => e.event === "merge" && e.taskId === o.taskId && e.data.commit === head))
+        return false;
+    // Only the git component is memoised, and only a completed proof: commit ids name immutable history,
+    // so the key is the obligation's id and recorded range facts plus the claimed mergeBase..head. A refusal
+    // or git failure (a shallow or partial object store can refuse a range it later proves) is never cached
+    // and is re-proved next fold. The merge-row eligibility above is rechecked on every fold.
+    const key = JSON.stringify([o.id, mergeBase, head, o.base, o.head, o.patch, o.patches]);
+    if (memo?.has(key))
+        return true;
+    const proved = integrationProved(cwd, o, mergeBase, head);
+    if (proved)
+        memo?.add(key);
+    return proved;
+}
+function integrationProved(cwd, o, mergeBase, head) {
+    try {
+        const parents = owedGit(cwd, ["show", "-s", "--format=%P", head]).trim().split(" ");
+        if (parents.length !== 2 || parents[0] !== mergeBase)
+            return false;
+        const [, carried] = parents;
+        const tree = (rev) => owedGit(cwd, ["rev-parse", `${rev}^{tree}`]).trim();
+        const trees = (from, to) => owedGit(cwd, ["log", "--reverse", "--format=%T", `${from}..${to}`]).trim();
+        if (tree(owedGit(cwd, ["merge-base", mergeBase, carried]).trim()) !== tree(o.base) || trees(mergeBase, carried) !== trees(o.base, o.head))
+            return false;
+        // A conflicted merge-tree exits 1 and throws; a clean one prints its tree first.
+        if (owedGit(cwd, ["merge-tree", "--write-tree", mergeBase, carried]).trim().split("\n")[0] !== tree(head))
+            return false;
+        const series = rangePatches(cwd, mergeBase, carried);
+        return series.length === o.patches.length && series.every((id, i) => id === o.patches[i])
+            && rangePatch(cwd, mergeBase, head) === o.patch;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Lifetime patch authors of base..head, read from the run: the daemon's subjectAuthors fold
+ * (daemon.ts, not exported and not this task's to edit) restated synchronously so the waive row is
+ * written without yielding. Recreation rows name SOURCE hashes, so ownership joins by stable patch
+ * identity across changed commit objects; a gate-only restore (resume-restore's seat, a recreation
+ * after work started) never becomes an author. Unreadable history names an unknown author.
+ */
+export function owedAuthors(events, taskId, cwd, base, head) {
+    const cache = new Map();
+    const patches = (commits) => {
+        const ids = new Set();
+        for (const commit of commits) {
+            if (!cache.has(commit))
+                cache.set(commit, patchIdOf(cwd, owedGit(cwd, ["show", "--format=", "--binary", commit])));
+            const id = cache.get(commit);
+            if (id)
+                ids.add(id);
+        }
+        return ids;
+    };
+    let current;
+    let previous;
+    let awaitingCarry = false;
+    const owners = new Map();
+    const preservedOwner = new Map();
+    const attribute = (ids, attempt) => {
+        for (const id of ids) {
+            if (attempt?.incoming.has(id))
+                continue;
+            const authors = owners.get(id) ?? new Set();
+            authors.add(preservedOwner.get(id) ?? attempt?.author ?? "unknown author (missing task-dispatch assignment)");
+            owners.set(id, authors);
+        }
+    };
+    try {
+        for (const row of events) {
+            if (row.taskId !== taskId)
+                continue;
+            const preserved = [row.data.ref, row.data.preservedRef].find((v) => typeof v === "string" && v.startsWith("refs/tickmarkr/preserved/"));
+            if (preserved) {
+                const [commit, subject, trailer] = owedGit(cwd, ["show", "-s", `--format=%H%n%s%n%(trailers:key=${PRESERVE_PRODUCER_TRAILER},valueonly)`, `${preserved}^{commit}`]).trim().split("\n");
+                if (commit && subject === PRESERVE_COMMIT_SUBJECT) {
+                    const owner = typeof row.data.producer === "string" ? row.data.producer
+                        : trailer?.trim().replace(/ attempt \d+$/, "") || "unknown author (legacy unattributed preservation)";
+                    for (const id of patches([commit])) {
+                        const prior = preservedOwner.get(id);
+                        if (prior === undefined || prior === "unknown" || prior.startsWith("unknown author"))
+                            preservedOwner.set(id, owner);
+                    }
+                }
+            }
+            if (row.event === "task-dispatch") {
+                previous = current;
+                const a = row.data.assignment;
+                current = { author: typeof a?.adapter === "string" && typeof a?.model === "string"
+                        ? `${a.adapter}:${a.model}` : "unknown author (missing task-dispatch assignment)", incoming: new Set() };
+                awaitingCarry = true;
+            }
+            else if (row.event === "worktree-recreation") {
+                const carried = patches(Array.isArray(row.data.carried) ? row.data.carried : []);
+                attribute(carried, awaitingCarry ? previous : current);
+                if (awaitingCarry && current)
+                    current.incoming = carried;
+                awaitingCarry = false;
+            }
+            else if (["worker-launch", "worker-result", "gate-result", "task-human"].includes(row.event)) {
+                awaitingCarry = false;
+            }
+        }
+        const subject = patches(owedGit(cwd, ["rev-list", "--reverse", `${base}..${head}`]).trim().split("\n").filter(Boolean));
+        attribute(subject, current);
+        return [...new Set([...subject].flatMap((id) => [...(owners.get(id) ?? [])]))].sort();
+    }
+    catch (error) {
+        return [`unknown author (${String(error).split("\n")[0]})`];
+    }
+}
+/**
+ * The obligation a waive of `gate` leaves on the task branch's current range. Synchronous on purpose:
+ * approve writes it into the waive row under the approval serialization without yielding, so a live
+ * daemon's boundary sees the same single append it always did. Anything not bound exactly — the
+ * waived row measured another subject, unreadable refs, unresolved authors, unreadable criteria — is
+ * recorded, never guessed, as known: false.
+ */
+export function captureOwedCheck(input) {
+    const { cwd, runId, taskId, gate, events } = input;
+    let base = "unknown", head = "unknown", subject = "unknown", patch = "unknown";
+    let patches = [];
+    let authors = [];
+    let unknownReason;
+    try {
+        head = owedGit(cwd, ["rev-parse", "--verify", `${input.taskRef}^{commit}`]).trim();
+        base = owedGit(cwd, ["merge-base", input.integrationRef, head]).trim();
+        subject = owedSubject(cwd, base, head);
+        const measured = [...events].reverse().find((e) => e.taskId === taskId && e.event === "gate-result" && e.data.gate === gate);
+        if (measured?.data.commit !== subject) {
+            throw new Error(`the waived ${gate} row measured ${String(measured?.data.commit ?? "no subject")}, not ${input.taskRef}'s range`);
+        }
+        patches = rangePatches(cwd, base, head);
+        patch = rangePatch(cwd, base, head);
+        authors = owedAuthors(events, taskId, cwd, base, head);
+        if (!authors.length || authors.some((a) => a.startsWith("unknown")))
+            throw new Error(`unresolved patch authors: ${authors.join(", ") || "none"}`);
+    }
+    catch (error) {
+        unknownReason = (error instanceof Error ? error.message : String(error)).split("\n")[0];
+    }
+    if (!Array.isArray(input.acceptance))
+        unknownReason ??= "task acceptance criteria unreadable";
+    const files = Array.isArray(input.files) && input.files.every((f) => typeof f === "string") ? input.files : undefined;
+    if (!files)
+        unknownReason ??= "task file scope unreadable";
+    if (!input.declared?.length)
+        unknownReason ??= "declared channels unreadable";
+    const criteria = Array.isArray(input.acceptance) ? owedCriteria(input.acceptance) : "unknown";
+    return {
+        version: OWED_CHECK_VERSION,
+        id: sha256(JSON.stringify([runId, taskId, gate, base, head, subject, criteria])).slice(0, 16),
+        runId, taskId, gate, base, head, subject, patch, patches, criteria, files: files ?? [], authors,
+        declared: [...(input.declared ?? [])].map(({ key, vendor }) => ({ key, vendor })), cause: input.cause,
+        evidence: `tickmarkr verify --base ${base} --task ${taskId} --record ${runId}: ${gate} passing on ${base}..${head} or on its recorded integration merge, reviewed outside the authors' vendors`,
+        disposition: "accepted-risk",
+        known: unknownReason === undefined,
+        ...(unknownReason === undefined ? {} : { unknownReason }),
+    };
+}
+/** A bound fact: a non-empty string that capture did not record as unknown. */
+const isBound = (v) => typeof v === "string" && v !== "" && !v.startsWith("unknown");
+/** Every required field present and well-typed; anything else is malformed evidence, never a known check. */
+const isOwedCheck = (value, taskId, gate) => {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const o = value;
+    return o.version === OWED_CHECK_VERSION && o.known === true && o.disposition === "accepted-risk"
+        && o.taskId === taskId && o.gate === gate && GATE_NAMES.includes(o.gate)
+        && [o.id, o.runId, o.taskId, o.base, o.head, o.subject, o.patch, o.criteria].every(isBound)
+        && typeof o.cause === "string" && typeof o.evidence === "string"
+        && Array.isArray(o.patches) && o.patches.every(isBound)
+        && Array.isArray(o.authors) && o.authors.length > 0 && o.authors.every(isBound)
+        && Array.isArray(o.files) && o.files.every((f) => typeof f === "string")
+        && Array.isArray(o.declared) && o.declared.length > 0 && o.declared.every(isChannelFact);
+};
+const providerOf = (fact) => modelProvider(fact.key.slice(fact.key.indexOf(":") + 1), fact.vendor);
+/** A resolved channel: an `adapter:model` key and a bound vendor — never an empty or placeholder claim. */
+const isChannelFact = (f) => typeof f === "object" && f !== null
+    && typeof f.key === "string" && /^[^:\s]+:\S+$/.test(f.key) && isBound(f.vendor);
+/**
+ * The trusted channel identities, key → vendors: what this repository's adapters declared under its config
+ * when the waive was written, recorded on the obligation by approve. Declaration, not doctor health — a
+ * later logout does not revoke a proof, but a seat not declared (or declared under another vendor) never
+ * resolved. Read from the row, the fold resolves identically in every process and every checkout.
+ */
+const declaredVendors = (o) => {
+    const vendors = new Map();
+    for (const c of o.declared)
+        vendors.set(c.key, (vendors.get(c.key) ?? new Set()).add(c.vendor));
+    return vendors;
+};
+/** Why a discharge row no longer proves its obligation, re-read from its artifact; undefined when it does. */
+function dischargeProblem(row, o, events, cwd, memo) {
+    const d = row.data;
+    if (row.taskId !== o.taskId)
+        return "discharge names another task";
+    if (d.criteria !== o.criteria)
+        return "discharge proved other criteria";
+    const exact = d.mapping === "exact" && d.mergeBase === o.base && d.head === o.head;
+    // The integration mapping is re-proved from git on every fold, never taken from the row's claims.
+    const integration = d.mapping === "integration" && integrationMapped(cwd, events, o, d.mergeBase, d.head, memo);
+    if (!exact && !integration)
+        return "discharge range does not bind the obligation";
+    let artifact;
+    try {
+        const bytes = readFileSync(String(d.artifactPath));
+        if (createHash("sha256").update(bytes).digest("hex") !== d.artifactSha256)
+            return "artifact hash mismatch";
+        artifact = JSON.parse(bytes.toString("utf8")) ?? {};
+    }
+    catch {
+        return "artifact unavailable";
+    }
+    if (artifact.head !== d.head || artifact.mergeBase !== d.mergeBase)
+        return "artifact measured another range";
+    if (artifact.green !== true)
+        return "artifact verdict is not green";
+    // The criteria the hash-bound evidence itself measured: the row's claim alone only repeats the obligation.
+    if (artifact.criteria !== o.criteria)
+        return "artifact measured other criteria";
+    // The scope the waived task declared, exactly: a wider allowlist (--files '*') is weakened evidence.
+    if (JSON.stringify(artifact.files) !== JSON.stringify(o.files))
+        return "artifact gated another file scope";
+    const rows = (Array.isArray(artifact.gateRows) ? artifact.gateRows : []);
+    const gateRow = rows.find((r) => r?.gate === o.gate && r.pass === true && r.meta?.skipped !== true);
+    if (!gateRow)
+        return `artifact holds no passing ${o.gate} row`;
+    if (o.gate === "review") {
+        const reviewer = d.reviewer;
+        const authors = Array.isArray(d.authorChannels) ? d.authorChannels : [];
+        // The row's reviewer must be the seat the hash-bound review row recorded — key, vendor and provider.
+        if (!isChannelFact(reviewer) || gateRow.meta?.reviewer !== reviewer.key || gateRow.meta.vendor !== reviewer.vendor
+            || gateRow.meta.provider !== providerOf(reviewer))
+            return "unresolved reviewer";
+        // ...and a channel the waive recorded as declared under exactly that vendor: agreement between the row
+        // and the artifact only repeats a claim, so identity and vendor resolve against the obligation's own.
+        const declared = declaredVendors(o);
+        const resolves = (f) => { const v = declared.get(f.key); return v?.size === 1 && v.has(f.vendor); };
+        // An author key stays excluded whatever vendor any row claims for it.
+        if (o.authors.includes(reviewer.key))
+            return "same-vendor reviewer (the reviewer is a recorded patch author)";
+        if (!resolves(reviewer))
+            return "unresolved reviewer (no declared channel with that identity and vendor)";
+        if (!authors.every(isChannelFact) || !o.authors.every((key) => authors.some((a) => a.key === key)))
+            return "unresolved author channel";
+        if (authors.some((a) => authors.some((b) => a.key === b.key && a.vendor !== b.vendor)))
+            return "unresolved author channel (inconsistent vendor claims)";
+        if (!authors.every(resolves))
+            return "unresolved author channel (no declared channel with that identity and vendor)";
+        if (authors.some((a) => a.vendor === reviewer.vendor || providerOf(a) === providerOf(reviewer)))
+            return "same-vendor reviewer";
+    }
+    return undefined;
+}
+/**
+ * The CURRENT owed-check fold: accepted-risk history, outstanding debt, and whether it is known.
+ * `cwd` is any checkout of the run's repository (integration discharges are re-proved from git).
+ * It never throws: a fold that cannot be computed is unknown debt, not a crash and never zero.
+ * `memo` (I2, optional): a store-scoped table reusing the immutable git re-proof of an integration mapping
+ * across folds; every artifact, hash, criteria and reviewer condition is still re-read on every fold.
+ */
+export function foldOwedChecks(events, cwd, memo) {
+    try {
+        return foldOwedChecksOrThrow(events, cwd, memo);
+    }
+    catch (error) {
+        return { known: false, debt: "unknown", outstanding: [], acceptedRisk: [], discharged: [], unknown: [{ reason: `owed-check fold failed: ${String(error).split("\n")[0]}` }] };
+    }
+}
+function foldOwedChecksOrThrow(events, cwd, memo) {
+    const accepted = new Map();
+    const discharged = new Set();
+    const unknown = [];
+    for (const e of effectiveEvents(events)) {
+        if (e.event === "task-approved" && e.data.release === GATE_SATISFIED_RELEASE) {
+            const o = e.data.obligation;
+            if (isOwedCheck(o, e.taskId, e.data.gate))
+                accepted.set(o.id, o);
+            else {
+                const recorded = typeof o === "object" && o !== null ? o.unknownReason : undefined;
+                unknown.push({ taskId: e.taskId, gate: String(e.data.gate), reason: o === undefined ? "legacy waiver without an owed-check obligation"
+                        : typeof recorded === "string" ? recorded : "malformed owed-check obligation" });
+            }
+        }
+        else if (e.event === OWED_DISCHARGE_EVENT) {
+            const ids = Array.isArray(e.data.ids) ? e.data.ids : [];
+            const problems = ids.map((id) => {
+                const o = accepted.get(String(id));
+                return o ? dischargeProblem(e, o, events, cwd, memo) : "discharge names no recorded obligation";
+            });
+            const problem = ids.length ? problems.find((p) => p !== undefined) : "discharge names no obligation";
+            if (problem)
+                unknown.push({ taskId: e.taskId, reason: problem });
+            else
+                for (const id of ids)
+                    discharged.add(String(id));
+        }
+    }
+    const acceptedRisk = [...accepted.values()];
+    const outstanding = acceptedRisk.filter((o) => !discharged.has(o.id));
+    const known = unknown.length === 0;
+    return { known, debt: known ? outstanding.length : "unknown", outstanding, acceptedRisk, discharged: [...discharged], unknown };
+}

package/dist/run/launchservices-check.d.ts

@@ -0,0 +1,56 @@
+import { spawn } from "node:child_process";
+import type { AuthHealth, LaunchServicesRecord } from "../adapters/types.js";
+/**
+ * v2.6.5 T10 (A1, D-787/D-789): did launchservicesd restart since tickmarkr last looked?
+ *
+ * On 2026-09-30 a heavy local suite exhausted launchservicesd's Mach port space (0x1000600b); the daemon
+ * crashed, respawned with an empty app registry, and every GUI app launched before it read "not open
+ * anymore". The tell is the daemon's own identity: a young pid/start beside an old Dock and Finder.
+ * doctor and standalone verify read that identity with one bounded /bin/ps call, compare it with the
+ * one the FIRST doctor.json record holds (registry order — no new state file or adapter row), and
+ * persist one advisory on a change. Unreadable evidence is unknown: the prior identity is kept, never
+ * replaced by a guess. Advisory only — verdicts, retries and routing never read it.
+ */
+export declare const LAUNCHSERVICES_PROBE_CEILING_MS = 5000;
+export interface LaunchServicesIdentity {
+    pid: number;
+    start: string;
+}
+export type LaunchServicesObservation = {
+    status: "non-darwin";
+} | {
+    status: "read";
+    identity: LaunchServicesIdentity;
+} | {
+    status: "unreadable";
+    detail: string;
+};
+/** The closed identity table; "first" is the baseline row when no prior identity is held. */
+export type LaunchServicesStatus = "first" | "unchanged" | "changed-pid" | "changed-start" | "unreadable" | "non-darwin" | "skipped";
+/** Exactly one launchservicesd row, or null (absent, ambiguous or malformed output is unknown). */
+export declare function parsePsIdentity(stdout: string): LaunchServicesIdentity | null;
+export type ProbeTimer = (fire: () => void, ms: number) => () => void;
+interface ProbeSeam {
+    platform: NodeJS.Platform;
+    spawn: typeof spawn;
+    setTimer: ProbeTimer;
+    signal?: AbortSignal;
+}
+export declare const setLaunchServicesProbeForTests: (s: Partial<ProbeSeam>) => void;
+export declare const resetLaunchServicesProbeForTests: () => void;
+export declare function observeLaunchServices(s?: ProbeSeam): Promise<LaunchServicesObservation>;
+export declare function launchServicesAdvisory(prior: LaunchServicesIdentity, now: LaunchServicesIdentity): string;
+/** Pure: the table row for one observation against the held record, and the record to hold next. */
+export declare function classifyLaunchServices(prior: Partial<LaunchServicesRecord> | undefined, observed: LaunchServicesObservation): {
+    status: LaunchServicesStatus;
+    next?: LaunchServicesRecord;
+    line?: string;
+};
+/** Observe, classify against the first record of `prior`, and hold the result on the first record of `health`.
+ *  Returns `health` itself when nothing changed, else a copy — the argument is never mutated. */
+export declare function recordLaunchServices(prior: Record<string, AuthHealth> | null, health: Record<string, AuthHealth>): Promise<{
+    status: LaunchServicesStatus;
+    health: Record<string, AuthHealth>;
+    line?: string;
+}>;
+export {};

package/dist/run/launchservices-check.js

@@ -0,0 +1,117 @@
+import { spawn } from "node:child_process";
+import { basename } from "node:path";
+/**
+ * v2.6.5 T10 (A1, D-787/D-789): did launchservicesd restart since tickmarkr last looked?
+ *
+ * On 2026-09-30 a heavy local suite exhausted launchservicesd's Mach port space (0x1000600b); the daemon
+ * crashed, respawned with an empty app registry, and every GUI app launched before it read "not open
+ * anymore". The tell is the daemon's own identity: a young pid/start beside an old Dock and Finder.
+ * doctor and standalone verify read that identity with one bounded /bin/ps call, compare it with the
+ * one the FIRST doctor.json record holds (registry order — no new state file or adapter row), and
+ * persist one advisory on a change. Unreadable evidence is unknown: the prior identity is kept, never
+ * replaced by a guess. Advisory only — verdicts, retries and routing never read it.
+ */
+export const LAUNCHSERVICES_PROBE_CEILING_MS = 5_000;
+// lstart in the C locale: "Wed Sep 30 21:54:33 2026"; comm is the executable path on Darwin.
+const PS_ARGS = ["-A", "-o", "pid=,lstart=,comm="];
+const PS_LINE = /^\s*(\d+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+?)\s*$/;
+const MAX_PS_BYTES = 4 * 1024 * 1024;
+/** Exactly one launchservicesd row, or null (absent, ambiguous or malformed output is unknown). */
+export function parsePsIdentity(stdout) {
+    const rows = stdout.split("\n").flatMap((line) => {
+        const m = PS_LINE.exec(line);
+        return m && basename(m[3]) === "launchservicesd" ? [{ pid: Number(m[1]), start: m[2].replace(/\s+/g, " ") }] : [];
+    });
+    return rows.length === 1 ? rows[0] : null;
+}
+const production = () => ({
+    platform: process.platform,
+    spawn,
+    setTimer: (fire, ms) => { const t = setTimeout(fire, ms); return () => clearTimeout(t); },
+});
+// ponytail: default-off under the test runner (the catalogRefreshAllowed precedent) so an unowned doctor
+// test never takes a real host reading or changes its doctor.json bytes; tests opt in through the seam.
+let seam;
+export const setLaunchServicesProbeForTests = (s) => { seam = { ...production(), ...s }; };
+export const resetLaunchServicesProbeForTests = () => { seam = undefined; };
+const activeSeam = () => seam ?? (process.env.VITEST === "true" ? undefined : production());
+/** One /bin/ps call that owns only its child, killed at the ceiling or on cancellation and reaped before it resolves. */
+function readIdentity(s) {
+    return new Promise((resolve) => {
+        const unknown = (detail) => resolve({ status: "unreadable", detail });
+        if (s.signal?.aborted) {
+            unknown("probe cancelled");
+            return;
+        }
+        let child;
+        try {
+            child = s.spawn("/bin/ps", PS_ARGS, { stdio: ["ignore", "pipe", "ignore"], env: { ...process.env, LC_ALL: "C" } });
+        }
+        catch (e) {
+            unknown(`/bin/ps did not start (${e instanceof Error ? e.message : String(e)})`);
+            return;
+        }
+        let out = "";
+        let why;
+        const retire = (reason) => { why ??= reason; child.kill("SIGKILL"); };
+        const clear = s.setTimer(() => retire(`/bin/ps exceeded the ${LAUNCHSERVICES_PROBE_CEILING_MS} ms kill ceiling`), LAUNCHSERVICES_PROBE_CEILING_MS);
+        const cancel = () => retire("probe cancelled");
+        s.signal?.addEventListener("abort", cancel, { once: true });
+        child.stdout?.on("data", (chunk) => {
+            out += chunk.toString("utf8");
+            if (out.length > MAX_PS_BYTES)
+                retire("/bin/ps output exceeded its bound");
+        });
+        child.once("error", (e) => { why ??= `/bin/ps failed (${e.message})`; });
+        child.once("close", (code) => {
+            clear();
+            s.signal?.removeEventListener("abort", cancel);
+            if (why)
+                return unknown(why);
+            if (code !== 0)
+                return unknown(`/bin/ps exited ${code}`);
+            const identity = parsePsIdentity(out);
+            return identity ? resolve({ status: "read", identity }) : unknown("no single launchservicesd row in /bin/ps output");
+        });
+    });
+}
+export function observeLaunchServices(s = production()) {
+    return s.platform === "darwin" ? readIdentity(s) : Promise.resolve({ status: "non-darwin" });
+}
+// doctor.json is never schema-validated: a malformed held record is no identity at all.
+const knownPrior = (prior) => typeof prior?.pid === "number" && typeof prior.start === "string";
+export function launchServicesAdvisory(prior, now) {
+    return `launchservicesd restarted: pid ${prior.pid} → ${now.pid}, started ${prior.start} → ${now.start}. `
+        + `GUI apps launched before ${now.start} may read "not open anymore" (D-787: the daemon crashed and respawned with an empty app registry). `
+        + `Remedy: quit and relaunch each affected app, or log out / restart the Mac (a restart ends agent sessions and wipes /private/tmp); `
+        + `confirm with /usr/bin/log show (launchservicesd 0x1000600b near ${now.start}) and ~/Library/Logs/DiagnosticReports/ExcUserFault_node-*.ips (advisory — verdicts unchanged)`;
+}
+/** Pure: the table row for one observation against the held record, and the record to hold next. */
+export function classifyLaunchServices(prior, observed) {
+    const kept = knownPrior(prior) ? prior : undefined;
+    if (observed.status === "non-darwin")
+        return { status: "non-darwin", next: kept };
+    if (observed.status === "unreadable") {
+        const held = kept ? `pid ${kept.pid} started ${kept.start}` : "none";
+        return { status: "unreadable", next: kept, line: `launchservicesd identity unknown — ${observed.detail}; prior identity (${held}) retained (advisory — verdicts unchanged)` };
+    }
+    const now = observed.identity;
+    if (!knownPrior(prior))
+        return { status: "first", next: now };
+    const status = prior.pid !== now.pid ? "changed-pid" : prior.start !== now.start ? "changed-start" : "unchanged";
+    if (status === "unchanged")
+        return { status, next: prior };
+    const advisory = launchServicesAdvisory(prior, now);
+    return { status, next: { ...now, advisory }, line: advisory };
+}
+/** Observe, classify against the first record of `prior`, and hold the result on the first record of `health`.
+ *  Returns `health` itself when nothing changed, else a copy — the argument is never mutated. */
+export async function recordLaunchServices(prior, health) {
+    const held = prior ? Object.values(prior)[0]?.launchServices : undefined;
+    const s = activeSeam();
+    const r = s ? classifyLaunchServices(held, await observeLaunchServices(s)) : { status: "skipped", next: knownPrior(held) ? held : undefined };
+    const holder = Object.keys(health)[0];
+    if (!holder || !r.next || JSON.stringify(health[holder].launchServices) === JSON.stringify(r.next))
+        return { ...r, health };
+    return { ...r, health: { ...health, [holder]: { ...health[holder], launchServices: r.next } } };
+}

package/dist/run/operator-state.d.ts

@@ -1,5 +1,5 @@
 import { type RunGraph } from "../graph/schema.js";
-import { type JournalEvent } from "./journal.js";
+import { type JournalEvent, type OwedFold } from "./journal.js";
 /** An evidence identity is a physical journal line, never a filtered row ordinal. */
 export interface EvidenceIdentity {
     source: string;
@@ -74,6 +74,15 @@ export interface OperatorSnapshot {
     };
     latestRunEnd?: EvidenceIdentity;
     approvedResumeRequired: boolean;
+    /** I2: CURRENT owed-check debt from the authority this observation supplied; "unknown" when absent or stale. */
+    debt: number | "unknown";
+    outstanding: readonly string[];
+}
+/** I2: foldOwedChecks over the complete effective journal, tagged with the journal basis it read. A result
+ * whose basis is not the observation's own is stale and counts as unknown debt, never as zero. */
+export interface OwedAuthority {
+    basis: string;
+    fold: OwedFold;
 }
 /** Author channels recorded on a task-done row. A row written before authors were recorded carries none and
  * projects nothing (never the dispatch); unattributed preserved work arrives as an explicit "unknown" entry. */
@@ -99,12 +108,20 @@ export declare class OperatorStateFold {
     private total;
     apply(record: OperatorRecord): void;
     private task;
-    snapshot({ graph, sequence, observedAt, readable, graphAvailability }?: {
+    /** A run-end is the latest lifecycle boundary: the only state whose headline consults owed-check debt. */
+    get ended(): boolean;
+    /** `daemonDead`: this run's lock holder was observed provably dead (lock.ts liveness). It is an observation,
+     * not a journal row, so it settles the projection only and the fold keeps no trace of it.
+     * `owed`/`basis` (I2): COMPLETE needs a known-empty debt computed over this very journal basis. */
+    snapshot({ graph, sequence, observedAt, readable, graphAvailability, daemonDead, owed, basis }?: {
         graph?: RunGraph;
         sequence?: number;
         observedAt?: number;
         readable?: boolean;
         graphAvailability?: OperatorSnapshot["graphAvailability"];
+        daemonDead?: boolean;
+        owed?: OwedAuthority;
+        basis?: string;
     }): OperatorSnapshot;
     private comparableTo;
 }
@@ -116,4 +133,7 @@ export declare function readOperatorState({ events, source, ...options }: {
     sequence?: number;
     observedAt?: number;
     readable?: boolean;
+    daemonDead?: boolean;
+    owed?: OwedAuthority;
+    basis?: string;
 }): OperatorSnapshot;