tickmarkr 2.6.4 → 2.6.5

package/dist/cli/commands/fleet.js

@@ -363,20 +363,34 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const channels = discoverChannels(cfg, adapters, health);
     const profile = loadRoutingProfile(cwd, cfg, { preview: true });
     const stagedDenyOf = (editable) => Object.fromEntries(DENY_SCOPES.map((scope) => [stagedDenyKeyOf(scope), editable[scope.key] ?? []]));
-    // B2: the classifications and efforts of the last reviewed state — the preview callbacks carry mode,
-    // map and deny only (fleet-app's contract), so every preview after a review ranks the same fully
-    // staged candidate that review rendered, never the assembly-time tiers.
-    // ponytail: one staged after the last review reaches previews at the next w; thread classifications
-    // and efforts through fleet-app's preview callbacks if that lag ever matters.
+    // T8: staged classifications and efforts as the editable tiers/efforts a review writes — one fold for
+    // the review and every preview, so the mode/shape/picker callbacks rank exactly what w would write.
+    const stagedMetadataOf = (stage) => {
+        const tiers = structuredClone(initial.tiers);
+        const today = new Date().toISOString().slice(0, 10);
+        for (const classification of stage.classifications) {
+            tiers[classification.adapter] ??= {};
+            tiers[classification.adapter][classification.model] = {
+                tier: classification.tier,
+                provenance: `${classification.note} — fleet ${today}`,
+            };
+        }
+        // OBS-1182: staged efforts replace the loaded ones; none staged anywhere ⇒ no key, as loaded
+        const efforts = Object.fromEntries(Object.entries(stage.efforts ?? {}).filter(([, models]) => Object.keys(models).length));
+        return { tiers, ...(Object.keys(efforts).length ? { efforts } : {}) };
+    };
+    // B2: the classifications and efforts of the last reviewed state — what a preview called without a
+    // stage (the browser's staged routing, --why) ranks; the editor passes its current stage (T8).
     let reviewedStage = { tiers: initial.tiers, efforts: initial.efforts };
     // OBS-1182: the layers under the written overlay — B2: the defaults alone under the USER overlay —
     // read raw, so clearing an effort masks an inherited one. OBS-1188: re-read at every review and
     // save, never an assembly-time snapshot; an unreadable read keeps the last good one for the
     // preview only — the save guard below refuses it.
     let lowerOverrides = {};
-    const stagedEditable = (map, deny) => ({
+    const stagedEditable = (map, deny, metadata) => ({
         ...structuredClone(initial),
-        ...structuredClone(reviewedStage),
+        efforts: undefined, // metadata carries efforts only when some are staged — as a review writes them
+        ...structuredClone(metadata),
         ...Object.fromEntries(DENY_SCOPES.map((scope) => [scope.key, deny[stagedDenyKeyOf(scope)]])),
         // OBS-1046: the allow complement is staged beside the deny lists, never folded into them
         allowOut: deny.allowOut ?? initial.allowOut,
@@ -424,14 +438,17 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     };
     // B2: a changed slot staged with no declaration (auto, no prefer) where the defaults under the user
     // overlay declare one: deleting the user's pin/pool would restore that default, so the slot is
-    // masked with prefer: [] — a declaration that replaces the lower slot atomically and ranks nothing
+    // masked with prefer: [] — a declaration that replaces the lower slot atomically and ranks nothing.
+    // T8: a default PIN is masked by the writer's raw pin: null tombstone instead (lowerMap below), so
+    // Auto saves no prefer declaration the operator never made.
     const maskClearedSlots = (base, staged) => {
         const map = { ...staged.map };
         for (const shape of new Set([...Object.keys(base.map), ...Object.keys(staged.map)])) {
             const entry = staged.map[shape];
+            const lower = mapSlot(DEFAULT_CONFIG.routing.map[shape]);
             if (JSON.stringify(base.map[shape]) === JSON.stringify(entry))
                 continue;
-            if (Object.keys(mapSlot(entry)).length || !Object.keys(mapSlot(DEFAULT_CONFIG.routing.map[shape])).length)
+            if (Object.keys(mapSlot(entry)).length || !Object.keys(lower).length || lower.pin)
                 continue;
             map[shape] = { ...entry, prefer: [] };
         }
@@ -449,6 +466,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             try {
                 const bytes = renderFleetOverlayWrite(userText, {
                     ...rest, initial: destinationInitial(initial, unchanged, userText, universe), edited: unchanged, universe,
+                    lowerMap: DEFAULT_CONFIG.routing.map,
                 });
                 const candidate = loadConfigWithMode(cwd, { globalDir, userOverlayText: bytes }).cfg;
                 target = universeOf(candidateChannels(candidate));
@@ -461,20 +479,23 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 // the full render below (or the reload guard) names the refusal
             }
         }
-        return { ...rest, initial: destinationInitial(initial, edited, userText, target), edited, universe: target };
+        // T8: the user overlay's lower layer is the defaults alone (B2) — a pin cleared over one is tombstoned
+        return { ...rest, initial: destinationInitial(initial, edited, userText, target), edited, universe: target, lowerMap: DEFAULT_CONFIG.routing.map };
     };
     const candidateMemo = new Map();
-    const previewCfg = (mode, map, deny) => {
+    const previewCfg = (mode, map, deny, stage) => {
         // B2: the user and repo overlay bytes are part of the key — a layer edited mid-session (a repo
-        // deny added before a review) re-renders the preview instead of serving the pre-edit one
+        // deny added before a review) re-renders the preview instead of serving the pre-edit one.
+        // T8: so are the staged tiers/efforts — a metadata edit never serves the preview cached before it
+        const metadata = stage ? stagedMetadataOf(stage) : reviewedStage;
         const userText = currentUserText();
-        const key = JSON.stringify([mode, map, deny, userText, currentRepoOverlayText(cwd)]);
+        const key = JSON.stringify([mode, map, deny, metadata, userText, currentRepoOverlayText(cwd)]);
         const hit = candidateMemo.get(key);
         if (hit)
             return hit;
         let preview;
         try {
-            const bytes = renderFleetOverlayWrite(userText, userLayerWrite(stagedEditable(map, deny), userText, {
+            const bytes = renderFleetOverlayWrite(userText, userLayerWrite(stagedEditable(map, deny, metadata), userText, {
                 lowerOverrides,
                 ...(mode !== rm.mode.mode ? { mode } : {}),
             }));
@@ -509,12 +530,12 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     // route() never deny-filters its pool — that contract lives in discoverChannels — so every
     // preview call rebuilds the pool the staged deny would discover
     const previewPool = (cfgPreview) => candidateChannels(cfgPreview).filter((c) => disallowedBy(c, cfgPreview.routing) === null);
-    const modeSpend = (mode, map, deny) => {
+    const modeSpend = (mode, map, deny, stage) => {
         const tierCount = {};
         let subs = 0;
         let apiN = 0;
         let apiUsd = 0;
-        const preview = previewCfg(mode, map, deny);
+        const preview = previewCfg(mode, map, deny, stage);
         if (!preview.ok)
             return `  mix: ${previewUnavailable(preview.error)}`;
         const cfgPreview = preview.cfg;
@@ -547,10 +568,10 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     };
     // B2: the floors the candidate user-layer bytes resolve to — the same config the routed mix ranks
     // against, so a repo-declared mode that shadows the user's pick previews no floor change
-    const floorPreview = (mode, map, deny) => {
+    const floorPreview = (mode, map, deny, stage) => {
         if (mode === rm.mode.mode)
             return [];
-        const preview = previewCfg(mode, map, deny);
+        const preview = previewCfg(mode, map, deny, stage);
         if (!preview.ok)
             return []; // modeSpend names the refusal
         const current = cfg.routing.floors;
@@ -585,8 +606,8 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             ? { declaredAt: `routing.floors.${shape}` }
             : { declaredAt: "routing.mode" };
     };
-    const projectedShapeRows = (mode, map, deny) => {
-        const preview = previewCfg(mode, map, deny);
+    const projectedShapeRows = (mode, map, deny, stage) => {
+        const preview = previewCfg(mode, map, deny, stage);
         if (!preview.ok) {
             return projectFleetWhy(SHAPES.map((shape) => ({
                 id: shape,
@@ -611,7 +632,9 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 // a pin. The declaration is the operator's decision; the winner is today's dice.
                 const declaredPool = entry?.pool;
                 const poolPrefix = declaredPool ? `pool(${declaredPool.mode}·${declaredPool.channels.length}) → ` : "";
-                const effective = `${poolPrefix}${assignment.adapter}:${assignment.model} (${assignment.channel}, ${assignment.tier})  ${costSignal(assignment, cfgPreview.pricing)}${shadowNote}`;
+                // T8: the launch effort the routed channel carries — a staged effort shows here before w
+                const effort = assignment.effort ? `, effort ${assignment.effort}` : "";
+                const effective = `${poolPrefix}${assignment.adapter}:${assignment.model} (${assignment.channel}, ${assignment.tier}${effort})  ${costSignal(assignment, cfgPreview.pricing)}${shadowNote}`;
                 const mapProducedValue = entry?.pin !== undefined || entry?.pool !== undefined
                     || routed.provenance.includes("via prefer");
                 return {
@@ -633,7 +656,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         });
         return projectFleetWhy(values, { repoRoot: cwd, globalDir });
     };
-    const routedShapeRows = (mode, map, deny) => projectedShapeRows(mode, map, deny).map(({ id, label }) => ({ id, label }));
+    const routedShapeRows = (mode, map, deny, stage) => projectedShapeRows(mode, map, deny, stage).map(({ id, label }) => ({ id, label }));
     // OBS-530: the picker silently omitted every excluded channel — the operator asked "why is X
     // missing" three times in one session and the answer lived only in config archaeology. One dim
     // line now names each bucket. Static buckets (unauthed, unclassified) computed once; the
@@ -802,8 +825,8 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         const order = (key) => (carried.includes(key) ? carried.indexOf(key) : carried.length);
         return [...lines, ...unnamed].sort((a, b) => order(a.key) - order(b.key)).map((row) => row.line);
     };
-    const candidatesForShape = (shape, mode, map, deny) => {
-        const preview = previewCfg(mode, map, deny);
+    const candidatesForShape = (shape, mode, map, deny, stage) => {
+        const preview = previewCfg(mode, map, deny, stage);
         if (!preview.ok)
             return { rows: [], excludedNote: previewUnavailable(preview.error) };
         const cfgPreview = preview.cfg;
@@ -882,21 +905,13 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             staged[scope.key] = state[scope.key];
         staged.allowOut = state.allowOut ?? initial.allowOut;
         staged.map = state.map;
-        // OBS-1182: staged efforts replace the loaded ones; none staged anywhere ⇒ no key, as loaded
-        const efforts = Object.fromEntries(Object.entries(state.efforts ?? {}).filter(([, models]) => Object.keys(models).length));
-        if (Object.keys(efforts).length)
-            staged.efforts = efforts;
+        const metadata = stagedMetadataOf(state);
+        staged.tiers = metadata.tiers;
+        if (metadata.efforts)
+            staged.efforts = metadata.efforts;
         else
             delete staged.efforts;
-        const today = new Date().toISOString().slice(0, 10);
-        for (const classification of state.classifications) {
-            staged.tiers[classification.adapter] ??= {};
-            staged.tiers[classification.adapter][classification.model] = {
-                tier: classification.tier,
-                provenance: `${classification.note} — fleet ${today}`,
-            };
-        }
-        reviewedStage = { tiers: staged.tiers, efforts: staged.efforts };
+        reviewedStage = metadata;
         // This callback is the sole candidate-overlay builder. The Ink component renders
         // the diff and asks for confirmation, but owns neither filesystem access nor a writer.
         // B2: defaults/user/repo are re-read here, at review — the destination is the user overlay.
@@ -971,7 +986,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         initialMode: rm.mode.mode,
         modeOptions: ROUTING_MODES.map((mode) => ({ id: mode, gloss: MODE_GLOSS[mode] })),
         initialMap: editable.map,
-        modePreview: (mode, map, deny) => [modeSpend(mode, map, deny), ...floorPreview(mode, map, deny)],
+        modePreview: (mode, map, deny, stage) => [modeSpend(mode, map, deny, stage), ...floorPreview(mode, map, deny, stage)],
         shapeRows: routedShapeRows,
         candidatesForShape,
         preferOptionsForShape: (_shape, current) => [
@@ -1050,5 +1065,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         props,
         commit,
         renderWhy: () => renderFleetWhy(projectedShapeRows(rm.mode.mode, editable.map, stagedDenyOf(editable))),
+        // T8: the memoized candidate every preview callback ranks — read-only, so its identity is checkable
+        previewConfig: previewCfg,
     };
 }

package/dist/cli/commands/init.js

@@ -132,7 +132,11 @@ you were handed the whole picture — list the repository root, open every guida
 - **The gates are the product.** Seven, defined in \`src/graph/schema.ts\`:
   \`build test lint evidence scope acceptance review\`. **That is DECLARATION order, not execution order** —
   the first five run as a battery that stops at its first red, then \`acceptance\` and \`review\` run
-  CONCURRENTLY (\`run-gates.ts:39\`, *"judge ‖ review"*). The first five are MANDATORY; only \`acceptance\` and
+  CONCURRENTLY (\`run-gates.ts:39\`, *"judge ‖ review"*). One repair reorders them: a repair the REVIEW sent
+  back (carried \`review:material\`, test selection on, no required repair test) runs build, lint, evidence and
+  scope, then \`acceptance\` ‖ \`review\`, then its test screen, so a review that re-reds an unchanged subject
+  starts no test at all; a test-red repair keeps the battery first. Either way nothing merges until the FULL
+  suite has passed on the merge-candidate commit. The first five are MANDATORY; only \`acceptance\` and
   \`review\` may be omitted per task. Implementations are in \`src/gates/\` — \`baseline.ts\` (build/test/lint,
   diffed against a recorded baseline so pre-existing failures are forgiven), \`evidence.ts\`, \`scope.ts\`,
   \`acceptance.ts\` (its judge reads the DIFF and every criterion must cite a changed hunk), \`review.ts\`

package/dist/cli/commands/plan.js

@@ -2,6 +2,7 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { parseArgs } from "node:util";
 import { allAdapters, doctorAgeMs, modelAuthExclusions, probeAll, readDoctor, rolePools, servableExclusions, servabilityLine } from "../../adapters/registry.js";
+import { aliasIdentityHeadlines } from "../../adapters/model-discovery-check.js";
 import { formatModelAuthLine, contextWindowLints, modelLints, preferEntryLints, ttyVisual } from "../../adapters/model-lints.js";
 import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
@@ -15,9 +16,10 @@ import { disallowedBy, excludedChannels, exclusionLine, observedSeat, routingEnt
 import { decayWeight, HALF_LIFE_RUNS, staffLedEvidence } from "../../route/profile.js";
 import { resolvedFloor, route, RoutingError } from "../../route/router.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
-import { modelId, modelProvider, pickReviewer } from "../../gates/review.js";
+import { carriedAuthorVendors, gateReviewerFloor, modelId, modelProvider, pickReviewer } from "../../gates/review.js";
 import { Journal, loadRoutingProfile, readProfileCursor, recordedGraphDefinitionHash, RUNS_WINDOW } from "../../run/journal.js";
 import { harnessLine, resolveHarness } from "../harness.js";
+import { codexCommitHeadline } from "../../adapters/codex-commit-check.js";
 import { channelKey, shq } from "../../adapters/types.js";
 import { shGit } from "../../run/git.js";
 import { runLockRunId, runStatusLine } from "../../run/lock.js";
@@ -135,6 +137,13 @@ async function taskInputFindings(tasks, cwd) {
     }
     return findings;
 }
+/**
+ * v2.6.5 T9 (D-862): a task the run never dispatched gates under the fresh route's author, so plan can
+ * mirror its review eligibility exactly. Once dispatched, resume state only the daemon decides (a restored
+ * or failed-over author, a tier climb, carried commits, a parked recheck) picks the author — fail closed.
+ * ponytail: unknown, not exact; call production's own resume functions once daemon.ts can export them (POOL).
+ */
+const resumeDecidesAuthor = (events, taskId) => events.some((row) => row.taskId === taskId && row.event === "task-dispatch");
 // v1.89 T4: harnessFrom is the resolver's INPUT — a caller (the byte-pinned goldens) fixes the location
 // and keeps this machine's absolute paths out of a fixture. The default is the INVOKED entrypoint,
 // `process.argv[1]`: the bin symlink a global install puts on PATH, which resolves to dist/cli/index.js.
@@ -183,6 +192,26 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             .filter((event) => event.event === "gate-result" && event.data.gate === "review" && typeof event.data.reviewer === "string")
             .map((event) => event.data.reviewer)
         : [];
+    // daemon.ts replayedReviewerExclusions: a journaled review-pool-demotion is excluded from every review
+    // pick of the resumed run this plan previews (reviewer role only).
+    const replayedReviewerExclusions = [...new Set((matchingEvents ?? [])
+            .filter((event) => event.event === "review-pool-demotion" && typeof event.data.reviewer === "string")
+            .map((event) => event.data.reviewer))];
+    const demotedReviewers = new Set(replayedReviewerExclusions);
+    // daemon.ts demotedChannels: the resumed run's worker exclusions (journal replayExcludedChannels).
+    const runJournal = matchingRunId ? Journal.open(cwd, matchingRunId) : undefined;
+    const demotedWorkers = runJournal?.replayExcludedChannels() ?? new Set();
+    // run-gates.ts retired (OBS-1025 add.2): seats with two no-verdicts this run are out of every pick, tallied
+    // as daemon.ts seeds reviewNoVerdicts — noVerdict rows only, and a checkout-proof timeout never strikes.
+    const noVerdicts = new Map();
+    for (const event of matchingEvents ?? []) {
+        if (event.event !== "review-no-verdict" || event.data.noVerdict !== true || typeof event.data.reviewer !== "string")
+            continue;
+        if (event.data.cause === "seat-launch-failed" && event.data.launchCause === "checkout-proof-timeout")
+            continue;
+        noVerdicts.set(event.data.reviewer, (noVerdicts.get(event.data.reviewer) ?? 0) + 1);
+    }
+    const retiredReviewers = [...noVerdicts].filter(([, n]) => n >= 2).map(([seat]) => seat);
     // OBS-947 repair: a resumed run re-dispatches only tasks whose replayed status is pending (or that the
     // journal never mentions). done, failed and human are all skipped alike, so rendering their preview
     // picks must not advance the shared reviewHistory — a phantom draw wraps the LRU and makes a later
@@ -243,6 +272,10 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     if (judgeDeny?.by === "deny") {
         lines.push(`REFUSAL OBS-576: judge seat ${cfg.judge.adapter}:${cfg.judge.model} is removed by flat routing.deny (${judgeDeny.entry}) — move worker-only policy to routing.deny.workers`, "");
     }
+    // v2.6.5 T9 (H): alias drift is read from the identity doctor persisted, never re-probed here.
+    const aliasHeadlines = aliasIdentityHeadlines(cfg, health);
+    if (aliasHeadlines.length)
+        lines.push(...aliasHeadlines, "");
     const entrySeats = routingEntrySeatLines(cfg);
     if (entrySeats.length)
         lines.push(...entrySeats, "");
@@ -359,9 +392,36 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             return { line: "none — reviewPolicy judge-only: declared leaf paths", cost: 0 };
         let rotationSeat = 1;
         let rotationCount = 0;
-        const reviewer = pickReviewer(author, pools.review, [], cfg.review.prefer ?? [], task.routingHints?.floor, reviewHistory, (seat, count) => { rotationSeat = seat; rotationCount = count; });
+        // Dispatched before: no count, no single-seat claim, no previewed reviewer (and so no rotation draw this
+        // plan could name). Never a guess.
+        if (resumeDecidesAuthor(matchingEvents ?? [], task.id)) {
+            lints.push(`${task.id}: eligible cross-vendor review seat count unknown — resume state decides the author`);
+            return { line: "unknown — resume state decides the author", cost: 0 };
+        }
+        // Never dispatched, daemon.ts subjectAuthors is just the fresh author; its vendor stays off the review.
+        const authors = [channelKey(author)];
+        const authorVendors = carriedAuthorVendors(pools.review, authors);
+        // Production's inputs as the task's first review round sees them: excludeReviewers = daemon badReviewers =
+        // replayedReviewerExclusions. run-gates.ts:1303 floors on THIS task's journaled reviewers at their dispatched
+        // tiers (daemon taskReviewers) ∪ excludeReviewers, so a replayed exclusion RAISES the floor; :1305 picks
+        // with excludeReviewers ∪ retired. prefer only reorders (the seat count below passes none).
+        const priorReviewers = [...(matchingEvents ?? []).filter((e) => e.taskId === task.id && typeof e.data.reviewer === "string"
+                && ((e.event === "gate-result" && e.data.gate === "review") || e.event === "review-no-verdict"))
+                .map((e) => ({ reviewer: e.data.reviewer, tier: e.data.reviewerTier })), ...replayedReviewerExclusions];
+        const reviewFloor = gateReviewerFloor(task, cfg, author, pools.review, priorReviewers).floor;
+        const exclusions = [...replayedReviewerExclusions, ...retiredReviewers];
+        const reviewer = pickReviewer(author, pools.review, exclusions, cfg.review.prefer ?? [], reviewFloor, reviewHistory, (seat, count) => { rotationSeat = seat; rotationCount = count; }, demotedReviewers, authorVendors, authors);
         if (!reviewer)
             return { line: "none — no cross-vendor reviewer available", cost: 0 };
+        // v2.6.5 T9 (H): one flaked or demoted seat away from no reviewer. Enumerate the production filter
+        // (pickReviewer at the gate's floor) and count served identities, so two aliases of one model count once.
+        const seats = [];
+        for (let s; (s = pickReviewer(author, pools.review, [...exclusions, ...seats.map(channelKey)], [], reviewFloor, [], undefined, demotedReviewers, authorVendors, authors));)
+            seats.push(s);
+        const identities = new Set(seats.map((c) => c.identity ?? modelId(c.model)));
+        if (identities.size === 1) {
+            lints.push(`${task.id}: exactly one eligible cross-vendor review seat remains — identity ${[...identities][0]} via ${seats.map(channelKey).join(", ")}; one flake or demotion leaves no reviewer`);
+        }
         // Advance the simulated rotation only for tasks the run would actually dispatch next — the same
         // rule as readyTasks (src/graph/graph.ts): pending, with every dependency already done. A pending
         // task behind a parked/failed/pending dependency cannot run, so it consumes no draw (RULING-229-14).
@@ -402,7 +462,8 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             continue;
         }
         try {
-            const r = route(t, cfg, channels, dispatchProfile);
+            // daemon.ts:3322: the resumed run routes around its replayed worker exclusions.
+            const r = route(t, cfg, channels, dispatchProfile, undefined, demotedWorkers);
             routed.push({ taskId: t.id, adapter: r.assignment.adapter, model: r.assignment.model });
             for (const l of r.lints) {
                 const suf = exclusionReason(l);
@@ -412,7 +473,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             const judge = judgeSeat(t);
             const review = reviewSeat(t, r.assignment);
             cost += est + judge.cost + review.cost;
-            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`, `    judge: ${judge.line}${judge.cost ? ` ~$${judge.cost.toFixed(2)}` : ""}`, `    review: ${review.line}${review.cost ? ` ~$${review.cost.toFixed(2)}` : ""}`, chainLine(t));
+            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`, ...[codexCommitHeadline(r.assignment.adapter, adapters, health)].filter((l) => l !== null), `    judge: ${judge.line}${judge.cost ? ` ~$${judge.cost.toFixed(2)}` : ""}`, `    review: ${review.line}${review.cost ? ` ~$${review.cost.toFixed(2)}` : ""}`, chainLine(t));
             const d = derivation(t);
             if (d)
                 lines.push(d);

package/dist/cli/commands/verify.d.ts

@@ -7,7 +7,7 @@ export declare const HUMAN_AUTHOR: Assignment;
 export declare function verifyStateDir(cwd: string): string;
 /** Linked worktrees share operational state with the repository that owns the common git dir. */
 export declare function verifyStateRoot(cwd: string): Promise<string>;
-/** Cache identity is repository content, never a checkout path. */
+/** Repository content plus the effective runner inputs the daemon hashes; never a checkout path. */
 export declare function baselineCachePath(cwd: string, baseSha: string, commands: Record<string, string>): string;
 export declare function excludeAuthorProvider(channels: BillingChannel[], author: BillingChannel): BillingChannel[];
 export declare const VERIFY_HELP = "usage: tickmarkr verify [--base <ref>] [--criteria <file> | --task <id>] [--json]\nThe final verdict and JSON result are written to stdout; progress and diagnostics are written to stderr.\nDo not merge stdout and stderr (for example with 2>&1): doing so corrupts the verdict stream.";

package/dist/cli/commands/verify.js

@@ -1,13 +1,13 @@
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, utimesSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { parseArgs } from "node:util";
-import { allAdapters, probeAll, readDoctor, rolePools } from "../../adapters/registry.js";
+import { allAdapters, probeAll, readDoctor, rolePools, writeDoctor } from "../../adapters/registry.js";
 import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
 import { captureBaseline, detectGateCommands, staleFileCountCommands } from "../../gates/baseline.js";
-import { getVerdictStore } from "../../gates/cache.js";
+import { getVerdictStore, runnerInputsHash } from "../../gates/cache.js";
 import { modelProvider } from "../../gates/review.js";
 import { runGates } from "../../gates/run-gates.js";
 import { getTask, loadGraph } from "../../graph/graph.js";
@@ -17,6 +17,7 @@ import { linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.j
 import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
 import { withRepositoryLease } from "../../run/lease.js";
 import { isPidLive } from "../../run/lock.js";
+import { recordLaunchServices } from "../../run/launchservices-check.js";
 /**
  * tickmarkr verify — the gate battery as a standalone command (OPERATING-MODEL-2026-08-11 item 3).
  *
@@ -86,7 +87,7 @@ const hashParts = (parts) => {
         hash.update(part);
     return hash.digest("hex").slice(0, 12);
 };
-/** Cache identity is repository content, never a checkout path. */
+/** Repository content plus the effective runner inputs the daemon hashes; never a checkout path. */
 export function baselineCachePath(cwd, baseSha, commands) {
     const lockParts = [];
     for (const file of LOCKFILES) {
@@ -94,7 +95,7 @@ export function baselineCachePath(cwd, baseSha, commands) {
         lockParts.push(file, existsSync(path) ? readFileSync(path) : "<absent>");
     }
     const commandParts = Object.entries(commands).sort(([a], [b]) => a.localeCompare(b)).map(([name, command]) => `${name}\0${command}\0`);
-    return join(realpathSync(tmpdir()), "tickmarkr-verify", "cache", `baseline-${baseSha.slice(0, 12)}-${hashParts(lockParts)}-${hashParts(commandParts)}.json`);
+    return join(realpathSync(tmpdir()), "tickmarkr-verify", "cache", `baseline-${baseSha.slice(0, 12)}-${hashParts(lockParts)}-${hashParts(commandParts)}-${runnerInputsHash()}.json`);
 }
 const verdictlessCommands = (baseline, commands) => Object.keys(commands).filter((name) => baseline.commands[name]?.exitCode === undefined);
 export function excludeAuthorProvider(channels, author) {
@@ -378,7 +379,7 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
             console.error(`verify: reusing cached baseline for ${mergeBase.slice(0, 12)} (${names.join(", ")}: ${cachePath})`);
             return cached;
         }
-        console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} for ${names.join(", ")} (cached by base, lockfile and command hashes at ${cachePath})`);
+        console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} for ${names.join(", ")} (cached by base, lockfile, command and effective runner hashes at ${cachePath})`);
         // Unleased captures of the SAME checkout overlap, so each owns a unique base worktree and removes
         // only its own; the pid in the name lets a later verify sweep what a killed one left behind.
         for (const entry of readdirSync(stateDir)) {
@@ -577,6 +578,27 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
             ...review,
         });
     }
+    // A1 (D-787/D-789): one bounded launchservicesd identity read AFTER the verdict is final, so a suite
+    // that restarted the daemon is caught and the verdict, exit code and retries never depend on it.
+    // It rides the doctor.json verify read; with none there it creates no state file.
+    const doctorRoot = fileRoot("doctor.json");
+    const priorDoctor = readDoctor(doctorRoot);
+    const launchServices = priorDoctor ? await recordLaunchServices(priorDoctor, priorDoctor) : undefined;
+    if (launchServices && launchServices.health !== priorDoctor) {
+        // Evidence only, not a probe: keep doctor.json's mtime (the auth-cache freshness signal, doctorAgeMs),
+        // and a failed write is an advisory diagnostic — the verdict below is returned regardless.
+        const doctorFile = join(doctorRoot, ".tickmarkr", "doctor.json");
+        try {
+            const { atime, mtime } = statSync(doctorFile);
+            writeDoctor(doctorRoot, launchServices.health);
+            utimesSync(doctorFile, atime, mtime);
+        }
+        catch (e) {
+            console.error(`verify: launchservicesd evidence not persisted (${e instanceof Error ? e.message : String(e)}) (advisory — verdict unchanged)`);
+        }
+    }
+    if (launchServices?.line)
+        console.error(`verify: ${launchServices.line}`);
     if (values.json) {
         return { out: JSON.stringify({ base: baseTip, head, mergeBase, green, artifactPath, artifactSha256, artifactAvailability, results,
                 ...(owedAfter && owedLines.length ? { owed: { debt: owedAfter.debt, discharged: dischargeRefusal ? [] : owed.map((o) => o.id), ...(dischargeRefusal ? { refused: dischargeRefusal } : {}) } } : {}),

package/dist/config/fleet-overlay.d.ts

@@ -1,4 +1,4 @@
-import { type FleetEditable, type FleetUniverseRow, type LowerLayerModelOverrides, type RoutingMode } from "./config.js";
+import { type FleetEditable, type FleetUniverseRow, type LowerLayerModelOverrides, type MapEntry, type RoutingMode } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
 type FleetOverlayWriteFields = {
@@ -20,6 +20,7 @@ type FleetOverlayWriteFields = {
         };
     };
     universe?: FleetUniverseRow[];
+    lowerMap?: Record<string, MapEntry>;
 };
 type EffortFree = FleetEditable & {
     efforts?: undefined;

package/dist/config/fleet-overlay.js

@@ -1,5 +1,5 @@
 // Fleet-overlay mutation, serialization, and diff rendering for the `tickmarkr fleet` write path.
-import { isMap, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
+import { isAlias, isMap, isNode, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
 import { DENY_SCOPES, universeCovers, universeEntryMatches } from "./config.js";
 // OBS-1099 add.1: the writer ranges over the schema-derived scopes. The flat (all-seats) scopes
 // take part in the membership/allow-form write; every nested scope (routing.deny.workers.*) is a
@@ -161,7 +161,71 @@ function setStringSequencePreservingComments(doc, path, values) {
 // Total forms: a delete treats the masked subtree as absent (the operator's tombstone already
 // denies it, and survives untouched); a set clears the scalar and rebuilds what fleet owns —
 // the routing.allow precedent below.
+// T8 repair: an alias is no tombstone — `spec: *empty` resolves to a mapping. Each alias on the path
+// is replaced by an un-anchored copy of its target, so what it resolves to decides, and a write under
+// it never edits the anchored node its other aliases share.
+function materializeAliases(doc, path) {
+    for (let depth = 1; depth < path.length; depth++) {
+        const node = doc.getIn(path.slice(0, depth), true);
+        if (!isAlias(node))
+            continue;
+        const target = node.resolve(doc);
+        if (target === undefined)
+            return;
+        doc.setIn(path.slice(0, depth), detachedCopy(doc, node, target, new Set()));
+    }
+}
+const nodesOf = (root) => {
+    const out = [];
+    visit(root, (_key, node) => {
+        if (isNode(node))
+            out.push(node);
+    });
+    return out;
+};
+// D-821: a copy carries NO anchor (a nested `&empty` would rebind `plan: *empty` and every later
+// alias to the edited copy), and each inner alias must still name what it named in the original —
+// one whose anchor is redefined before `at` is replaced by a detached copy of its original target.
+function detachedCopy(doc, at, target, expanding) {
+    if (expanding.has(target))
+        throw new Error(`fleet cannot detach the recursive YAML alias *${at.source}`);
+    const visible = new Map();
+    visit(doc, (_key, node) => {
+        if (node === at)
+            return visit.BREAK;
+        if (isNode(node) && !isAlias(node) && node.anchor)
+            visible.set(node.anchor, node);
+    });
+    const copy = target.clone();
+    const originals = nodesOf(target);
+    const replace = new Map();
+    nodesOf(copy).forEach((node, index) => {
+        if (!isAlias(node)) {
+            node.anchor = undefined;
+            return;
+        }
+        const resolved = originals[index].resolve(doc);
+        if (resolved !== undefined && visible.get(node.source) !== resolved) {
+            replace.set(node, detachedCopy(doc, at, resolved, new Set([...expanding, target])));
+        }
+    });
+    if (!replace.size)
+        return copy;
+    visit(copy, (_key, node) => (isNode(node) ? replace.get(node) : undefined));
+    return copy;
+}
+function underScalar(doc, path) {
+    for (let depth = 1; depth < path.length; depth++) {
+        const node = doc.getIn(path.slice(0, depth), true);
+        if (node === undefined)
+            return false;
+        if (!isMap(node))
+            return true;
+    }
+    return false;
+}
 function deleteAt(doc, path) {
+    materializeAliases(doc, path); // an aliased mapping is no tombstone: Auto under `spec: *pinned` deletes the pin
     for (let depth = 1; depth < path.length; depth++) {
         if (!isMap(doc.getIn(path.slice(0, depth), true)))
             return;
@@ -171,6 +235,7 @@ function deleteAt(doc, path) {
         doc.deleteIn(path);
 }
 function setAt(doc, path, value) {
+    materializeAliases(doc, path); // edit a copy of an aliased mapping, never drop what it resolved to
     for (let depth = 1; depth < path.length; depth++) {
         const node = doc.getIn(path.slice(0, depth), true);
         if (node === undefined)
@@ -281,11 +346,19 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
         const before = initial.map[shape];
         const after = edited.map[shape];
-        if (JSON.stringify(before?.pin) !== JSON.stringify(after?.pin)) {
+        const pinPath = ["routing", "map", shape, "pin"];
+        const declares = after?.pin !== undefined || after?.pool !== undefined || after?.prefer !== undefined;
+        if (!declares && write.lowerMap?.[shape]?.pin !== undefined && JSON.stringify(before) !== JSON.stringify(after)) {
+            // pin: null tombstone — masks the lower-layer pin; a scalar tombstone above it already masks the entry
+            materializeAliases(doc, pinPath);
+            if (!underScalar(doc, pinPath))
+                setScalarPreservingComment(doc, pinPath, null);
+        }
+        else if (JSON.stringify(before?.pin) !== JSON.stringify(after?.pin)) {
             if (after?.pin === undefined)
-                deleteAt(doc, ["routing", "map", shape, "pin"]);
+                deleteAt(doc, pinPath);
             else
-                setAt(doc, ["routing", "map", shape, "pin"], doc.createNode(after.pin));
+                setAt(doc, pinPath, doc.createNode(after.pin));
         }
         if (JSON.stringify(before?.pool) !== JSON.stringify(after?.pool)) {
             const path = ["routing", "map", shape, "pool"];

package/dist/drivers/orca.d.ts

@@ -31,16 +31,18 @@ export declare class OrcaError extends Error {
     readonly raw: string;
     readonly code?: string;
     readonly runtimeId?: string;
+    readonly launchCause?: SeatLaunchCause;
     constructor(family: string, reason: string, raw: string, opts?: {
         code?: string;
         runtimeId?: string;
+        launchCause?: SeatLaunchCause;
     });
 }
 /** The slot cannot be addressed: dead/unknown terminal record, or a handle that cannot be recovered
  *  to exactly one owned terminal in the slot's own worktree. Never a silent false or empty string. */
 export declare class OrcaUnavailableError extends OrcaError {
     readonly terminalStatus?: string | undefined;
-    constructor(family: string, reason: string, raw: string, terminalStatus?: string | undefined);
+    constructor(family: string, reason: string, raw: string, terminalStatus?: string | undefined, launchCause?: SeatLaunchCause);
 }
 export interface OrcaEnvelope {
     result: Record<string, unknown>;
@@ -83,6 +85,10 @@ export declare function terminalWorktree(term: Record<string, unknown>): string
 export declare function canonicalWorktreePath(path: string): string;
 /** The proof line a worker terminal prints first: create, recovery and focus read it back. */
 export declare const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
+/** E1: the one typed launch cause a driver attaches to its launch failure. `checkout-proof-timeout`
+ *  means the terminal printed NO proof frame by the ceiling — a slow host, not a misplaced seat. A
+ *  foreign or malformed frame is placement evidence and carries no cause (never a timeout exemption). */
+export type SeatLaunchCause = "checkout-proof-timeout";
 /** The exact bytes the create command prints as its first line. */
 export declare function checkoutProofLine(checkout: string): string;
 /** Every complete frame in a scrollback, decoded and canonicalized; whether an incomplete one was seen. */
@@ -250,6 +256,18 @@ export declare class OrcaDriver implements ExecutorDriver {
      * that supplied the ownership listing — else another terminal's or another runtime's bytes were
      * answered and nothing is proven. Proven means provesCheckout: exact canonical full-path equality
      * of a complete frame, no other checkout named, no incomplete frame.
+     * E1: with a `deadline` (create's window) there is ONE absolute deadline: a read is issued only while
+     * budget is left and is handed exactly that budget, and a page that still lands past it is late —
+     * nothing late proves the checkout. `seen` is what the scrollback showed, for the typed timeout:
+     * `misplaced` — a frame naming another checkout, a cut frame or an unparseable mark in anything read
+     * (the anchor's tail and every page included, even when paging stopped or a later read threw);
+     * `absent` — ONLY when every page down to the start of the scrollback was read before the ceiling
+     * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
+     * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read
+     * the ceiling cut off or never let start (the anchor included), or a page that landed late (even one
+     * carrying the right proof), a malformed page (its tail, cursors or paging flags), or a blind stream
+     * page (isBlindStreamPage). Unread output is unknown — never an empty page, never absence.
+     * Without a deadline (reconcile, recovery) only `proven` is consumed.
      */
     private checkoutProven;
     private recover;