tickmarkr 2.6.4 → 2.6.5

package/dist/run/operator-state.d.ts

@@ -1,5 +1,5 @@
 import { type RunGraph } from "../graph/schema.js";
-import { type JournalEvent } from "./journal.js";
+import { type JournalEvent, type OwedFold } from "./journal.js";
 /** An evidence identity is a physical journal line, never a filtered row ordinal. */
 export interface EvidenceIdentity {
     source: string;
@@ -74,6 +74,15 @@ export interface OperatorSnapshot {
     };
     latestRunEnd?: EvidenceIdentity;
     approvedResumeRequired: boolean;
+    /** I2: CURRENT owed-check debt from the authority this observation supplied; "unknown" when absent or stale. */
+    debt: number | "unknown";
+    outstanding: readonly string[];
+}
+/** I2: foldOwedChecks over the complete effective journal, tagged with the journal basis it read. A result
+ * whose basis is not the observation's own is stale and counts as unknown debt, never as zero. */
+export interface OwedAuthority {
+    basis: string;
+    fold: OwedFold;
 }
 /** Author channels recorded on a task-done row. A row written before authors were recorded carries none and
  * projects nothing (never the dispatch); unattributed preserved work arrives as an explicit "unknown" entry. */
@@ -99,12 +108,20 @@ export declare class OperatorStateFold {
     private total;
     apply(record: OperatorRecord): void;
     private task;
-    snapshot({ graph, sequence, observedAt, readable, graphAvailability }?: {
+    /** A run-end is the latest lifecycle boundary: the only state whose headline consults owed-check debt. */
+    get ended(): boolean;
+    /** `daemonDead`: this run's lock holder was observed provably dead (lock.ts liveness). It is an observation,
+     * not a journal row, so it settles the projection only and the fold keeps no trace of it.
+     * `owed`/`basis` (I2): COMPLETE needs a known-empty debt computed over this very journal basis. */
+    snapshot({ graph, sequence, observedAt, readable, graphAvailability, daemonDead, owed, basis }?: {
         graph?: RunGraph;
         sequence?: number;
         observedAt?: number;
         readable?: boolean;
         graphAvailability?: OperatorSnapshot["graphAvailability"];
+        daemonDead?: boolean;
+        owed?: OwedAuthority;
+        basis?: string;
     }): OperatorSnapshot;
     private comparableTo;
 }
@@ -116,4 +133,7 @@ export declare function readOperatorState({ events, source, ...options }: {
     sequence?: number;
     observedAt?: number;
     readable?: boolean;
+    daemonDead?: boolean;
+    owed?: OwedAuthority;
+    basis?: string;
 }): OperatorSnapshot;

package/dist/run/operator-state.js

@@ -5,6 +5,9 @@ const bucketNames = ["failed", "human", "blocked", "pending"];
 const strings = (value) => Array.isArray(value) && value.every(v => typeof v === "string") ? [...value] : undefined;
 const identity = ({ source, line, id, generation }) => ({ source, line, id, generation });
 const emptyGates = () => Object.fromEntries(GATE_NAMES.map(g => [g, { state: "not-run" }]));
+/** I1: at a terminal boundary nothing will finish a queued or running cell, so it reads unknown (keeping the
+ * row that started it); a measured passed/failed cell is never touched. Returns copies. */
+const settled = (gates, settle = true) => Object.fromEntries(Object.entries(gates).map(([g, cell]) => [g, settle && (cell.state === "queued" || cell.state === "running") ? { ...cell, state: "unknown" } : { ...cell }]));
 /** Author channels recorded on a task-done row. A row written before authors were recorded carries none and
  * projects nothing (never the dispatch); unattributed preserved work arrives as an explicit "unknown" entry. */
 export const doneAuthors = (data) => strings(data.authors);
@@ -60,6 +63,10 @@ export class OperatorStateFold {
             };
             this.active = false;
             this.approved = false;
+            for (const t of this.tasks.values()) {
+                t.gates = settled(t.gates);
+                t.gateActivity = undefined;
+            }
             for (const key of bucketNames)
                 for (const id of this.end.buckets[key] ?? []) {
                     const task = this.task(id);
@@ -132,6 +139,8 @@ export class OperatorStateFold {
             t.gateActivity = undefined;
         if (["task-done", "merge", "task-failed", "task-human", "task-blocked"].includes(e.event))
             t.gateActivity = undefined;
+        if (["task-failed", "task-human", "task-blocked"].includes(e.event))
+            t.gates = settled(t.gates);
         const phaseGate = e.event === "phase-start" && typeof e.data.phase === "string"
             ? e.data.phase.startsWith("gate:") ? e.data.phase.slice(5) : e.data.phase === "judge" ? "acceptance" : e.data.phase === "review" ? "review" : undefined
             : undefined;
@@ -162,13 +171,18 @@ export class OperatorStateFold {
         }
         return t;
     }
-    snapshot({ graph, sequence = 0, observedAt = Date.now(), readable = true, graphAvailability } = {}) {
+    /** A run-end is the latest lifecycle boundary: the only state whose headline consults owed-check debt. */
+    get ended() { return !!this.end && !this.active; }
+    /** `daemonDead`: this run's lock holder was observed provably dead (lock.ts liveness). It is an observation,
+     * not a journal row, so it settles the projection only and the fold keeps no trace of it.
+     * `owed`/`basis` (I2): COMPLETE needs a known-empty debt computed over this very journal basis. */
+    snapshot({ graph, sequence = 0, observedAt = Date.now(), readable = true, graphAvailability, daemonDead = false, owed, basis } = {}) {
         const hash = graph && graphDefinitionHash(graph);
         const comparable = this.comparableTo(hash);
         const ids = comparable ? [...graph.tasks.map(t => t.id), ...[...this.tasks.keys()].filter(id => !graph.tasks.some(t => t.id === id))] : [...this.tasks.keys()];
         const tasks = ids.map(id => {
             const t = this.tasks.get(id) ?? { id, state: "unknown", merged: false, dispatches: 0, reviewRounds: 0, parks: 0, gates: emptyGates() };
-            return { ...t, title: comparable ? graph.tasks.find(g => g.id === id)?.title : undefined, gates: Object.fromEntries(Object.entries(t.gates).map(([g, cell]) => [g, { ...cell }])) };
+            return { ...t, title: comparable ? graph.tasks.find(g => g.id === id)?.title : undefined, gates: settled(t.gates, daemonDead), ...(daemonDead ? { gateActivity: undefined } : {}) };
         });
         const buckets = Object.fromEntries(bucketNames.map(k => [k, this.end?.buckets[k] === undefined ? undefined : [...this.end.buckets[k]]]));
         // A matching graph contributes planned tasks even when the journal has never named them.
@@ -179,9 +193,11 @@ export class OperatorStateFold {
         const unresolved = tasks.some(t => ["unknown", "failed", "human", "blocked", "pending", "running"].includes(t.state));
         const allPlannedMerged = comparable && merged === planned;
         const currentTip = this.active ? "pending" : this.tipFailed ? "failed" : this.end?.tip ?? "unknown";
+        const current = owed !== undefined && basis !== undefined && owed.basis === basis && owed.fold.known && typeof owed.fold.debt === "number";
+        const debt = current ? owed.fold.debt : "unknown";
         const green = readable && comparable && allPlannedMerged && !!this.start && !!this.end && !this.approved && !unresolved
             && (currentTip === "passed" || currentTip === "not required")
-            && bucketNames.every(k => buckets[k]?.length === 0);
+            && bucketNames.every(k => buckets[k]?.length === 0) && debt === 0;
         const lifecycle = !readable || !this.start ? "UNKNOWN" : this.active ? "RUNNING" : this.approved ? "APPROVED" : green ? "COMPLETE" : this.end ? "PARTIAL" : "PENDING";
         return {
             sequence, observedAt, lastEventAt: this.lastEventAt, firstEventAt: this.firstEventAt, resumes: this.resumes, escalations: this.escalations, lifecycle,
@@ -191,6 +207,7 @@ export class OperatorStateFold {
             planned, tasks, buckets,
             gatesRan: { passed: this.passed, total: this.total }, latestRunEnd: this.end?.evidence,
             approvedResumeRequired: this.approved,
+            debt, outstanding: current ? owed.fold.outstanding.map(o => `${o.taskId} ${o.gate}`) : [],
         };
     }
     comparableTo(hash) {

package/dist/run/title-environment.d.ts

@@ -0,0 +1,45 @@
+import { spawnSync } from "node:child_process";
+/**
+ * A2 (D-787): the process-title mode every shell child receives. On Darwin, children get one
+ * `--require` of the shipped title-preload.cjs appended to their NODE_OPTIONS, so a Node child's
+ * process.title writes stay in JavaScript instead of each checking in with LaunchServices (npm's own
+ * entry keeps its native, secret-hiding title — see title-preload.cts). Everything here fails OPEN to
+ * the native mode, which is exactly what children received before A2: another platform, the operator's
+ * opt-out, a missing artifact, inherited options the preflight cannot vouch for, or a preflight the
+ * runner's own node refused.
+ *
+ * `shell` (git.ts) applies this to the child it spawns and `runnerInputsHash` (cache.ts) hashes the same
+ * value, so a cached verdict or baseline is only ever answered by one produced under the identical mode
+ * and preload content.
+ */
+export declare const NATIVE_PROCESS_TITLE_ENV = "TICKMARKR_NATIVE_PROCESS_TITLE";
+/** The preflight's kill ceiling, never a predicted duration: one `node -e ""` start. */
+export declare const TITLE_PREFLIGHT_TIMEOUT_MS = 10000;
+export type TitleMode = "native" | "preload";
+export interface TitleEnvironment {
+    mode: TitleMode;
+    /** Content identity of the preload a child loads; null in native mode. */
+    identity: string | null;
+    /** The NODE_OPTIONS the child receives: the inherited value less any managed preload in native mode;
+     *  undefined when nothing is left, so the child's NODE_OPTIONS is unset rather than empty. */
+    nodeOptions: string | undefined;
+}
+interface TitleSeams {
+    platform: NodeJS.Platform;
+    preloadPath: string;
+    /** Undefined until a test sets it: the standard library binding is read at CALL time, so a suite that
+     *  mocks `node:child_process` without `spawnSync` still imports this module. */
+    probe?: typeof spawnSync;
+}
+export declare const setTitleEnvironmentForTests: (overrides: Partial<TitleSeams>) => void;
+export declare const resetTitleEnvironmentForTests: () => void;
+/** NODE_OPTIONS splits on spaces outside double quotes; inside them a backslash escapes `"` and `\`. */
+export declare const quoteNodeOption: (value: string) => string;
+/**
+ * The title mode a child spawned from `env` receives, and the NODE_OPTIONS that carries it. A nested shell
+ * inherits its parent's preload, so every mode first removes it: native gets none (the opt-out, options the
+ * probe cannot vouch for, a refusal or a missing artifact must hold in a nested shell too) and preload mode
+ * exactly one, this one.
+ */
+export declare function titleEnvironment(env: NodeJS.ProcessEnv): TitleEnvironment;
+export {};

package/dist/run/title-environment.js

@@ -0,0 +1,127 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * A2 (D-787): the process-title mode every shell child receives. On Darwin, children get one
+ * `--require` of the shipped title-preload.cjs appended to their NODE_OPTIONS, so a Node child's
+ * process.title writes stay in JavaScript instead of each checking in with LaunchServices (npm's own
+ * entry keeps its native, secret-hiding title — see title-preload.cts). Everything here fails OPEN to
+ * the native mode, which is exactly what children received before A2: another platform, the operator's
+ * opt-out, a missing artifact, inherited options the preflight cannot vouch for, or a preflight the
+ * runner's own node refused.
+ *
+ * `shell` (git.ts) applies this to the child it spawns and `runnerInputsHash` (cache.ts) hashes the same
+ * value, so a cached verdict or baseline is only ever answered by one produced under the identical mode
+ * and preload content.
+ */
+export const NATIVE_PROCESS_TITLE_ENV = "TICKMARKR_NATIVE_PROCESS_TITLE";
+/** The preflight's kill ceiling, never a predicted duration: one `node -e ""` start. */
+export const TITLE_PREFLIGHT_TIMEOUT_MS = 10_000;
+const shipped = () => ({
+    platform: process.platform,
+    preloadPath: fileURLToPath(new URL("./title-preload.cjs", import.meta.url)),
+});
+let seams = shipped();
+const preflights = new Map();
+export const setTitleEnvironmentForTests = (overrides) => {
+    seams = { ...seams, ...overrides };
+    preflights.clear();
+};
+export const resetTitleEnvironmentForTests = () => {
+    seams = shipped();
+    preflights.clear();
+};
+/** NODE_OPTIONS splits on spaces outside double quotes; inside them a backslash escapes `"` and `\`. */
+export const quoteNodeOption = (value) => `"${value.replace(/[\\"]/g, "\\$&")}"`;
+/** The one option this install adds: its preload, at an absolute path. */
+const preloadOption = () => `--require ${quoteNodeOption(seams.preloadPath)}`;
+/**
+ * D-827: does the runner's own node load this preload? Probed at most once per process per (node execPath,
+ * preload content identity, mode) — neither the operator's options nor a payload's cwd key it — so a
+ * refusal is sticky for that triple. The probe certifies only the context it reproduces: the preload alone,
+ * at its absolute path, run in the preload's own directory. `certifiable` sends every payload whose own
+ * options could change how that loads — the permission model, other code loaders, a policy or config file,
+ * any cwd-relative path — to native before any probe, so what reaches a payload loads the same from the
+ * probe's cwd and from the payload's (D-835: an absolute preload with none of those certifies every cwd).
+ * A bounded synchronous probe that never goes through `shell` or its spawn seam, so payload start timing,
+ * recorded spawn commands and the lease census see payloads only. A refusal — nonzero exit, signal, the ceiling, or a spawn error — selects native payloads without
+ * re-probing; a payload is never started twice to find out.
+ */
+function preflight(env, identity) {
+    const key = [process.execPath, identity, "preload"].join("\0");
+    let accepted = preflights.get(key);
+    if (accepted === undefined) {
+        try {
+            const probe = (seams.probe ?? spawnSync)(process.execPath, ["-e", ""], {
+                cwd: dirname(seams.preloadPath), env: { ...env, NODE_OPTIONS: preloadOption() },
+                stdio: "ignore", timeout: TITLE_PREFLIGHT_TIMEOUT_MS, killSignal: "SIGKILL",
+            });
+            accepted = probe.status === 0 && !probe.error;
+        }
+        catch {
+            accepted = false;
+        }
+        preflights.set(key, accepted);
+    }
+    return accepted;
+}
+/** NODE_OPTIONS as Node splits it: on spaces outside double quotes, each quoted segment unescaped. */
+const optionTokens = (options) => (options.match(/(?:[^\s"]|"(?:[^"\\]|\\.)*")+/g) ?? [])
+    .map((token) => token.replace(/"((?:[^"\\]|\\.)*)"/g, (_, quoted) => quoted.replace(/\\(.)/g, "$1")));
+/** Node accepts `_` for `-` in an option's name (`--experimental_permission` is Node 20's permission flag), so
+ * a name is classified in its hyphen spelling; the value after `=` is left as written. */
+const hyphenated = (token) => token.replace(/^--[^=]*/, (name) => name.replace(/_/g, "-"));
+/** Options that gate file access, load other code, or read a policy or config file. */
+const LOADING_OPTION = /^(?:-r|--(?:require|import|(?:experimental-)?loader|(?:experimental-)?permission[\w-]*|allow-[\w-]+|(?:experimental-)?policy[\w-]*|experimental-(?:default-)?config-file))(?:=|$)/;
+/** A path a cwd resolves: not absolute, and a directory step or a leading `.` or `~` (Node expands neither). */
+const cwdRelative = (value) => !value.startsWith("/") && /^[.~]|\//.test(value);
+/** Can the one canonical probe vouch for a payload under the operator's own options? No when any token
+ * loads, permits or resolves against the cwd — a separate value token or an `=` value alike. */
+const certifiable = (own) => optionTokens(own ?? "").every((token) => !LOADING_OPTION.test(hyphenated(token)) && !cwdRelative(/^-[^=]*=/.test(token) ? token.slice(token.indexOf("=") + 1) : token));
+/** One `--require "<path>"` option in the quoted form quoteNodeOption writes. */
+const QUOTED_REQUIRE = /(?:^|\s+)--require "((?:[^"\\]|\\.)*)"(?=\s|$)/g;
+/** A tickmarkr-managed preload, positively identified: this install's, or another install's shipped
+ * `dist/run/title-preload.cjs` whose package.json names it tickmarkr (a nested shell under another install).
+ * A user's own file of the same name is never one, so their hook keeps running in every mode. */
+const managed = (path) => {
+    if (path === seams.preloadPath)
+        return true;
+    if (!/[\\/]dist[\\/]run[\\/]title-preload\.cjs$/.test(path))
+        return false;
+    try {
+        return JSON.parse(readFileSync(join(dirname(path), "../../package.json"), "utf8")).name === "tickmarkr";
+    }
+    catch {
+        return false;
+    }
+};
+/** The operator's own options: every inherited managed preload removed; every other option byte-identical,
+ * and the value untouched without one. */
+const withoutManaged = (options) => {
+    const stripped = options?.replace(QUOTED_REQUIRE, (whole, quoted) => managed(quoted.replace(/\\(.)/g, "$1")) ? "" : whole);
+    return stripped === options ? options : stripped.trim() || undefined;
+};
+/**
+ * The title mode a child spawned from `env` receives, and the NODE_OPTIONS that carries it. A nested shell
+ * inherits its parent's preload, so every mode first removes it: native gets none (the opt-out, options the
+ * probe cannot vouch for, a refusal or a missing artifact must hold in a nested shell too) and preload mode
+ * exactly one, this one.
+ */
+export function titleEnvironment(env) {
+    const own = withoutManaged(env.NODE_OPTIONS);
+    const native = { mode: "native", identity: null, nodeOptions: own };
+    if (seams.platform !== "darwin" || env[NATIVE_PROCESS_TITLE_ENV] === "1" || !certifiable(own))
+        return native;
+    let identity;
+    try {
+        identity = createHash("sha256").update(readFileSync(seams.preloadPath)).digest("hex").slice(0, 16);
+    }
+    catch {
+        return native; // a missing or unreadable artifact keeps the native setter
+    }
+    if (!preflight(env, identity))
+        return native;
+    return { mode: "preload", identity, nodeOptions: [own?.trim(), preloadOption()].filter(Boolean).join(" ") };
+}

package/dist/run/title-preload.cjs

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// A2 (D-787): loaded through NODE_OPTIONS into Darwin shell children (title-environment.ts decides
+// when). Node's native process.title setter checks in with LaunchServices on every write, and test
+// runners write it per worker; a burst of those check-ins has restarted launchservicesd. Here a title
+// write stays in JavaScript, so `ps` keeps the original command line.
+//
+// npm is the exception: its entry sets the native title first thing so `ps` never shows secrets given
+// on its command line, and that hiding must survive. The entry is recognised by the script it runs —
+// `bin/npm-cli.js` / `bin/npx-cli.js` in every npm major's package layout, or corepack's npm/npx shim —
+// resolved through symlinks, since the `npm` command on PATH is a link to it.
+//
+// CommonJS (.cts → .cjs) so `--require` loads it in every supported Node, ESM package or not. It never
+// throws: a preload that throws kills the payload it was meant to protect.
+const node_fs_1 = require("node:fs");
+const NPM_ENTRY = /[\\/](?:bin[\\/]np[mx]-cli|corepack[\\/]dist[\\/]np[mx])\.js$/;
+// The script node was asked to run; an unresolvable one (`node -e`, a deleted file) is simply not npm.
+const entry = () => {
+    try {
+        return (0, node_fs_1.realpathSync)(process.argv[1]);
+    }
+    catch {
+        return process.argv[1] ?? "";
+    }
+};
+try {
+    const native = Object.getOwnPropertyDescriptor(process, "title");
+    if (native?.configurable && !NPM_ENTRY.test(entry())) {
+        let title = process.title;
+        Object.defineProperty(process, "title", {
+            configurable: true,
+            enumerable: native.enumerable,
+            get: () => title,
+            set: (value) => { title = String(value); },
+        });
+    }
+}
+catch { /* fail open: the native setter stays */ }

package/dist/run/title-preload.d.cts

@@ -0,0 +1 @@
+export {};

package/dist/tui/cockpit/board.js

@@ -136,13 +136,16 @@ export function boardFrame(input, width) {
         const unknown = buckets.filter(([, v]) => v === undefined).map(([k]) => k);
         const parked = buckets.filter(([, v]) => v !== undefined && v.length > 0).map(([k, v]) => `${k} ${v.join(",")}`);
         const tally = `${doneIds.size} merged · ${(s.buckets.human ?? []).length} parked · ${(s.buckets.blocked ?? []).length} dep-blocked`;
-        const green = !unknown.length && !parked.length && (s.currentTip === "passed" || s.currentTip === "not required");
+        // I2: the same CURRENT owed-check authority as the lifecycle — debt must be known and empty.
+        const owed = s.debt === 0 ? undefined : s.debt === "unknown" ? "outstanding unknown" : `outstanding ${s.debt} (${s.outstanding.join(", ")})`;
+        const tipOk = s.currentTip === "passed" || s.currentTip === "not required";
+        const green = !unknown.length && !parked.length && tipOk && !owed;
         const now = green
             ? `${pass("RUN ENDED — GREEN")}  ${mute(`tip ${s.currentTip} · ${tally}`)}`
             : s.currentTip === "failed"
                 ? `${fail("RUN ENDED — TIP VERIFY FAILED")}  ${mute(tally)}`
-                : parked.length || unknown.length
-                    ? `${fail("RUN ENDED — NOT GREEN")}  ${mute(`${[...parked, ...unknown.map((k) => `${k} bucket unknown`)].join(" · ")} · ${tally}`)}`
+                : parked.length || unknown.length || tipOk
+                    ? `${fail("RUN ENDED — NOT GREEN")}  ${mute(`${[...parked, ...unknown.map((k) => `${k} bucket unknown`), ...(owed ? [owed] : [])].join(" · ")} · ${tally}`)}`
                     : `${warn("RUN ENDED — TIP NOT VERIFIED")}  ${mute(`tip ${s.currentTip} · ${tally}`)}`;
         top.push(`  ${accent("▌")} ${bold("NOW")}        ${now}`);
         top.push("");
@@ -152,8 +155,11 @@ export function boardFrame(input, width) {
     top.push("");
     // ── aligned gate header: each label truncated to the cell it owns (prototype :382-394) ──
     const elastic = Math.max(30, W - BOARD_FIXED - BOARD_NOTE_RESERVE);
-    const LBL = Math.min(46, Math.max(18, Math.round(elastic * 0.62)));
-    const CHAN = Math.min(26, Math.max(12, elastic - LBL));
+    const compactLabel = Math.min(46, Math.max(18, Math.round(elastic * 0.62)));
+    const stacked = boardBand(W) === "stacked";
+    const LBL = stacked ? Math.max(0, W - 4 - 5 - BOARD_AREA_W - BOARD_DEPS_W)
+        : compactLabel;
+    const CHAN = Math.min(26, Math.max(12, elastic - compactLabel));
     const gateHead = BOARD_GATES.map((g) => faint(pad(g.slice(0, BOARD_CELL - 1), BOARD_CELL))).join("");
     const gateHeader = {
         head: `    ${pad("", 5)}${pad(faint("area"), BOARD_AREA_W)}${pad(faint("deps"), BOARD_DEPS_W)}${pad(faint("task"), LBL)}`,
@@ -200,7 +206,7 @@ export function boardFrame(input, width) {
             ? depText
             : depIds.length > 1 ? `${depIds[0]}+${depIds.length - 1}` : `${depIds[0].slice(0, BOARD_DEPS_W - 3)}…`;
         const deps = pad(faint(depLabel), BOARD_DEPS_W);
-        const titleText = sliceCells(g.title ?? "", LBL - 2).head;
+        const titleText = sliceCells(g.title ?? "", stacked ? LBL : LBL - 2).head;
         const title = hot ? body(pad(titleText, LBL)) : faint(pad(titleText, LBL));
         const note = [
             parks >= 3 ? park(`◍ parked ×${parks}`) : "",

package/dist/tui/cockpit/keys.d.ts

@@ -259,6 +259,10 @@ export declare const SHELL_BINDINGS: readonly [{
     readonly key: "5";
     readonly label: "Evidence";
     readonly action: "evidence";
+}, {
+    readonly key: "7";
+    readonly label: "Log";
+    readonly action: "log";
 }, {
     readonly key: "Tab";
     readonly label: "Focus";
@@ -322,6 +326,10 @@ export declare function shellBindings(context: {
     readonly key: "5";
     readonly label: "Evidence";
     readonly action: "evidence";
+} | {
+    readonly key: "7";
+    readonly label: "Log";
+    readonly action: "log";
 } | {
     readonly key: "Tab";
     readonly label: "Focus";

package/dist/tui/cockpit/keys.js

@@ -637,6 +637,7 @@ export const SHELL_BINDINGS = [
     { key: "1", label: "Home", action: "home" },
     { key: "4", label: "Run", action: "run" },
     { key: "5", label: "Evidence", action: "evidence" },
+    { key: "7", label: "Log", action: "log" },
     { key: "Tab", label: "Focus", action: "focus" },
     { key: "Enter", label: "Open", action: "open" },
     { key: "a", label: "Actions", action: "actions" },
@@ -658,7 +659,9 @@ export function shellBindings(context) {
             return context.canResize === true;
         if (binding.action === "export")
             return context.view === "evidence";
-        if (binding.action === "filter" || binding.action === "follow")
+        if (binding.action === "follow")
+            return context.view === "log" || context.view === "evidence" && !context.evidenceSection;
+        if (binding.action === "filter")
             return context.view === "evidence" && !context.evidenceSection;
         return true;
     });

package/dist/tui/cockpit/layout.d.ts

@@ -306,8 +306,8 @@ export declare function planFrame(size: MeasuredSize, view?: FrameView, state?:
 export declare function resolveCockpitLayout(columns: number, rows: number): CockpitLayout;
 /**
  * FINAL §3.1: one geometry for paint, focus and pointer hit testing. A ZERO shortcut budget is the
- * rail-less mount (BD-1, RULING-231-19 §2): the daemon-placed board is a one-view observer, so it
- * plans no rail and no shortcuts at any width — the budget is honoured, never floored back to 20.
+ * explicit compact mount: it plans no rail and no shortcuts at any width. Daemon-owned and manual
+ * boards both use the default budget; an explicit zero is honoured, never floored back to 20.
  */
 export declare function planShell(columns: number, rows: number, shortcutColumns?: number): {
     columns: number;

package/dist/tui/cockpit/layout.js

@@ -391,8 +391,8 @@ export function resolveCockpitLayout(columns, rows) {
 }
 /**
  * FINAL §3.1: one geometry for paint, focus and pointer hit testing. A ZERO shortcut budget is the
- * rail-less mount (BD-1, RULING-231-19 §2): the daemon-placed board is a one-view observer, so it
- * plans no rail and no shortcuts at any width — the budget is honoured, never floored back to 20.
+ * explicit compact mount: it plans no rail and no shortcuts at any width. Daemon-owned and manual
+ * boards both use the default budget; an explicit zero is honoured, never floored back to 20.
  */
 export function planShell(columns, rows, shortcutColumns = 22) {
     columns = Math.max(0, Math.floor(columns));

package/dist/tui/cockpit/live-runtime.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { existsSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { renderMarkdownRecord } from "../../cli/commands/report.js";
 import { loadConfig } from "../../config/config.js";
@@ -7,13 +7,14 @@ import { estimateCosts } from "../../report/cost.js";
 import { PerformanceObserver, performance } from "node:perf_hooks";
 import { render, useInput, useStdin } from "ink";
 import { useLayoutEffect, useSyncExternalStore } from "react";
-import { createLiveStore } from "./live-store.js";
+import { createLiveStore, journalBasis, readObservedJournal } from "./live-store.js";
 import { HomeView, deriveHomeView, selectNeedsYouTarget } from "./home-view.js";
 import { RunView, applyRunViewKey, initialRunViewSession, runGateCells, evidenceLookup } from "./run-view.js";
 import { renderBoardLines, stripBoardAnsi } from "./board.js";
 import { EvidenceView, deriveEvidenceView, defaultExportPath, planEvidenceExport, writeEvidenceExport } from "./evidence-view.js";
 import { ShellGridFlow, ShellJournalSelection } from "./components.js";
 import { CockpitShell, initialShellState } from "./shell.js";
+import { LogView, readLogPage, moveLogEnd } from "./log-view.js";
 import { planShell } from "./layout.js";
 import { shellBindings } from "./keys.js";
 import { createPointerReportReader, POINTER_TRACKING_ON, POINTER_TRACKING_OFF } from "./pointer.js";
@@ -21,7 +22,7 @@ import { deriveRunDecisions, previewDecision, executeDecision, withDecisionPrevi
 import { approvalRunOwner } from "../../cli/commands/approve.js";
 import { GLYPHS } from "../../brand.js";
 import { effectiveEvents, Journal, parseJournalText, physicalLine } from "../../run/journal.js";
-import { observeNamedRun, WATCH_OWNER_ENV } from "../../run/supervision.js";
+import { observeNamedRun } from "../../run/supervision.js";
 import { formatOwnedName } from "../../drivers/types.js";
 import { readOperatorState } from "../../run/operator-state.js";
 import { cellWidth, wrapCells } from "./width.js";
@@ -59,6 +60,10 @@ export function borrowRuntimeTimeline() {
 }
 export const SHELL_TERMINAL_ENTER = "\x1b[?1049h\x1b[22;0t\x1b]0;tickmarkr cockpit\x07" + POINTER_TRACKING_ON;
 export const SHELL_TERMINAL_RESTORE = POINTER_TRACKING_OFF + "\x1b[23;0t\x1b[?25h\x1b[?1049l";
+/** Rows not bound to the store's observation: only the store's own observation is served, with debt unknown
+ * (the fold's formula then gives PARTIAL for a headline that was green — green implies ended and unapproved). */
+const unbound = (snap) => ({ ...snap, owed: undefined, operator: { ...snap.operator, debt: "unknown", outstanding: [],
+        green: false, ...(snap.operator.green ? { lifecycle: "PARTIAL", label: "PARTIAL" } : {}) } });
 /**
  * OBS-1178: the store's incremental fold reads every task-approved row as a release. A refused or unsound
  * decision released nothing, so whenever the rows the store has read hold one — whatever state the raw
@@ -70,36 +75,48 @@ export const SHELL_TERMINAL_RESTORE = POINTER_TRACKING_OFF + "\x1b[23;0t\x1b[?25
  */
 export function decidedLiveStore(store) {
     let key;
-    let operator;
+    let events;
+    // I2: the refold is keyed by the store's owed authority too, so a debt the store re-folded (an artifact
+    // removed or altered under unchanged journal bytes) is never served from an earlier observation's refold.
+    let folded;
     const decided = (snap) => {
         const { journal, graph } = snap;
-        const observed = `${journal.source}:${journal.generation}:${journal.offset}:${graph.identity}:${graph.status}`;
+        const observed = `${journalBasis(journal)}:${graph.identity}:${graph.status}:${snap.lock.state}`;
         if (observed !== key) {
             key = observed;
-            operator = undefined;
+            events = undefined;
+            folded = undefined;
             let bytes;
+            // I2 (D-857): the refold reads the very journal version the store observed — the one its owed authority
+            // and basis name. A changed or failed read is never cached (un-keyed, re-read next observation) and
+            // decides nothing meanwhile: debt unknown, never green.
             try {
-                bytes = readFileSync(journal.source).subarray(0, journal.offset);
+                bytes = readObservedJournal(journal);
             }
             catch {
-                return snap;
+                key = undefined;
+                return unbound(snap);
             }
             if (bytes.includes("task-approved")) {
                 const rows = parseJournalText(bytes.subarray(0, bytes.lastIndexOf(10) + 1).toString("utf8"))
                     .filter(e => e !== null && typeof e === "object" && typeof e.event === "string" && typeof e.data === "object" && e.data !== null);
                 const kept = effectiveEvents(rows);
                 if (kept.length !== rows.length) {
-                    const events = kept.map((event, i) => {
+                    events = kept.map((event, i) => {
                         const line = physicalLine(kept, i);
                         return { source: journal.source, line, id: `${journal.source}#L${line}`, generation: journal.generation, event };
                     });
-                    operator = readOperatorState({ events, graph: graph.status === "readable" ? graph.value : undefined,
-                        readable: journal.status === "readable" && journal.backlogBytes === 0 });
                 }
             }
         }
-        if (!operator)
+        if (!events)
             return snap;
+        if (!folded || folded.owed !== snap.owed) {
+            folded = { owed: snap.owed, operator: readOperatorState({ events, graph: graph.status === "readable" ? graph.value : undefined,
+                    readable: journal.status === "readable" && journal.backlogBytes === 0, daemonDead: snap.lock.state === "dead",
+                    owed: snap.owed, basis: journalBasis(journal) }) };
+        }
+        const operator = folded.operator;
         const { sequence, observedAt, graphAvailability } = snap.operator;
         return { ...snap, operator: { ...operator, sequence, observedAt, graphAvailability } };
     };
@@ -147,10 +164,8 @@ export async function runConsolidatedCockpit(options) {
         const source = decidedLiveStore(store);
         if (options.observeRun !== false)
             observation = observeNamedRun(cwd, runId, options.environment);
-        // BD-1 (RULING-231-19 §2): the daemon-placed board carries the watch owner token and mounts
-        // rail-less — a zero shortcut budget the plan honours at every width. The manual cockpit keeps its rail.
-        const railless = Boolean((options.environment ?? process.env)[WATCH_OWNER_ENV]);
-        let state = { ...initialShellState(), view: options.initialView ?? "home", ...(railless ? { shortcutColumns: 0 } : {}) };
+        // Daemon-placed and manual boards share the same rails and navigation.
+        let state = { ...initialShellState(), view: options.initialView ?? "home" };
         let runSession = initialRunViewSession();
         if (options.initialParks) {
             runSession = { ...runSession, selection: Math.max(0, source.snapshot().operator.tasks.findIndex(t => t.state === "human" || t.state === "blocked")) };
@@ -202,6 +217,9 @@ export async function runConsolidatedCockpit(options) {
                 snap.journal.generation, snap.journal.offset, snap.journal.status, snap.journal.malformedCount, snap.journal.backlogBytes, snap.journal.pending, snap.journal.error,
                 snap.graph.identity, snap.graph.status, snap.config.identity, snap.config.status, snap.cache.identity, snap.cache.status,
                 snap.lock.value, snap.lock.status, snap.lock.state, snap.lock.alive,
+                // I2: owed-check debt moves under unchanged journal bytes (an artifact removed or altered) and
+                // decides the drawn lifecycle and board headline.
+                snap.operator.lifecycle, snap.operator.debt, snap.operator.outstanding,
                 // D-383: supervision tier state is not drawn by any view; an ARMED→STALE transition earns no
                 // frame. Its UNREADABLE case already surfaces through snap.errors above.
             ]);
@@ -418,7 +436,7 @@ export async function runConsolidatedCockpit(options) {
             }
             else {
                 const action = shellBindings(state).find(b => b.key === text)?.action;
-                if (action === "home" || action === "run" || action === "evidence")
+                if (action === "home" || action === "run" || action === "evidence" || action === "log")
                     state = { ...state, view: action, scroll: 0, evidenceSection: action === state.view ? state.evidenceSection : 0 };
                 else if (action === "widen" || action === "narrow")
                     state = { ...state, shortcutColumns: planShell(geometry().columns, geometry().rows, geometry().shortcuts + (action === "widen" ? 1 : -1)).shortcuts };
@@ -432,6 +450,13 @@ export async function runConsolidatedCockpit(options) {
                 }
                 else if (state.view === "evidence" && (k.leftArrow || k.rightArrow))
                     state = { ...state, evidenceSection: ((state.evidenceSection ?? 0) + (k.rightArrow ? 1 : 4)) % 5 };
+                else if (state.view === "log" && (k.pageDown || k.pageUp || k.upArrow || k.downArrow || action === "follow")) {
+                    const snap = source.snapshot();
+                    const sourceLog = { journal: snap.journal, page: source.page, runId, columns: geometry().bodyColumns };
+                    const delta = (k.pageDown || k.downArrow ? 1 : -1) * (k.pageDown || k.pageUp ? geometry().bodyRows : 1);
+                    state = { ...state, logEnd: action === "follow" ? state.logEnd === undefined ? snap.journal.lines : undefined
+                            : moveLogEnd(sourceLog, state.logEnd, delta), scroll: 0 };
+                }
                 else if ((k.pageDown || k.pageUp) && state.view !== "run")
                     state = { ...state, scroll: Math.max(0, state.scroll + (k.pageDown ? 1 : -1) * geometry().bodyRows) };
                 else if (k.return || action === "open") {
@@ -471,7 +496,7 @@ export async function runConsolidatedCockpit(options) {
                 else if (text === "a")
                     state = { ...state, overlay: ["Existing CLI actions", "tickmarkr fleet", "tickmarkr plan", "tickmarkr doctor"], overlayOffset: 0 };
             }
-            if (!terminal && state.view !== "run" && !state.overlay && !state.help && state.editor === undefined) {
+            if (!terminal && state.view !== "run" && state.view !== "log" && !state.overlay && !state.help && state.editor === undefined) {
                 const bytes = k.upArrow ? "\x1b[A" : k.downArrow ? "\x1b[B" : k.rightArrow ? "\x1b[C" : k.leftArrow ? "\x1b[D" : k.pageUp ? "\x1b[5~" : k.pageDown ? "\x1b[6~" : text === "f" ? "f" : undefined;
                 if (bytes)
                     forwardLeaf(bytes);
@@ -700,7 +725,7 @@ export async function runConsolidatedCockpit(options) {
                     const usedTasks = new Set();
                     for (const row of plan.paintedRows) {
                         if (row.row < plan.bodyRow && (row.text.startsWith("1 Home") || row.text.startsWith("1H"))) {
-                            for (const binding of bindings.filter(binding => ["home", "run", "evidence"].includes(binding.action))) {
+                            for (const binding of bindings.filter(binding => ["home", "run", "evidence", "log"].includes(binding.action))) {
                                 const caption = plan.columns < 60 ? `${binding.key}${binding.label[0]}` : `${binding.key} ${binding.label}`;
                                 const index = row.text.indexOf(caption);
                                 if (index >= 0)
@@ -758,7 +783,8 @@ export async function runConsolidatedCockpit(options) {
                     committedTargets = targets;
                 }, children: state.view === "home" ? _jsx(ShellGridFlow, { width: p.bodyColumns, columns: p.columns < 120 ? 2 : 3, rowHeight: p.rows < 20 ? 1 : p.columns < 120 ? 2 : 3, children: _jsx(HomeView, { width: p.bodyColumns, model: homeModel, focused: focused, onOpenPark: id => { runSession = { ...runSession, selection: Math.max(0, snap.operator.tasks.findIndex(t => t.id === id)) }; state = { ...state, view: "run", scroll: 0 }; followSelection(); publish(); }, onOpenDiagnostic: id => { state = { ...state, overlay: [id], overlayOffset: 0 }; publish(); }, onOpenEvidence: openEvidence, onSelectNeedsYou: reportHomeNeedsYouSelection }, String(homeModel.needsYou.length > 0)) }) :
                     state.view === "run" ? _jsx(RunView, { snapshot: snap.operator, rows: snap.journal.history, page: source.page, graph: snap.graph.value, decisions: visibleDecisions, session: runSession, columns: p.bodyColumns, run: approvalRunOwner(cwd, runId), now: options.now }) :
-                        _jsx(ShellJournalSelection.Provider, { value: reportEvidenceSelection, children: _jsx(EvidenceView, { width: p.bodyColumns, model: { ...model, journal: evidenceRows }, focusEvidence: selectedEvidence, focused: focused, onExport: beginExport, onSelect: id => { selectedEvidence = id; openDetail(); publish(); } }, `${state.query}:${evidenceNavigation}`) }) });
+                        state.view === "log" ? _jsx(LogView, { page: readLogPage({ journal: snap.journal, page: source.page, runId, columns: p.bodyColumns }, p.bodyRows, state.logEnd) }) :
+                            _jsx(ShellJournalSelection.Provider, { value: reportEvidenceSelection, children: _jsx(EvidenceView, { width: p.bodyColumns, model: { ...model, journal: evidenceRows }, focusEvidence: selectedEvidence, focused: focused, onExport: beginExport, onSelect: id => { selectedEvidence = id; openDetail(); publish(); } }, `${state.query}:${evidenceNavigation}`) }) });
         }
         app = render(_jsx(App, {}), { stdin, stdout: output, debug: options.debug, exitOnCtrlC: false, patchConsole: false });
         void app.waitUntilExit().then(() => stop(), stop);