tickmarkr 2.6.4 → 2.6.6

package/dist/cli/commands/init.js

@@ -132,7 +132,11 @@ you were handed the whole picture — list the repository root, open every guida
 - **The gates are the product.** Seven, defined in \`src/graph/schema.ts\`:
   \`build test lint evidence scope acceptance review\`. **That is DECLARATION order, not execution order** —
   the first five run as a battery that stops at its first red, then \`acceptance\` and \`review\` run
-  CONCURRENTLY (\`run-gates.ts:39\`, *"judge ‖ review"*). The first five are MANDATORY; only \`acceptance\` and
+  CONCURRENTLY (\`run-gates.ts:39\`, *"judge ‖ review"*). One repair reorders them: a repair the REVIEW sent
+  back (carried \`review:material\`, test selection on, no required repair test) runs build, lint, evidence and
+  scope, then \`acceptance\` ‖ \`review\`, then its test screen, so a review that re-reds an unchanged subject
+  starts no test at all; a test-red repair keeps the battery first. Either way nothing merges until the FULL
+  suite has passed on the merge-candidate commit. The first five are MANDATORY; only \`acceptance\` and
   \`review\` may be omitted per task. Implementations are in \`src/gates/\` — \`baseline.ts\` (build/test/lint,
   diffed against a recorded baseline so pre-existing failures are forgiven), \`evidence.ts\`, \`scope.ts\`,
   \`acceptance.ts\` (its judge reads the DIFF and every criterion must cite a changed hunk), \`review.ts\`
@@ -635,7 +639,8 @@ export async function init(argv, cwd = process.cwd(), io = {}) {
     const interactive = input.isTTY === true && output.isTTY === true && !(values.yes ?? false);
     // Act 1 — preferences. Only when the repo config does not exist yet: init never rewrites an
     // operator's config; re-tuning is `tickmarkr fleet` (act 3 below still runs). Act 1 writes only
-    // project execution preferences; model choices are act 3's, saved to the USER overlay (B2).
+    // project execution preferences; model choices are act 3's, saved by Fleet's one destination rule:
+    // the USER overlay (B2), except a membership edit the repo overlay holds (T10).
     if (!repoConfigExists) {
         if (interactive) {
             emitBanner();
@@ -673,7 +678,9 @@ export async function init(argv, cwd = process.cwd(), io = {}) {
     // Act 3 — fleet. The compact discovery surface prints BETWEEN the acts so the operator reads
     // what the fleet browser (and its presets overlay, raised on the first Shapes entry) ranks
     // with; the final summary then carries a pointer, not a repeat. Its confirmation is the shared
-    // Fleet actuator's: the reviewed choices land in the user overlay (gdir), never the repo's.
+    // Fleet actuator's: a preset (routing.mode) lands in the user overlay (gdir), and so does every
+    // choice except a routing.allow/deny membership edit this repo overlay holds — T10 writes that one
+    // where it is effective, and the review names the destination before y.
     if (interactive) {
         output.write(`${doc}\n`);
         doc = "discovery shown above — full matrix any time with `tickmarkr doctor`";

package/dist/cli/commands/plan.js

@@ -2,6 +2,7 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { parseArgs } from "node:util";
 import { allAdapters, doctorAgeMs, modelAuthExclusions, probeAll, readDoctor, rolePools, servableExclusions, servabilityLine } from "../../adapters/registry.js";
+import { aliasIdentityHeadlines } from "../../adapters/model-discovery-check.js";
 import { formatModelAuthLine, contextWindowLints, modelLints, preferEntryLints, ttyVisual } from "../../adapters/model-lints.js";
 import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
@@ -15,9 +16,11 @@ import { disallowedBy, excludedChannels, exclusionLine, observedSeat, routingEnt
 import { decayWeight, HALF_LIFE_RUNS, staffLedEvidence } from "../../route/profile.js";
 import { resolvedFloor, route, RoutingError } from "../../route/router.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
-import { modelId, modelProvider, pickReviewer } from "../../gates/review.js";
+import { carriedAuthorVendors, gateReviewerFloor, modelId, modelProvider, pickReviewer } from "../../gates/review.js";
 import { Journal, loadRoutingProfile, readProfileCursor, recordedGraphDefinitionHash, RUNS_WINDOW } from "../../run/journal.js";
 import { harnessLine, resolveHarness } from "../harness.js";
+import { codexCommitHeadline, codexEscapeRoleLine } from "../../adapters/codex-commit-check.js";
+import { codex } from "../../adapters/codex.js";
 import { channelKey, shq } from "../../adapters/types.js";
 import { shGit } from "../../run/git.js";
 import { runLockRunId, runStatusLine } from "../../run/lock.js";
@@ -135,6 +138,13 @@ async function taskInputFindings(tasks, cwd) {
     }
     return findings;
 }
+/**
+ * v2.6.5 T9 (D-862): a task the run never dispatched gates under the fresh route's author, so plan can
+ * mirror its review eligibility exactly. Once dispatched, resume state only the daemon decides (a restored
+ * or failed-over author, a tier climb, carried commits, a parked recheck) picks the author — fail closed.
+ * ponytail: unknown, not exact; call production's own resume functions once daemon.ts can export them (POOL).
+ */
+const resumeDecidesAuthor = (events, taskId) => events.some((row) => row.taskId === taskId && row.event === "task-dispatch");
 // v1.89 T4: harnessFrom is the resolver's INPUT — a caller (the byte-pinned goldens) fixes the location
 // and keeps this machine's absolute paths out of a fixture. The default is the INVOKED entrypoint,
 // `process.argv[1]`: the bin symlink a global install puts on PATH, which resolves to dist/cli/index.js.
@@ -183,6 +193,26 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             .filter((event) => event.event === "gate-result" && event.data.gate === "review" && typeof event.data.reviewer === "string")
             .map((event) => event.data.reviewer)
         : [];
+    // daemon.ts replayedReviewerExclusions: a journaled review-pool-demotion is excluded from every review
+    // pick of the resumed run this plan previews (reviewer role only).
+    const replayedReviewerExclusions = [...new Set((matchingEvents ?? [])
+            .filter((event) => event.event === "review-pool-demotion" && typeof event.data.reviewer === "string")
+            .map((event) => event.data.reviewer))];
+    const demotedReviewers = new Set(replayedReviewerExclusions);
+    // daemon.ts demotedChannels: the resumed run's worker exclusions (journal replayExcludedChannels).
+    const runJournal = matchingRunId ? Journal.open(cwd, matchingRunId) : undefined;
+    const demotedWorkers = runJournal?.replayExcludedChannels() ?? new Set();
+    // run-gates.ts retired (OBS-1025 add.2): seats with two no-verdicts this run are out of every pick, tallied
+    // as daemon.ts seeds reviewNoVerdicts — noVerdict rows only, and a checkout-proof timeout never strikes.
+    const noVerdicts = new Map();
+    for (const event of matchingEvents ?? []) {
+        if (event.event !== "review-no-verdict" || event.data.noVerdict !== true || typeof event.data.reviewer !== "string")
+            continue;
+        if (event.data.cause === "seat-launch-failed" && event.data.launchCause === "checkout-proof-timeout")
+            continue;
+        noVerdicts.set(event.data.reviewer, (noVerdicts.get(event.data.reviewer) ?? 0) + 1);
+    }
+    const retiredReviewers = [...noVerdicts].filter(([, n]) => n >= 2).map(([seat]) => seat);
     // OBS-947 repair: a resumed run re-dispatches only tasks whose replayed status is pending (or that the
     // journal never mentions). done, failed and human are all skipped alike, so rendering their preview
     // picks must not advance the shared reviewHistory — a phantom draw wraps the LRU and makes a later
@@ -243,9 +273,23 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     if (judgeDeny?.by === "deny") {
         lines.push(`REFUSAL OBS-576: judge seat ${cfg.judge.adapter}:${cfg.judge.model} is removed by flat routing.deny (${judgeDeny.entry}) — move worker-only policy to routing.deny.workers`, "");
     }
+    // v2.6.5 T9 (H): alias drift is read from the identity doctor persisted, never re-probed here.
+    const aliasHeadlines = aliasIdentityHeadlines(cfg, health);
+    if (aliasHeadlines.length)
+        lines.push(...aliasHeadlines, "");
     const entrySeats = routingEntrySeatLines(cfg);
     if (entrySeats.length)
         lines.push(...entrySeats, "");
+    // v2.6.6 T9 (K): Codex judge/review/consult seats launch with the worker grant (llm.ts, consult.ts), so a
+    // doctor-probed escape blocks them too; worker rows carry their own headline below.
+    const codexRoles = [
+        ...(cfg.judge.adapter === codex.id ? ["judge"] : []),
+        ...(pools.review.some((c) => c.adapter === codex.id) ? ["review"] : []),
+        ...(cfg.consult.adapter === codex.id || pools.consult.some((c) => c.adapter === codex.id) ? ["consult"] : []),
+    ];
+    const codexEscape = codexEscapeRoleLine(codexRoles, adapters, health);
+    if (codexEscape)
+        lines.push(codexEscape, "");
     // OBS-1185: the floor route() resolved for THIS task — a task hint over the configured/mode floor.
     const derivation = (t) => {
         const floor = resolvedFloor(t, cfg);
@@ -359,9 +403,36 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             return { line: "none — reviewPolicy judge-only: declared leaf paths", cost: 0 };
         let rotationSeat = 1;
         let rotationCount = 0;
-        const reviewer = pickReviewer(author, pools.review, [], cfg.review.prefer ?? [], task.routingHints?.floor, reviewHistory, (seat, count) => { rotationSeat = seat; rotationCount = count; });
+        // Dispatched before: no count, no single-seat claim, no previewed reviewer (and so no rotation draw this
+        // plan could name). Never a guess.
+        if (resumeDecidesAuthor(matchingEvents ?? [], task.id)) {
+            lints.push(`${task.id}: eligible cross-vendor review seat count unknown — resume state decides the author`);
+            return { line: "unknown — resume state decides the author", cost: 0 };
+        }
+        // Never dispatched, daemon.ts subjectAuthors is just the fresh author; its vendor stays off the review.
+        const authors = [channelKey(author)];
+        const authorVendors = carriedAuthorVendors(pools.review, authors);
+        // Production's inputs as the task's first review round sees them: excludeReviewers = daemon badReviewers =
+        // replayedReviewerExclusions. run-gates.ts:1303 floors on THIS task's journaled reviewers at their dispatched
+        // tiers (daemon taskReviewers) ∪ excludeReviewers, so a replayed exclusion RAISES the floor; :1305 picks
+        // with excludeReviewers ∪ retired. prefer only reorders (the seat count below passes none).
+        const priorReviewers = [...(matchingEvents ?? []).filter((e) => e.taskId === task.id && typeof e.data.reviewer === "string"
+                && ((e.event === "gate-result" && e.data.gate === "review") || e.event === "review-no-verdict"))
+                .map((e) => ({ reviewer: e.data.reviewer, tier: e.data.reviewerTier })), ...replayedReviewerExclusions];
+        const reviewFloor = gateReviewerFloor(task, cfg, author, pools.review, priorReviewers).floor;
+        const exclusions = [...replayedReviewerExclusions, ...retiredReviewers];
+        const reviewer = pickReviewer(author, pools.review, exclusions, cfg.review.prefer ?? [], reviewFloor, reviewHistory, (seat, count) => { rotationSeat = seat; rotationCount = count; }, demotedReviewers, authorVendors, authors);
         if (!reviewer)
             return { line: "none — no cross-vendor reviewer available", cost: 0 };
+        // v2.6.5 T9 (H): one flaked or demoted seat away from no reviewer. Enumerate the production filter
+        // (pickReviewer at the gate's floor) and count served identities, so two aliases of one model count once.
+        const seats = [];
+        for (let s; (s = pickReviewer(author, pools.review, [...exclusions, ...seats.map(channelKey)], [], reviewFloor, [], undefined, demotedReviewers, authorVendors, authors));)
+            seats.push(s);
+        const identities = new Set(seats.map((c) => c.identity ?? modelId(c.model)));
+        if (identities.size === 1) {
+            lints.push(`${task.id}: exactly one eligible cross-vendor review seat remains — identity ${[...identities][0]} via ${seats.map(channelKey).join(", ")}; one flake or demotion leaves no reviewer`);
+        }
         // Advance the simulated rotation only for tasks the run would actually dispatch next — the same
         // rule as readyTasks (src/graph/graph.ts): pending, with every dependency already done. A pending
         // task behind a parked/failed/pending dependency cannot run, so it consumes no draw (RULING-229-14).
@@ -402,7 +473,8 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             continue;
         }
         try {
-            const r = route(t, cfg, channels, dispatchProfile);
+            // daemon.ts:3322: the resumed run routes around its replayed worker exclusions.
+            const r = route(t, cfg, channels, dispatchProfile, undefined, demotedWorkers);
             routed.push({ taskId: t.id, adapter: r.assignment.adapter, model: r.assignment.model });
             for (const l of r.lints) {
                 const suf = exclusionReason(l);
@@ -412,7 +484,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             const judge = judgeSeat(t);
             const review = reviewSeat(t, r.assignment);
             cost += est + judge.cost + review.cost;
-            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`, `    judge: ${judge.line}${judge.cost ? ` ~$${judge.cost.toFixed(2)}` : ""}`, `    review: ${review.line}${review.cost ? ` ~$${review.cost.toFixed(2)}` : ""}`, chainLine(t));
+            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`, ...[codexCommitHeadline(r.assignment.adapter, adapters, health)].filter((l) => l !== null), `    judge: ${judge.line}${judge.cost ? ` ~$${judge.cost.toFixed(2)}` : ""}`, `    review: ${review.line}${review.cost ? ` ~$${review.cost.toFixed(2)}` : ""}`, chainLine(t));
             const d = derivation(t);
             if (d)
                 lines.push(d);

package/dist/cli/commands/verify.d.ts

@@ -7,7 +7,7 @@ export declare const HUMAN_AUTHOR: Assignment;
 export declare function verifyStateDir(cwd: string): string;
 /** Linked worktrees share operational state with the repository that owns the common git dir. */
 export declare function verifyStateRoot(cwd: string): Promise<string>;
-/** Cache identity is repository content, never a checkout path. */
+/** Repository content plus the effective runner inputs the daemon hashes; never a checkout path. */
 export declare function baselineCachePath(cwd: string, baseSha: string, commands: Record<string, string>): string;
 export declare function excludeAuthorProvider(channels: BillingChannel[], author: BillingChannel): BillingChannel[];
 export declare const VERIFY_HELP = "usage: tickmarkr verify [--base <ref>] [--criteria <file> | --task <id>] [--json]\nThe final verdict and JSON result are written to stdout; progress and diagnostics are written to stderr.\nDo not merge stdout and stderr (for example with 2>&1): doing so corrupts the verdict stream.";

package/dist/cli/commands/verify.js

@@ -1,13 +1,13 @@
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, utimesSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { parseArgs } from "node:util";
-import { allAdapters, probeAll, readDoctor, rolePools } from "../../adapters/registry.js";
+import { allAdapters, probeAll, readDoctor, rolePools, writeDoctor } from "../../adapters/registry.js";
 import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
 import { captureBaseline, detectGateCommands, staleFileCountCommands } from "../../gates/baseline.js";
-import { getVerdictStore } from "../../gates/cache.js";
+import { getVerdictStore, runnerInputsHash } from "../../gates/cache.js";
 import { modelProvider } from "../../gates/review.js";
 import { runGates } from "../../gates/run-gates.js";
 import { getTask, loadGraph } from "../../graph/graph.js";
@@ -17,6 +17,7 @@ import { linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.j
 import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
 import { withRepositoryLease } from "../../run/lease.js";
 import { isPidLive } from "../../run/lock.js";
+import { recordLaunchServices } from "../../run/launchservices-check.js";
 /**
  * tickmarkr verify — the gate battery as a standalone command (OPERATING-MODEL-2026-08-11 item 3).
  *
@@ -86,7 +87,7 @@ const hashParts = (parts) => {
         hash.update(part);
     return hash.digest("hex").slice(0, 12);
 };
-/** Cache identity is repository content, never a checkout path. */
+/** Repository content plus the effective runner inputs the daemon hashes; never a checkout path. */
 export function baselineCachePath(cwd, baseSha, commands) {
     const lockParts = [];
     for (const file of LOCKFILES) {
@@ -94,13 +95,44 @@ export function baselineCachePath(cwd, baseSha, commands) {
         lockParts.push(file, existsSync(path) ? readFileSync(path) : "<absent>");
     }
     const commandParts = Object.entries(commands).sort(([a], [b]) => a.localeCompare(b)).map(([name, command]) => `${name}\0${command}\0`);
-    return join(realpathSync(tmpdir()), "tickmarkr-verify", "cache", `baseline-${baseSha.slice(0, 12)}-${hashParts(lockParts)}-${hashParts(commandParts)}.json`);
+    return join(realpathSync(tmpdir()), "tickmarkr-verify", "cache", `baseline-${baseSha.slice(0, 12)}-${hashParts(lockParts)}-${hashParts(commandParts)}-${runnerInputsHash()}.json`);
 }
 const verdictlessCommands = (baseline, commands) => Object.keys(commands).filter((name) => baseline.commands[name]?.exitCode === undefined);
 export function excludeAuthorProvider(channels, author) {
     const provider = modelProvider(author.model, author.vendor);
     return [author, ...channels.filter((candidate) => candidate !== author && modelProvider(candidate.model, candidate.vendor) !== provider)];
 }
+/**
+ * G (D-874): `--author` names who wrote the diff so review can EXCLUDE it — it never asks for a seat. So
+ * it resolves against installed identities (an installed adapter's doctor-listed or configured model),
+ * not against the review pool, whose role allow/deny, model-auth and tier gates say nothing about
+ * authorship. A pool member resolves to itself, unchanged. Anything else is an author-only identity: its
+ * vendor is the configured declaration (the model's override, else the adapter entry's; the adapter's own
+ * only when config has no entry), never inferred, and an unseeded model carries no tier of its own — it
+ * holds the human sentinel's frontier floor, so the reviewer floor is never lowered. Same-vendor, so it
+ * can never be seated. An identity nothing declares refuses by name.
+ */
+function authorIdentity(claim, cfg, adapters, health, pool) {
+    const [adapter = "", ...rest] = claim.split(":");
+    const model = rest.join(":");
+    const member = pool.find((c) => c.adapter === adapter && c.model === model);
+    if (member)
+        return member;
+    const a = adapters.find((x) => x.id === adapter);
+    const h = health[adapter];
+    const seeded = a?.channels(cfg).find((c) => c.model === model);
+    const entry = cfg.tiers[adapter];
+    const vendor = seeded?.vendor ?? (entry ? entry.modelOverrides?.[model]?.vendor ?? entry.vendor : a?.vendor);
+    const why = !a ? `no registered adapter "${adapter}"`
+        : !h?.installed ? `doctor does not record ${adapter} as installed`
+            : !seeded && !h.models?.includes(model) ? `${adapter} neither lists "${model}" in doctor nor configures it`
+                : !vendor ? `no vendor is declared for ${adapter}:${model}`
+                    : undefined;
+    if (why) {
+        throw new Error(`--author ${claim} does not name a discoverable author identity (${why}) — name an installed adapter's doctor-listed or configured model as <adapter>:<model>, or human`);
+    }
+    return seeded ?? { adapter, vendor: vendor, model, channel: entry?.modelOverrides?.[model]?.channel ?? entry?.channel ?? "sub", tier: "frontier" };
+}
 function recordedMerges(repoRoot) {
     const runs = join(repoRoot, ".tickmarkr", "runs");
     if (!existsSync(runs))
@@ -287,6 +319,9 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
         const pools = rolePools(cfg, adapters, health);
         judgeChannels = pools.judge;
         channels = pools.review;
+        // Resolved before either branch so an undiscoverable claim refuses here, ahead of any capture —
+        // even where recorded authors bind and the claim is otherwise ignored.
+        const claimed = values.author && values.author !== "human" ? authorIdentity(values.author, cfg, adapters, health, channels) : undefined;
         if (owed.length) {
             // The run's lifetime patch authors bind the reviewer's exclusions; --author never overrides
             // them. An author the pool cannot resolve leaves review unseatable, which fails closed.
@@ -297,15 +332,9 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
             if (first)
                 author = { adapter: first.adapter, model: first.model, channel: first.channel, tier: first.tier };
         }
-        else if (values.author && values.author !== "human") {
-            const [adapter, ...rest] = values.author.split(":");
-            const model = rest.join(":");
-            const c = channels.find((ch) => ch.adapter === adapter && ch.model === model);
-            if (!c) {
-                throw new Error(`--author ${values.author} does not name a discoverable review channel — one of: ${channels.map(channelKey).join(", ") || "(none)"}`);
-            }
-            author = { adapter: c.adapter, model: c.model, channel: c.channel, tier: c.tier };
-            channels = excludeAuthorProvider(channels, c);
+        else if (claimed) {
+            author = { adapter: claimed.adapter, model: claimed.model, channel: claimed.channel, tier: claimed.tier };
+            channels = excludeAuthorProvider(channels, claimed);
         }
         else {
             channels = [...channels, HUMAN_CHANNEL];
@@ -378,7 +407,7 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
             console.error(`verify: reusing cached baseline for ${mergeBase.slice(0, 12)} (${names.join(", ")}: ${cachePath})`);
             return cached;
         }
-        console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} for ${names.join(", ")} (cached by base, lockfile and command hashes at ${cachePath})`);
+        console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} for ${names.join(", ")} (cached by base, lockfile, command and effective runner hashes at ${cachePath})`);
         // Unleased captures of the SAME checkout overlap, so each owns a unique base worktree and removes
         // only its own; the pid in the name lets a later verify sweep what a killed one left behind.
         for (const entry of readdirSync(stateDir)) {
@@ -577,6 +606,27 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
             ...review,
         });
     }
+    // A1 (D-787/D-789): one bounded launchservicesd identity read AFTER the verdict is final, so a suite
+    // that restarted the daemon is caught and the verdict, exit code and retries never depend on it.
+    // It rides the doctor.json verify read; with none there it creates no state file.
+    const doctorRoot = fileRoot("doctor.json");
+    const priorDoctor = readDoctor(doctorRoot);
+    const launchServices = priorDoctor ? await recordLaunchServices(priorDoctor, priorDoctor) : undefined;
+    if (launchServices && launchServices.health !== priorDoctor) {
+        // Evidence only, not a probe: keep doctor.json's mtime (the auth-cache freshness signal, doctorAgeMs),
+        // and a failed write is an advisory diagnostic — the verdict below is returned regardless.
+        const doctorFile = join(doctorRoot, ".tickmarkr", "doctor.json");
+        try {
+            const { atime, mtime } = statSync(doctorFile);
+            writeDoctor(doctorRoot, launchServices.health);
+            utimesSync(doctorFile, atime, mtime);
+        }
+        catch (e) {
+            console.error(`verify: launchservicesd evidence not persisted (${e instanceof Error ? e.message : String(e)}) (advisory — verdict unchanged)`);
+        }
+    }
+    if (launchServices?.line)
+        console.error(`verify: ${launchServices.line}`);
     if (values.json) {
         return { out: JSON.stringify({ base: baseTip, head, mergeBase, green, artifactPath, artifactSha256, artifactAvailability, results,
                 ...(owedAfter && owedLines.length ? { owed: { debt: owedAfter.debt, discharged: dischargeRefusal ? [] : owed.map((o) => o.id), ...(dischargeRefusal ? { refused: dischargeRefusal } : {}) } } : {}),

package/dist/config/fleet-overlay.d.ts

@@ -1,4 +1,4 @@
-import { type FleetEditable, type FleetUniverseRow, type LowerLayerModelOverrides, type RoutingMode } from "./config.js";
+import { type FleetEditable, type FleetUniverseRow, type LowerLayerModelOverrides, type MapEntry, type RoutingMode } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
 type FleetOverlayWriteFields = {
@@ -20,6 +20,15 @@ type FleetOverlayWriteFields = {
         };
     };
     universe?: FleetUniverseRow[];
+    lowerMap?: Record<string, MapEntry>;
+    preservedAllow?: {
+        adapters?: string[];
+        models?: string[];
+    };
+    lowerAllow?: {
+        adapters?: string[];
+        models?: string[];
+    };
 };
 type EffortFree = FleetEditable & {
     efforts?: undefined;
@@ -39,6 +48,12 @@ export declare function fleetFirstTouchProvenance(note: string, firstTouch: Flee
 /** Apply only fields fleet authored to the parsed YAML document. Untouched nodes retain their
  * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
 export declare function renderFleetOverlayWrite(priorBytes: string, write: FleetOverlayWrite): string;
+/** T10: the 1-based line of the key that holds `path` in these overlay bytes — the path's own key, the
+ * key whose `null` masks it from above, or a `<<` merge key on it (D-987: the write there refuses) — else
+ * undefined (the overlay neither declares nor masks it). */
+export declare function overlayHoldingLine(bytes: string, path: readonly string[]): number | undefined;
+/** T10: does `path` hold a mapping in these overlay bytes — neither absent nor a `null` mask? */
+export declare function overlayHoldsMap(bytes: string, path: readonly string[]): boolean;
 /** Build the repo overlay fragment fleet would write for edits since session start. */
 export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>, universe?: FleetUniverseRow[]): Record<string, unknown>;
 export declare function repoOverlayYaml(overlay: Record<string, unknown>): string;