tickmarkr 2.6.4 → 2.6.6

package/dist/config/fleet-overlay.js

@@ -1,6 +1,6 @@
 // Fleet-overlay mutation, serialization, and diff rendering for the `tickmarkr fleet` write path.
-import { isMap, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
-import { DENY_SCOPES, universeCovers, universeEntryMatches } from "./config.js";
+import { isAlias, isCollection, isMap, isNode, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
+import { ConfigError, DENY_SCOPES, universeCovers, universeEntryMatches } from "./config.js";
 // OBS-1099 add.1: the writer ranges over the schema-derived scopes. The flat (all-seats) scopes
 // take part in the membership/allow-form write; every nested scope (routing.deny.workers.*) is a
 // literal deny list written on its own. ponytail: "flat" = directly under routing.deny. Read
@@ -64,9 +64,12 @@ function residualDeny(universe, entries) {
 // list keeps its node. A staged entry the allow form cannot express as a membership key (outside the
 // probe universe, or a bare-model/identity spelling) is written verbatim too; canonical keys the
 // session added ride the allow form alone.
+// T10 (D-973): read as the loader reads these bytes (readYaml parses with yaml's defaults, as toJS does
+// here) — aliases at the leaf, its items and every ancestor resolve, and `<<` merges only in a document
+// whose YAML version merges — so an aliased list's entries are authored entries too.
 function authoredEntries(doc, path) {
-    const node = doc.getIn(path, true);
-    return isSeq(node) ? node.items.flatMap((item) => (isScalar(item) ? [String(item.value)] : [])) : [];
+    const value = path.reduce((node, key) => (node !== null && typeof node === "object" ? node[key] : undefined), doc.toJS());
+    return Array.isArray(value) ? value.flatMap((item) => (item === null || typeof item !== "object" ? [String(item)] : [])) : [];
 }
 function flatDenyAfterWrite(doc, path, after, universe) {
     const authored = authoredEntries(doc, path);
@@ -112,8 +115,10 @@ function unpackFleetProvenance(provenance) {
 }
 function setScalarPreservingComment(doc, path, value, authoredComment) {
     const existing = doc.getIn(path, true);
-    if (isScalar(existing))
+    if (isScalar(existing)) {
+        releaseAnchors(doc, path);
         existing.value = value;
+    }
     else
         setAt(doc, path, doc.createNode(value));
     if (authoredComment !== undefined) {
@@ -146,6 +151,10 @@ function setStringSequencePreservingComments(doc, path, values) {
         setAt(doc, path, doc.createNode(values));
         return;
     }
+    // T10 owed review F2: an unchanged list is not edited, so its anchor and every alias keep their bytes
+    if (existing.items.length === values.length && existing.items.every((item, at) => isScalar(item) && String(item.value) === values[at]))
+        return;
+    releaseAnchors(doc, path); // an anchored list is edited in place: its other aliases keep the original
     const available = [...existing.items];
     existing.items = values.map((value) => {
         const at = available.findIndex((item) => isScalar(item) && String(item.value) === value);
@@ -161,31 +170,150 @@ function setStringSequencePreservingComments(doc, path, values) {
 // Total forms: a delete treats the masked subtree as absent (the operator's tombstone already
 // denies it, and survives untouched); a set clears the scalar and rebuilds what fleet owns —
 // the routing.allow precedent below.
+// T8 repair: an alias is no tombstone — `spec: *empty` resolves to a mapping. Each alias on the path
+// is replaced by an un-anchored copy of its target, so what it resolves to decides, and a write under
+// it never edits the anchored node its other aliases share.
+function materializeAliases(doc, path) {
+    for (let depth = 1; depth < path.length; depth++) {
+        const node = doc.getIn(path.slice(0, depth), true);
+        if (!isAlias(node))
+            continue;
+        const target = node.resolve(doc);
+        if (target === undefined)
+            return;
+        doc.setIn(path.slice(0, depth), detachedCopy(doc, node, target, new Set()));
+    }
+}
+// T10 (D-973): a write mutates every ancestor on its path and edits or replaces the leaf with all it
+// holds; any of those nodes may be an anchor other aliases share. Each such alias first becomes a
+// detached copy of what it resolved to, so the write never changes another consumer's value nor
+// leaves its alias dangling.
+function releaseAnchors(doc, path) {
+    const held = new Set();
+    for (let depth = 1; depth <= path.length; depth++) {
+        const node = doc.getIn(path.slice(0, depth), true);
+        if (!isNode(node))
+            break;
+        for (const inner of depth < path.length ? [node] : nodesOf(node)) {
+            if (!isAlias(inner) && inner.anchor)
+                held.add(inner);
+        }
+    }
+    if (!held.size)
+        return;
+    visit(doc, {
+        Alias: (_key, alias) => {
+            const target = alias.resolve(doc);
+            return target !== undefined && held.has(target) ? detachedCopy(doc, alias, target, new Set()) : undefined;
+        },
+    });
+}
+const nodesOf = (root) => {
+    const out = [];
+    visit(root, (_key, node) => {
+        if (isNode(node))
+            out.push(node);
+    });
+    return out;
+};
+// D-821: a copy carries NO anchor (a nested `&empty` would rebind `plan: *empty` and every later
+// alias to the edited copy), and each inner alias must still name what it named in the original —
+// one whose anchor is redefined before `at` is replaced by a detached copy of its original target.
+function detachedCopy(doc, at, target, expanding) {
+    if (expanding.has(target))
+        throw new Error(`fleet cannot detach the recursive YAML alias *${at.source}`);
+    const visible = new Map();
+    visit(doc, (_key, node) => {
+        if (node === at)
+            return visit.BREAK;
+        if (isNode(node) && !isAlias(node) && node.anchor)
+            visible.set(node.anchor, node);
+    });
+    const copy = target.clone();
+    const originals = nodesOf(target);
+    const replace = new Map();
+    nodesOf(copy).forEach((node, index) => {
+        if (!isAlias(node)) {
+            node.anchor = undefined;
+            return;
+        }
+        const resolved = originals[index].resolve(doc);
+        if (resolved !== undefined && visible.get(node.source) !== resolved) {
+            replace.set(node, detachedCopy(doc, at, resolved, new Set([...expanding, target])));
+        }
+    });
+    if (!replace.size)
+        return copy;
+    visit(copy, (_key, node) => (isNode(node) ? replace.get(node) : undefined));
+    return copy;
+}
+function underScalar(doc, path) {
+    for (let depth = 1; depth < path.length; depth++) {
+        const node = doc.getIn(path.slice(0, depth), true);
+        if (node === undefined)
+            return false;
+        if (!isMap(node))
+            return true;
+    }
+    return false;
+}
 function deleteAt(doc, path) {
+    materializeAliases(doc, path); // an aliased mapping is no tombstone: Auto under `spec: *pinned` deletes the pin
     for (let depth = 1; depth < path.length; depth++) {
         if (!isMap(doc.getIn(path.slice(0, depth), true)))
             return;
     }
     // deleteIn throws on an empty document — only delete keys that exist.
-    if (doc.getIn(path) !== undefined)
-        doc.deleteIn(path);
+    if (doc.getIn(path) === undefined)
+        return;
+    releaseAnchors(doc, path);
+    doc.deleteIn(path);
 }
 function setAt(doc, path, value) {
+    materializeAliases(doc, path); // edit a copy of an aliased mapping, never drop what it resolved to
+    releaseAnchors(doc, path);
     for (let depth = 1; depth < path.length; depth++) {
         const node = doc.getIn(path.slice(0, depth), true);
         if (node === undefined)
             break;
         if (!isMap(node)) {
-            doc.deleteIn(path.slice(0, depth));
+            const prefix = path.slice(0, depth);
+            doc.deleteIn(prefix);
+            // T10: a null mask over membership lists stays a mask for every deny leaf — and the routing.allow
+            // block — this write does not set, so materializing one leaf never resurrects a lower layer's
+            // other deny lists or its allow form (judge/review/consult reach)
+            if (isScalar(node) && node.value === null) {
+                const under = (inner, outer) => outer.every((key, at) => inner[at] === key);
+                for (const masked of [...DENY_SCOPES.map((scope) => scope.path), ["routing", "allow"]]) {
+                    if (under(masked, prefix) && !under(masked, path) && !under(path, masked))
+                        doc.setIn(masked, doc.createNode(null));
+                }
+            }
             break;
         }
     }
     doc.setIn(path, value);
 }
+// T10 (D-987): Fleet writes through no YAML merge key — a membership write whose edited path (the edited
+// leaf or any map above it) takes keys through `<<` is refused, fail-closed, so nothing is published.
+function refuseMerge(doc, priorBytes, path) {
+    let node = doc.contents;
+    for (let depth = 0; depth <= path.length && isMap(node); depth++) {
+        const merge = node.items.find((item) => isScalar(item.key) && typeof item.key.value === "symbol");
+        if (merge) {
+            const range = isNode(merge.value) ? merge.value.range : undefined;
+            const shape = range ? priorBytes.slice(range[0], range[1]).trim().replace(/\s+/g, " ") : "…";
+            throw new ConfigError(`${path.join(".")} takes keys through the YAML merge key \`<<: ${shape}\` in ${path.slice(0, depth).join(".") || "the document root"} — Fleet does not write through merge keys; inline the merged keys there by hand, then save again`);
+        }
+        node = depth < path.length ? node.get(path[depth], true) : undefined;
+        if (isAlias(node))
+            node = node.resolve(doc);
+    }
+}
 function deleteEmptyMap(doc, path) {
     const node = doc.getIn(path, true);
     if (isMap(node) && node.items.length === 0)
-        doc.deleteIn(path);
+        deleteAt(doc, path);
 }
 /** Apply only fields fleet authored to the parsed YAML document. Untouched nodes retain their
  * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
@@ -201,24 +329,49 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     const flatChanged = new Map(FLAT_DENY_SCOPES.map((scope) => [scope.key, changed(...listsOf(write, scope))]));
     if ([...flatChanged.values()].some(Boolean) || changed(initial.allowOut, edited.allowOut)) {
         if (write.universe) {
+            refuseMerge(doc, priorBytes, ["routing", "allow"]);
             // Membership write: the allow form IS the fleet; deny adapters/models scopes are tombstoned
             // so a lower layer can never re-exclude behind the operator's back (workers untouched).
             const form = allowFormFromExclusions(write.universe, edited);
+            const universe = write.universe;
+            const known = (entry) => universe.some((row) => entry === row.adapter || row.models.some((m) => universeEntryMatches(row, m, entry)));
+            const retainedAll = [];
+            for (const leaf of ["adapters", "models"]) {
+                const retained = [...(write.preservedAllow?.[leaf] ?? []), ...authoredEntries(doc, ["routing", "allow", leaf])]
+                    .filter((entry) => !known(entry));
+                if (!retained.length)
+                    continue;
+                retainedAll.push(...retained);
+                form[leaf] = sortedUnique([...form[leaf], ...retained]);
+                form.excluded = true;
+            }
+            // T10 review: a retained allow entry admits a channel the allow form cannot see, so a staged flat
+            // deny covering it stays in deny verbatim — folded into the allow form alone, the retained entry
+            // would re-admit what the operator just excluded (rail out · all over an unprobed fake:U).
+            // Either allow leaf admits a bare model (routing matches both leaves alike), so coverage never
+            // depends on which leaf retained the entry.
+            // ponytail: a bare retained entry's adapter is unknown, so any discovered adapter id covers it;
+            // an identity alias of an unprobed channel is unknowable and is matched by spelling only.
+            const coversRetained = (entry) => retainedAll.some((kept) => {
+                const colon = kept.indexOf(":");
+                if (colon !== -1) {
+                    const model = kept.slice(colon + 1);
+                    return universeEntryMatches({ adapter: kept.slice(0, colon), models: [model] }, model, entry);
+                }
+                return entry === kept || universe.some((row) => row.adapter === entry);
+            });
             if (form.excluded) {
                 const allowNode = doc.getIn(["routing", "allow"], true);
                 if (allowNode !== undefined && !isMap(allowNode))
-                    doc.deleteIn(["routing", "allow"]);
-                if (form.adapters.length) {
-                    setStringSequencePreservingComments(doc, ["routing", "allow", "adapters"], form.adapters);
-                }
-                else {
-                    deleteAt(doc, ["routing", "allow", "adapters"]);
-                }
-                if (form.models.length) {
-                    setStringSequencePreservingComments(doc, ["routing", "allow", "models"], form.models);
-                }
-                else {
-                    deleteAt(doc, ["routing", "allow", "models"]);
+                    deleteAt(doc, ["routing", "allow"]);
+                for (const leaf of ["adapters", "models"]) {
+                    const path = ["routing", "allow", leaf];
+                    if (form[leaf].length)
+                        setStringSequencePreservingComments(doc, path, form[leaf]);
+                    else if (write.lowerAllow?.[leaf] != null)
+                        setStringSequencePreservingComments(doc, path, null);
+                    else
+                        deleteAt(doc, path);
                 }
                 // Whole fleet out: allow stays present but empty — fail-closed, nothing admitted.
                 if (doc.getIn(["routing", "allow"]) === undefined) {
@@ -226,8 +379,12 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 }
             }
             else {
-                // Whole fleet in: no restriction to express — the allow block goes away entirely.
-                deleteAt(doc, ["routing", "allow"]);
+                // Whole fleet in: no restriction to express — the allow block goes away entirely, or is
+                // masked when a lower layer's allow would otherwise come back (T10 A/B resurrection).
+                if (write.lowerAllow)
+                    setAt(doc, ["routing", "allow"], doc.createNode(null));
+                else
+                    deleteAt(doc, ["routing", "allow"]);
             }
             // Authored and non-canonical entries stay in deny (LEG2-T3 finding 4, round 2 finding 2).
             // OBS-1046: only an EDITED scope is rewritten, and only when its bytes must change — an
@@ -248,7 +405,8 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 const stale = authored.some((entry) => admitted.includes(entry));
                 if (!touched && !stale)
                     continue;
-                const remaining = flatDenyAfterWrite(doc, path, after, write.universe);
+                refuseMerge(doc, priorBytes, path);
+                const remaining = [...new Set([...flatDenyAfterWrite(doc, path, after, write.universe), ...after.filter(coversRetained)])];
                 if (remaining.length) {
                     if (remaining.join("\n") !== authored.join("\n"))
                         setStringSequencePreservingComments(doc, path, remaining);
@@ -262,6 +420,7 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             for (const scope of FLAT_DENY_SCOPES) {
                 if (!flatChanged.get(scope.key))
                     continue;
+                refuseMerge(doc, priorBytes, scope.path);
                 const after = edited[scope.key] ?? [];
                 setStringSequencePreservingComments(doc, scope.path, after.length ? sortedUnique(after) : null);
             }
@@ -276,16 +435,25 @@ export function renderFleetOverlayWrite(priorBytes, write) {
         const [before, after] = listsOf(write, scope);
         if (!changed(before, after))
             continue;
+        refuseMerge(doc, priorBytes, scope.path);
         setStringSequencePreservingComments(doc, scope.path, after.length ? sortedUnique(after) : null);
     }
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
         const before = initial.map[shape];
         const after = edited.map[shape];
-        if (JSON.stringify(before?.pin) !== JSON.stringify(after?.pin)) {
+        const pinPath = ["routing", "map", shape, "pin"];
+        const declares = after?.pin !== undefined || after?.pool !== undefined || after?.prefer !== undefined;
+        if (!declares && write.lowerMap?.[shape]?.pin !== undefined && JSON.stringify(before) !== JSON.stringify(after)) {
+            // pin: null tombstone — masks the lower-layer pin; a scalar tombstone above it already masks the entry
+            materializeAliases(doc, pinPath);
+            if (!underScalar(doc, pinPath))
+                setScalarPreservingComment(doc, pinPath, null);
+        }
+        else if (JSON.stringify(before?.pin) !== JSON.stringify(after?.pin)) {
             if (after?.pin === undefined)
-                deleteAt(doc, ["routing", "map", shape, "pin"]);
+                deleteAt(doc, pinPath);
             else
-                setAt(doc, ["routing", "map", shape, "pin"], doc.createNode(after.pin));
+                setAt(doc, pinPath, doc.createNode(after.pin));
         }
         if (JSON.stringify(before?.pool) !== JSON.stringify(after?.pool)) {
             const path = ["routing", "map", shape, "pool"];
@@ -457,8 +625,9 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     // byte-identical to yaml's own stringifyComment. OBS-1046: a scalar parsed from the prior bytes
     // keeps the exact whitespace it had before its hash sign (yaml itself emits one space, so the
     // sentinel carries the rest); only a comment fleet authored gets the two-space style.
+    // T10 (D-936): a flow collection's trailing note (`[codex]  # c`) is inline too, so it keeps its gap.
     visit(doc, (_key, node) => {
-        if (isScalar(node) && typeof node.comment === "string" && !node.comment.includes("\n")) {
+        if ((isScalar(node) || (isCollection(node) && node.flow)) && typeof node.comment === "string" && !node.comment.includes("\n")) {
             const tail = node.range ? priorBytes.slice(node.range[1], node.range[2]) : "";
             const gap = /^([ \t]+)#/.exec(tail)?.[1] ?? "  ";
             node.comment = `${INLINE_COMMENT_SENTINEL}${gap.slice(1)}#${node.comment}`;
@@ -474,6 +643,39 @@ export function renderFleetOverlayWrite(priorBytes, write) {
         flowCollectionPadding: false,
     });
 }
+/** T10: the 1-based line of the key that holds `path` in these overlay bytes — the path's own key, the
+ * key whose `null` masks it from above, or a `<<` merge key on it (D-987: the write there refuses) — else
+ * undefined (the overlay neither declares nor masks it). */
+export function overlayHoldingLine(bytes, path) {
+    const doc = parseDocument(bytes);
+    if (doc.errors.length)
+        return undefined;
+    const lineOf = (offset) => bytes.slice(0, offset).split("\n").length;
+    let node = doc.contents;
+    let line;
+    for (const key of path) {
+        if (isAlias(node))
+            node = node.resolve(doc);
+        if (line !== undefined && isScalar(node) && node.value === null)
+            return line; // a mask at or above
+        if (!isMap(node))
+            return undefined;
+        const merge = node.items.find((item) => isScalar(item.key) && typeof item.key.value === "symbol");
+        const pair = merge ?? node.items.find((item) => isScalar(item.key) && String(item.key.value) === key);
+        if (!pair || !isScalar(pair.key) || !pair.key.range)
+            return undefined;
+        line = lineOf(pair.key.range[0]);
+        if (merge)
+            return line;
+        node = pair.value;
+    }
+    return line;
+}
+/** T10: does `path` hold a mapping in these overlay bytes — neither absent nor a `null` mask? */
+export function overlayHoldsMap(bytes, path) {
+    const doc = parseDocument(bytes);
+    return !doc.errors.length && isMap(doc.getIn(path, true));
+}
 /** Build the repo overlay fragment fleet would write for edits since session start. */
 export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, firstTouches = {}, universe) {
     if (fleetEditableEquals(initial, edited))

package/dist/drivers/orca.d.ts

@@ -5,7 +5,7 @@ import { type ExecutorDriver, type FocusTarget, type FocusResult, type NotifyOpt
 /** The response families the ONE shared envelope parser serves. There is no second JSON seam. */
 export declare const ORCA_RESPONSE_FAMILIES: readonly ["status", "create", "list", "read", "send", "wait", "show", "close", "worktree-current", "worktree-set", "hooks-status", "split"];
 export type OrcaFamily = (typeof ORCA_RESPONSE_FAMILIES)[number];
-export declare const ORCA_FIXTURE_VERSION = "1.4.195";
+export declare const ORCA_FIXTURE_VERSION = "1.4.218";
 export declare const ORCA_CLI_COMMAND_ENV = "ORCA_CLI_COMMAND";
 export declare const STALE_HANDLE_CODE = "terminal_handle_stale";
 export declare const TERMINAL_GONE_CODE = "terminal_gone";
@@ -31,16 +31,18 @@ export declare class OrcaError extends Error {
     readonly raw: string;
     readonly code?: string;
     readonly runtimeId?: string;
+    readonly launchCause?: SeatLaunchCause;
     constructor(family: string, reason: string, raw: string, opts?: {
         code?: string;
         runtimeId?: string;
+        launchCause?: SeatLaunchCause;
     });
 }
 /** The slot cannot be addressed: dead/unknown terminal record, or a handle that cannot be recovered
  *  to exactly one owned terminal in the slot's own worktree. Never a silent false or empty string. */
 export declare class OrcaUnavailableError extends OrcaError {
     readonly terminalStatus?: string | undefined;
-    constructor(family: string, reason: string, raw: string, terminalStatus?: string | undefined);
+    constructor(family: string, reason: string, raw: string, terminalStatus?: string | undefined, launchCause?: SeatLaunchCause);
 }
 export interface OrcaEnvelope {
     result: Record<string, unknown>;
@@ -83,6 +85,10 @@ export declare function terminalWorktree(term: Record<string, unknown>): string
 export declare function canonicalWorktreePath(path: string): string;
 /** The proof line a worker terminal prints first: create, recovery and focus read it back. */
 export declare const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
+/** E1: the one typed launch cause a driver attaches to its launch failure. `checkout-proof-timeout`
+ *  means the terminal printed NO proof frame by the ceiling — a slow host, not a misplaced seat. A
+ *  foreign or malformed frame is placement evidence and carries no cause (never a timeout exemption). */
+export type SeatLaunchCause = "checkout-proof-timeout";
 /** The exact bytes the create command prints as its first line. */
 export declare function checkoutProofLine(checkout: string): string;
 /** Every complete frame in a scrollback, decoded and canonicalized; whether an incomplete one was seen. */
@@ -170,6 +176,17 @@ export interface OrcaDriverOpts {
     probeStalenessMs?: number;
     launchingHandle?: string;
 }
+/**
+ * F (D-832): what one proof page's OWN metadata says about the scrollback it was read from — the closed
+ * seam checkoutProven decides paging and absence by. `complete`: explicit `limited:false` and
+ * `truncated:false` with cursors that agree — nothing lies past this page. `partial`: explicit booleans,
+ * one of them true, cursors that agree — more scrollback exists. `unread`: everything else — a flag
+ * missing or not a boolean, a cursor that is not a string, `limited:false` with a next cursor short of
+ * the latest one (the contradictory "last" page), a blind stream page
+ * (isBlindStreamPage), or a source that is not the stream (`screen-unavailable`). Missing metadata is
+ * never inferred complete: its page's bytes still count as read evidence, but no absence rests on it.
+ */
+export declare function classifyProofPage(term: Record<string, unknown>): "complete" | "partial" | "unread";
 export declare class OrcaDriver implements ExecutorDriver {
     id: string;
     interactive: boolean;
@@ -250,6 +267,21 @@ export declare class OrcaDriver implements ExecutorDriver {
      * that supplied the ownership listing — else another terminal's or another runtime's bytes were
      * answered and nothing is proven. Proven means provesCheckout: exact canonical full-path equality
      * of a complete frame, no other checkout named, no incomplete frame.
+     * E1: with a `deadline` (create's window) there is ONE absolute deadline: a read is issued only while
+     * budget is left and is handed exactly that budget, and a page that still lands past it is late —
+     * nothing late proves the checkout. `seen` is what the scrollback showed, for the typed timeout:
+     * `misplaced` — a frame naming another checkout, a cut frame or an unparseable mark in anything read
+     * (the anchor's tail and every page included, even when paging stopped or a later read threw);
+     * `absent` — ONLY when every page down to the start of the scrollback was read before the ceiling
+     * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
+     * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read
+     * the ceiling cut off or never let start (the anchor included), or a page that landed late (even one
+     * carrying the right proof), a malformed page (its tail or cursors), a blind stream page
+     * (isBlindStreamPage), or — F (D-832) — any page read whose paging metadata classifyProofPage cannot
+     * call complete or partial (flags missing, not boolean or contradicted; even when they were omitted,
+     * that page's bytes stay evidence and its matching proof still proves). Unread output is unknown —
+     * never an empty page, never absence.
+     * Without a deadline (reconcile, recovery) only `proven` is consumed.
      */
     private checkoutProven;
     private recover;