tickmarkr 2.6.5 → 2.6.6

package/dist/cli/commands/plan.js

@@ -19,7 +19,8 @@ import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.j
 import { carriedAuthorVendors, gateReviewerFloor, modelId, modelProvider, pickReviewer } from "../../gates/review.js";
 import { Journal, loadRoutingProfile, readProfileCursor, recordedGraphDefinitionHash, RUNS_WINDOW } from "../../run/journal.js";
 import { harnessLine, resolveHarness } from "../harness.js";
-import { codexCommitHeadline } from "../../adapters/codex-commit-check.js";
+import { codexCommitHeadline, codexEscapeRoleLine } from "../../adapters/codex-commit-check.js";
+import { codex } from "../../adapters/codex.js";
 import { channelKey, shq } from "../../adapters/types.js";
 import { shGit } from "../../run/git.js";
 import { runLockRunId, runStatusLine } from "../../run/lock.js";
@@ -279,6 +280,16 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     const entrySeats = routingEntrySeatLines(cfg);
     if (entrySeats.length)
         lines.push(...entrySeats, "");
+    // v2.6.6 T9 (K): Codex judge/review/consult seats launch with the worker grant (llm.ts, consult.ts), so a
+    // doctor-probed escape blocks them too; worker rows carry their own headline below.
+    const codexRoles = [
+        ...(cfg.judge.adapter === codex.id ? ["judge"] : []),
+        ...(pools.review.some((c) => c.adapter === codex.id) ? ["review"] : []),
+        ...(cfg.consult.adapter === codex.id || pools.consult.some((c) => c.adapter === codex.id) ? ["consult"] : []),
+    ];
+    const codexEscape = codexEscapeRoleLine(codexRoles, adapters, health);
+    if (codexEscape)
+        lines.push(codexEscape, "");
     // OBS-1185: the floor route() resolved for THIS task — a task hint over the configured/mode floor.
     const derivation = (t) => {
         const floor = resolvedFloor(t, cfg);

package/dist/cli/commands/verify.js

@@ -102,6 +102,37 @@ export function excludeAuthorProvider(channels, author) {
     const provider = modelProvider(author.model, author.vendor);
     return [author, ...channels.filter((candidate) => candidate !== author && modelProvider(candidate.model, candidate.vendor) !== provider)];
 }
+/**
+ * G (D-874): `--author` names who wrote the diff so review can EXCLUDE it — it never asks for a seat. So
+ * it resolves against installed identities (an installed adapter's doctor-listed or configured model),
+ * not against the review pool, whose role allow/deny, model-auth and tier gates say nothing about
+ * authorship. A pool member resolves to itself, unchanged. Anything else is an author-only identity: its
+ * vendor is the configured declaration (the model's override, else the adapter entry's; the adapter's own
+ * only when config has no entry), never inferred, and an unseeded model carries no tier of its own — it
+ * holds the human sentinel's frontier floor, so the reviewer floor is never lowered. Same-vendor, so it
+ * can never be seated. An identity nothing declares refuses by name.
+ */
+function authorIdentity(claim, cfg, adapters, health, pool) {
+    const [adapter = "", ...rest] = claim.split(":");
+    const model = rest.join(":");
+    const member = pool.find((c) => c.adapter === adapter && c.model === model);
+    if (member)
+        return member;
+    const a = adapters.find((x) => x.id === adapter);
+    const h = health[adapter];
+    const seeded = a?.channels(cfg).find((c) => c.model === model);
+    const entry = cfg.tiers[adapter];
+    const vendor = seeded?.vendor ?? (entry ? entry.modelOverrides?.[model]?.vendor ?? entry.vendor : a?.vendor);
+    const why = !a ? `no registered adapter "${adapter}"`
+        : !h?.installed ? `doctor does not record ${adapter} as installed`
+            : !seeded && !h.models?.includes(model) ? `${adapter} neither lists "${model}" in doctor nor configures it`
+                : !vendor ? `no vendor is declared for ${adapter}:${model}`
+                    : undefined;
+    if (why) {
+        throw new Error(`--author ${claim} does not name a discoverable author identity (${why}) — name an installed adapter's doctor-listed or configured model as <adapter>:<model>, or human`);
+    }
+    return seeded ?? { adapter, vendor: vendor, model, channel: entry?.modelOverrides?.[model]?.channel ?? entry?.channel ?? "sub", tier: "frontier" };
+}
 function recordedMerges(repoRoot) {
     const runs = join(repoRoot, ".tickmarkr", "runs");
     if (!existsSync(runs))
@@ -288,6 +319,9 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
         const pools = rolePools(cfg, adapters, health);
         judgeChannels = pools.judge;
         channels = pools.review;
+        // Resolved before either branch so an undiscoverable claim refuses here, ahead of any capture —
+        // even where recorded authors bind and the claim is otherwise ignored.
+        const claimed = values.author && values.author !== "human" ? authorIdentity(values.author, cfg, adapters, health, channels) : undefined;
         if (owed.length) {
             // The run's lifetime patch authors bind the reviewer's exclusions; --author never overrides
             // them. An author the pool cannot resolve leaves review unseatable, which fails closed.
@@ -298,15 +332,9 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
             if (first)
                 author = { adapter: first.adapter, model: first.model, channel: first.channel, tier: first.tier };
         }
-        else if (values.author && values.author !== "human") {
-            const [adapter, ...rest] = values.author.split(":");
-            const model = rest.join(":");
-            const c = channels.find((ch) => ch.adapter === adapter && ch.model === model);
-            if (!c) {
-                throw new Error(`--author ${values.author} does not name a discoverable review channel — one of: ${channels.map(channelKey).join(", ") || "(none)"}`);
-            }
-            author = { adapter: c.adapter, model: c.model, channel: c.channel, tier: c.tier };
-            channels = excludeAuthorProvider(channels, c);
+        else if (claimed) {
+            author = { adapter: claimed.adapter, model: claimed.model, channel: claimed.channel, tier: claimed.tier };
+            channels = excludeAuthorProvider(channels, claimed);
         }
         else {
             channels = [...channels, HUMAN_CHANNEL];

package/dist/config/fleet-overlay.d.ts

@@ -21,6 +21,14 @@ type FleetOverlayWriteFields = {
     };
     universe?: FleetUniverseRow[];
     lowerMap?: Record<string, MapEntry>;
+    preservedAllow?: {
+        adapters?: string[];
+        models?: string[];
+    };
+    lowerAllow?: {
+        adapters?: string[];
+        models?: string[];
+    };
 };
 type EffortFree = FleetEditable & {
     efforts?: undefined;
@@ -40,6 +48,12 @@ export declare function fleetFirstTouchProvenance(note: string, firstTouch: Flee
 /** Apply only fields fleet authored to the parsed YAML document. Untouched nodes retain their
  * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
 export declare function renderFleetOverlayWrite(priorBytes: string, write: FleetOverlayWrite): string;
+/** T10: the 1-based line of the key that holds `path` in these overlay bytes — the path's own key, the
+ * key whose `null` masks it from above, or a `<<` merge key on it (D-987: the write there refuses) — else
+ * undefined (the overlay neither declares nor masks it). */
+export declare function overlayHoldingLine(bytes: string, path: readonly string[]): number | undefined;
+/** T10: does `path` hold a mapping in these overlay bytes — neither absent nor a `null` mask? */
+export declare function overlayHoldsMap(bytes: string, path: readonly string[]): boolean;
 /** Build the repo overlay fragment fleet would write for edits since session start. */
 export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>, universe?: FleetUniverseRow[]): Record<string, unknown>;
 export declare function repoOverlayYaml(overlay: Record<string, unknown>): string;

package/dist/config/fleet-overlay.js

@@ -1,6 +1,6 @@
 // Fleet-overlay mutation, serialization, and diff rendering for the `tickmarkr fleet` write path.
-import { isAlias, isMap, isNode, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
-import { DENY_SCOPES, universeCovers, universeEntryMatches } from "./config.js";
+import { isAlias, isCollection, isMap, isNode, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
+import { ConfigError, DENY_SCOPES, universeCovers, universeEntryMatches } from "./config.js";
 // OBS-1099 add.1: the writer ranges over the schema-derived scopes. The flat (all-seats) scopes
 // take part in the membership/allow-form write; every nested scope (routing.deny.workers.*) is a
 // literal deny list written on its own. ponytail: "flat" = directly under routing.deny. Read
@@ -64,9 +64,12 @@ function residualDeny(universe, entries) {
 // list keeps its node. A staged entry the allow form cannot express as a membership key (outside the
 // probe universe, or a bare-model/identity spelling) is written verbatim too; canonical keys the
 // session added ride the allow form alone.
+// T10 (D-973): read as the loader reads these bytes (readYaml parses with yaml's defaults, as toJS does
+// here) — aliases at the leaf, its items and every ancestor resolve, and `<<` merges only in a document
+// whose YAML version merges — so an aliased list's entries are authored entries too.
 function authoredEntries(doc, path) {
-    const node = doc.getIn(path, true);
-    return isSeq(node) ? node.items.flatMap((item) => (isScalar(item) ? [String(item.value)] : [])) : [];
+    const value = path.reduce((node, key) => (node !== null && typeof node === "object" ? node[key] : undefined), doc.toJS());
+    return Array.isArray(value) ? value.flatMap((item) => (item === null || typeof item !== "object" ? [String(item)] : [])) : [];
 }
 function flatDenyAfterWrite(doc, path, after, universe) {
     const authored = authoredEntries(doc, path);
@@ -112,8 +115,10 @@ function unpackFleetProvenance(provenance) {
 }
 function setScalarPreservingComment(doc, path, value, authoredComment) {
     const existing = doc.getIn(path, true);
-    if (isScalar(existing))
+    if (isScalar(existing)) {
+        releaseAnchors(doc, path);
         existing.value = value;
+    }
     else
         setAt(doc, path, doc.createNode(value));
     if (authoredComment !== undefined) {
@@ -146,6 +151,10 @@ function setStringSequencePreservingComments(doc, path, values) {
         setAt(doc, path, doc.createNode(values));
         return;
     }
+    // T10 owed review F2: an unchanged list is not edited, so its anchor and every alias keep their bytes
+    if (existing.items.length === values.length && existing.items.every((item, at) => isScalar(item) && String(item.value) === values[at]))
+        return;
+    releaseAnchors(doc, path); // an anchored list is edited in place: its other aliases keep the original
     const available = [...existing.items];
     existing.items = values.map((value) => {
         const at = available.findIndex((item) => isScalar(item) && String(item.value) === value);
@@ -175,6 +184,30 @@ function materializeAliases(doc, path) {
         doc.setIn(path.slice(0, depth), detachedCopy(doc, node, target, new Set()));
     }
 }
+// T10 (D-973): a write mutates every ancestor on its path and edits or replaces the leaf with all it
+// holds; any of those nodes may be an anchor other aliases share. Each such alias first becomes a
+// detached copy of what it resolved to, so the write never changes another consumer's value nor
+// leaves its alias dangling.
+function releaseAnchors(doc, path) {
+    const held = new Set();
+    for (let depth = 1; depth <= path.length; depth++) {
+        const node = doc.getIn(path.slice(0, depth), true);
+        if (!isNode(node))
+            break;
+        for (const inner of depth < path.length ? [node] : nodesOf(node)) {
+            if (!isAlias(inner) && inner.anchor)
+                held.add(inner);
+        }
+    }
+    if (!held.size)
+        return;
+    visit(doc, {
+        Alias: (_key, alias) => {
+            const target = alias.resolve(doc);
+            return target !== undefined && held.has(target) ? detachedCopy(doc, alias, target, new Set()) : undefined;
+        },
+    });
+}
 const nodesOf = (root) => {
     const out = [];
     visit(root, (_key, node) => {
@@ -231,26 +264,56 @@ function deleteAt(doc, path) {
             return;
     }
     // deleteIn throws on an empty document — only delete keys that exist.
-    if (doc.getIn(path) !== undefined)
-        doc.deleteIn(path);
+    if (doc.getIn(path) === undefined)
+        return;
+    releaseAnchors(doc, path);
+    doc.deleteIn(path);
 }
 function setAt(doc, path, value) {
     materializeAliases(doc, path); // edit a copy of an aliased mapping, never drop what it resolved to
+    releaseAnchors(doc, path);
     for (let depth = 1; depth < path.length; depth++) {
         const node = doc.getIn(path.slice(0, depth), true);
         if (node === undefined)
             break;
         if (!isMap(node)) {
-            doc.deleteIn(path.slice(0, depth));
+            const prefix = path.slice(0, depth);
+            doc.deleteIn(prefix);
+            // T10: a null mask over membership lists stays a mask for every deny leaf — and the routing.allow
+            // block — this write does not set, so materializing one leaf never resurrects a lower layer's
+            // other deny lists or its allow form (judge/review/consult reach)
+            if (isScalar(node) && node.value === null) {
+                const under = (inner, outer) => outer.every((key, at) => inner[at] === key);
+                for (const masked of [...DENY_SCOPES.map((scope) => scope.path), ["routing", "allow"]]) {
+                    if (under(masked, prefix) && !under(masked, path) && !under(path, masked))
+                        doc.setIn(masked, doc.createNode(null));
+                }
+            }
             break;
         }
     }
     doc.setIn(path, value);
 }
+// T10 (D-987): Fleet writes through no YAML merge key — a membership write whose edited path (the edited
+// leaf or any map above it) takes keys through `<<` is refused, fail-closed, so nothing is published.
+function refuseMerge(doc, priorBytes, path) {
+    let node = doc.contents;
+    for (let depth = 0; depth <= path.length && isMap(node); depth++) {
+        const merge = node.items.find((item) => isScalar(item.key) && typeof item.key.value === "symbol");
+        if (merge) {
+            const range = isNode(merge.value) ? merge.value.range : undefined;
+            const shape = range ? priorBytes.slice(range[0], range[1]).trim().replace(/\s+/g, " ") : "…";
+            throw new ConfigError(`${path.join(".")} takes keys through the YAML merge key \`<<: ${shape}\` in ${path.slice(0, depth).join(".") || "the document root"} — Fleet does not write through merge keys; inline the merged keys there by hand, then save again`);
+        }
+        node = depth < path.length ? node.get(path[depth], true) : undefined;
+        if (isAlias(node))
+            node = node.resolve(doc);
+    }
+}
 function deleteEmptyMap(doc, path) {
     const node = doc.getIn(path, true);
     if (isMap(node) && node.items.length === 0)
-        doc.deleteIn(path);
+        deleteAt(doc, path);
 }
 /** Apply only fields fleet authored to the parsed YAML document. Untouched nodes retain their
  * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
@@ -266,24 +329,49 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     const flatChanged = new Map(FLAT_DENY_SCOPES.map((scope) => [scope.key, changed(...listsOf(write, scope))]));
     if ([...flatChanged.values()].some(Boolean) || changed(initial.allowOut, edited.allowOut)) {
         if (write.universe) {
+            refuseMerge(doc, priorBytes, ["routing", "allow"]);
             // Membership write: the allow form IS the fleet; deny adapters/models scopes are tombstoned
             // so a lower layer can never re-exclude behind the operator's back (workers untouched).
             const form = allowFormFromExclusions(write.universe, edited);
+            const universe = write.universe;
+            const known = (entry) => universe.some((row) => entry === row.adapter || row.models.some((m) => universeEntryMatches(row, m, entry)));
+            const retainedAll = [];
+            for (const leaf of ["adapters", "models"]) {
+                const retained = [...(write.preservedAllow?.[leaf] ?? []), ...authoredEntries(doc, ["routing", "allow", leaf])]
+                    .filter((entry) => !known(entry));
+                if (!retained.length)
+                    continue;
+                retainedAll.push(...retained);
+                form[leaf] = sortedUnique([...form[leaf], ...retained]);
+                form.excluded = true;
+            }
+            // T10 review: a retained allow entry admits a channel the allow form cannot see, so a staged flat
+            // deny covering it stays in deny verbatim — folded into the allow form alone, the retained entry
+            // would re-admit what the operator just excluded (rail out · all over an unprobed fake:U).
+            // Either allow leaf admits a bare model (routing matches both leaves alike), so coverage never
+            // depends on which leaf retained the entry.
+            // ponytail: a bare retained entry's adapter is unknown, so any discovered adapter id covers it;
+            // an identity alias of an unprobed channel is unknowable and is matched by spelling only.
+            const coversRetained = (entry) => retainedAll.some((kept) => {
+                const colon = kept.indexOf(":");
+                if (colon !== -1) {
+                    const model = kept.slice(colon + 1);
+                    return universeEntryMatches({ adapter: kept.slice(0, colon), models: [model] }, model, entry);
+                }
+                return entry === kept || universe.some((row) => row.adapter === entry);
+            });
             if (form.excluded) {
                 const allowNode = doc.getIn(["routing", "allow"], true);
                 if (allowNode !== undefined && !isMap(allowNode))
-                    doc.deleteIn(["routing", "allow"]);
-                if (form.adapters.length) {
-                    setStringSequencePreservingComments(doc, ["routing", "allow", "adapters"], form.adapters);
-                }
-                else {
-                    deleteAt(doc, ["routing", "allow", "adapters"]);
-                }
-                if (form.models.length) {
-                    setStringSequencePreservingComments(doc, ["routing", "allow", "models"], form.models);
-                }
-                else {
-                    deleteAt(doc, ["routing", "allow", "models"]);
+                    deleteAt(doc, ["routing", "allow"]);
+                for (const leaf of ["adapters", "models"]) {
+                    const path = ["routing", "allow", leaf];
+                    if (form[leaf].length)
+                        setStringSequencePreservingComments(doc, path, form[leaf]);
+                    else if (write.lowerAllow?.[leaf] != null)
+                        setStringSequencePreservingComments(doc, path, null);
+                    else
+                        deleteAt(doc, path);
                 }
                 // Whole fleet out: allow stays present but empty — fail-closed, nothing admitted.
                 if (doc.getIn(["routing", "allow"]) === undefined) {
@@ -291,8 +379,12 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 }
             }
             else {
-                // Whole fleet in: no restriction to express — the allow block goes away entirely.
-                deleteAt(doc, ["routing", "allow"]);
+                // Whole fleet in: no restriction to express — the allow block goes away entirely, or is
+                // masked when a lower layer's allow would otherwise come back (T10 A/B resurrection).
+                if (write.lowerAllow)
+                    setAt(doc, ["routing", "allow"], doc.createNode(null));
+                else
+                    deleteAt(doc, ["routing", "allow"]);
             }
             // Authored and non-canonical entries stay in deny (LEG2-T3 finding 4, round 2 finding 2).
             // OBS-1046: only an EDITED scope is rewritten, and only when its bytes must change — an
@@ -313,7 +405,8 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 const stale = authored.some((entry) => admitted.includes(entry));
                 if (!touched && !stale)
                     continue;
-                const remaining = flatDenyAfterWrite(doc, path, after, write.universe);
+                refuseMerge(doc, priorBytes, path);
+                const remaining = [...new Set([...flatDenyAfterWrite(doc, path, after, write.universe), ...after.filter(coversRetained)])];
                 if (remaining.length) {
                     if (remaining.join("\n") !== authored.join("\n"))
                         setStringSequencePreservingComments(doc, path, remaining);
@@ -327,6 +420,7 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             for (const scope of FLAT_DENY_SCOPES) {
                 if (!flatChanged.get(scope.key))
                     continue;
+                refuseMerge(doc, priorBytes, scope.path);
                 const after = edited[scope.key] ?? [];
                 setStringSequencePreservingComments(doc, scope.path, after.length ? sortedUnique(after) : null);
             }
@@ -341,6 +435,7 @@ export function renderFleetOverlayWrite(priorBytes, write) {
         const [before, after] = listsOf(write, scope);
         if (!changed(before, after))
             continue;
+        refuseMerge(doc, priorBytes, scope.path);
         setStringSequencePreservingComments(doc, scope.path, after.length ? sortedUnique(after) : null);
     }
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
@@ -530,8 +625,9 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     // byte-identical to yaml's own stringifyComment. OBS-1046: a scalar parsed from the prior bytes
     // keeps the exact whitespace it had before its hash sign (yaml itself emits one space, so the
     // sentinel carries the rest); only a comment fleet authored gets the two-space style.
+    // T10 (D-936): a flow collection's trailing note (`[codex]  # c`) is inline too, so it keeps its gap.
     visit(doc, (_key, node) => {
-        if (isScalar(node) && typeof node.comment === "string" && !node.comment.includes("\n")) {
+        if ((isScalar(node) || (isCollection(node) && node.flow)) && typeof node.comment === "string" && !node.comment.includes("\n")) {
             const tail = node.range ? priorBytes.slice(node.range[1], node.range[2]) : "";
             const gap = /^([ \t]+)#/.exec(tail)?.[1] ?? "  ";
             node.comment = `${INLINE_COMMENT_SENTINEL}${gap.slice(1)}#${node.comment}`;
@@ -547,6 +643,39 @@ export function renderFleetOverlayWrite(priorBytes, write) {
         flowCollectionPadding: false,
     });
 }
+/** T10: the 1-based line of the key that holds `path` in these overlay bytes — the path's own key, the
+ * key whose `null` masks it from above, or a `<<` merge key on it (D-987: the write there refuses) — else
+ * undefined (the overlay neither declares nor masks it). */
+export function overlayHoldingLine(bytes, path) {
+    const doc = parseDocument(bytes);
+    if (doc.errors.length)
+        return undefined;
+    const lineOf = (offset) => bytes.slice(0, offset).split("\n").length;
+    let node = doc.contents;
+    let line;
+    for (const key of path) {
+        if (isAlias(node))
+            node = node.resolve(doc);
+        if (line !== undefined && isScalar(node) && node.value === null)
+            return line; // a mask at or above
+        if (!isMap(node))
+            return undefined;
+        const merge = node.items.find((item) => isScalar(item.key) && typeof item.key.value === "symbol");
+        const pair = merge ?? node.items.find((item) => isScalar(item.key) && String(item.key.value) === key);
+        if (!pair || !isScalar(pair.key) || !pair.key.range)
+            return undefined;
+        line = lineOf(pair.key.range[0]);
+        if (merge)
+            return line;
+        node = pair.value;
+    }
+    return line;
+}
+/** T10: does `path` hold a mapping in these overlay bytes — neither absent nor a `null` mask? */
+export function overlayHoldsMap(bytes, path) {
+    const doc = parseDocument(bytes);
+    return !doc.errors.length && isMap(doc.getIn(path, true));
+}
 /** Build the repo overlay fragment fleet would write for edits since session start. */
 export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, firstTouches = {}, universe) {
     if (fleetEditableEquals(initial, edited))

package/dist/drivers/orca.d.ts

@@ -5,7 +5,7 @@ import { type ExecutorDriver, type FocusTarget, type FocusResult, type NotifyOpt
 /** The response families the ONE shared envelope parser serves. There is no second JSON seam. */
 export declare const ORCA_RESPONSE_FAMILIES: readonly ["status", "create", "list", "read", "send", "wait", "show", "close", "worktree-current", "worktree-set", "hooks-status", "split"];
 export type OrcaFamily = (typeof ORCA_RESPONSE_FAMILIES)[number];
-export declare const ORCA_FIXTURE_VERSION = "1.4.195";
+export declare const ORCA_FIXTURE_VERSION = "1.4.218";
 export declare const ORCA_CLI_COMMAND_ENV = "ORCA_CLI_COMMAND";
 export declare const STALE_HANDLE_CODE = "terminal_handle_stale";
 export declare const TERMINAL_GONE_CODE = "terminal_gone";
@@ -176,6 +176,17 @@ export interface OrcaDriverOpts {
     probeStalenessMs?: number;
     launchingHandle?: string;
 }
+/**
+ * F (D-832): what one proof page's OWN metadata says about the scrollback it was read from — the closed
+ * seam checkoutProven decides paging and absence by. `complete`: explicit `limited:false` and
+ * `truncated:false` with cursors that agree — nothing lies past this page. `partial`: explicit booleans,
+ * one of them true, cursors that agree — more scrollback exists. `unread`: everything else — a flag
+ * missing or not a boolean, a cursor that is not a string, `limited:false` with a next cursor short of
+ * the latest one (the contradictory "last" page), a blind stream page
+ * (isBlindStreamPage), or a source that is not the stream (`screen-unavailable`). Missing metadata is
+ * never inferred complete: its page's bytes still count as read evidence, but no absence rests on it.
+ */
+export declare function classifyProofPage(term: Record<string, unknown>): "complete" | "partial" | "unread";
 export declare class OrcaDriver implements ExecutorDriver {
     id: string;
     interactive: boolean;
@@ -265,8 +276,11 @@ export declare class OrcaDriver implements ExecutorDriver {
      * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
      * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read
      * the ceiling cut off or never let start (the anchor included), or a page that landed late (even one
-     * carrying the right proof), a malformed page (its tail, cursors or paging flags), or a blind stream
-     * page (isBlindStreamPage). Unread output is unknown — never an empty page, never absence.
+     * carrying the right proof), a malformed page (its tail or cursors), a blind stream page
+     * (isBlindStreamPage), or — F (D-832) — any page read whose paging metadata classifyProofPage cannot
+     * call complete or partial (flags missing, not boolean or contradicted; even when they were omitted,
+     * that page's bytes stay evidence and its matching proof still proves). Unread output is unknown —
+     * never an empty page, never absence.
      * Without a deadline (reconcile, recovery) only `proven` is consumed.
      */
     private checkoutProven;

package/dist/drivers/orca.js

@@ -44,7 +44,7 @@ export const ORCA_RESPONSE_FAMILIES = [
     "status", "create", "list", "read", "send", "wait", "show", "close",
     "worktree-current", "worktree-set", "hooks-status", "split",
 ];
-export const ORCA_FIXTURE_VERSION = "1.4.195";
+export const ORCA_FIXTURE_VERSION = "1.4.218";
 export const ORCA_CLI_COMMAND_ENV = "ORCA_CLI_COMMAND";
 export const STALE_HANDLE_CODE = "terminal_handle_stale";
 export const TERMINAL_GONE_CODE = "terminal_gone";
@@ -608,6 +608,31 @@ export function isBlindStreamPage(term) {
         && Array.isArray(term.tail) && term.tail.length === 0
         && (term.returnedLineCount === undefined || term.returnedLineCount === 0);
 }
+/**
+ * F (D-832): what one proof page's OWN metadata says about the scrollback it was read from — the closed
+ * seam checkoutProven decides paging and absence by. `complete`: explicit `limited:false` and
+ * `truncated:false` with cursors that agree — nothing lies past this page. `partial`: explicit booleans,
+ * one of them true, cursors that agree — more scrollback exists. `unread`: everything else — a flag
+ * missing or not a boolean, a cursor that is not a string, `limited:false` with a next cursor short of
+ * the latest one (the contradictory "last" page), a blind stream page
+ * (isBlindStreamPage), or a source that is not the stream (`screen-unavailable`). Missing metadata is
+ * never inferred complete: its page's bytes still count as read evidence, but no absence rests on it.
+ */
+export function classifyProofPage(term) {
+    const { limited, truncated } = term;
+    if (typeof limited !== "boolean" || typeof truncated !== "boolean")
+        return "unread";
+    if (isBlindStreamPage(term) || (term.source !== undefined && term.source !== "stream"))
+        return "unread";
+    const next = str(term.nextCursor), latest = str(term.latestCursor);
+    if ((term.nextCursor !== undefined && next === undefined) || (term.latestCursor !== undefined && latest === undefined))
+        return "unread";
+    // a page that says it is the last while its next cursor stops short of the latest one contradicts itself.
+    // (A limited page whose next cursor IS the latest is not: the read from that cursor settles it.)
+    if (!limited && next !== undefined && latest !== undefined && next !== latest)
+        return "unread";
+    return limited || truncated ? "partial" : "complete";
+}
 export class OrcaDriver {
     id = "orca";
     interactive = true; // a visible terminal the operator can watch and answer
@@ -1021,12 +1046,17 @@ export class OrcaDriver {
      * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
      * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read
      * the ceiling cut off or never let start (the anchor included), or a page that landed late (even one
-     * carrying the right proof), a malformed page (its tail, cursors or paging flags), or a blind stream
-     * page (isBlindStreamPage). Unread output is unknown — never an empty page, never absence.
+     * carrying the right proof), a malformed page (its tail or cursors), a blind stream page
+     * (isBlindStreamPage), or — F (D-832) — any page read whose paging metadata classifyProofPage cannot
+     * call complete or partial (flags missing, not boolean or contradicted; even when they were omitted,
+     * that page's bytes stay evidence and its matching proof still proves). Unread output is unknown —
+     * never an empty page, never absence.
      * Without a deadline (reconcile, recovery) only `proven` is consumed.
      */
     async checkoutProven(handle, checkout, from, runtimeId, deadline) {
-        let late = false;
+        // F (D-832): a page read whose own metadata does not say how complete it is (classifyProofPage):
+        // its bytes are evidence, but the scrollback it came from is not known to be read whole.
+        let late = false, unknown = false;
         const page = async (cursor) => {
             const budget = deadline === undefined ? undefined : deadline - this.time.now();
             if (budget !== undefined && budget <= 0)
@@ -1052,23 +1082,24 @@ export class OrcaDriver {
                 throw new OrcaError("read", `proof page names terminal ${str(term.handle) ?? "none"}, not the candidate ${handle}`, env.raw);
             }
             // E1: only a well-formed page is read text. A tail that is missing, not an array or carries a
-            // non-string row (tailText), a cursor that is not a non-empty string, or a paging flag that is not
-            // a boolean is a malformed page: it throws, so it is unread output — never filtered to an empty
-            // page that would read as an absent proof.
+            // non-string row (tailText), or a cursor that is not a non-empty string is a malformed page: it
+            // throws, so it is unread output — never filtered to an empty page that would read as an absent proof.
             for (const key of ["oldestCursor", "nextCursor"]) {
                 if (term[key] !== undefined && str(term[key]) === undefined)
                     throw new OrcaError("read", `proof page ${key} is not a cursor`, env.raw);
             }
-            for (const key of ["limited", "truncated"]) {
-                if (term[key] !== undefined && typeof term[key] !== "boolean")
-                    throw new OrcaError("read", `proof page ${key} is not a boolean`, env.raw);
-            }
             // E1: the OBS-1011 add.1 blind stream (exited, empty tail, zero lines returned) is the shape a
             // live terminal's stream answers while its screen still paints — and a dead terminal's too. The
             // stream alone cannot tell them apart, so its empty tail is unread scrollback, never absence.
             if (isBlindStreamPage(term))
                 throw new OrcaError("read", "proof page is a blind stream page (status exited, empty tail): its scrollback is unread", env.raw);
-            return { term, text: this.tailText("read", term, env.raw) };
+            const text = this.tailText("read", term, env.raw);
+            // F: paging flags missing, not boolean or contradicted by the cursors leave the page's bytes read
+            // but its completeness unknown — it ends paging, and the poll can never read as absent.
+            const kind = classifyProofPage(term);
+            if (kind === "unread")
+                unknown = true;
+            return { term, text, kind };
         };
         // Every validated read is evidence, whatever stops the next one: the anchor's tail and the pages
         // read from the oldest cursor are inspected even when paging hits PROOF_PAGES or a read throws.
@@ -1093,12 +1124,13 @@ export class OrcaDriver {
             tail = first.text;
             let cursor = str(anchor.oldestCursor);
             // why paging ended with scrollback still unread. Every exit is one of: complete (an anchor that
-            // is the whole scrollback, or a page that is not limited), whole frames found, or one of these.
+            // is the whole scrollback, or a page whose metadata says it is the last), whole frames found, a
+            // page whose completeness is unknown (`unknown`, classifyProofPage), or one of these.
             let stop;
             if (cursor === undefined) {
                 text = tail;
                 // A cursorless anchor that says it holds less than the scrollback leaves the rest unreadable.
-                if (anchor.truncated === true || anchor.limited === true)
+                if (first.kind === "partial")
                     stop = "stalled";
             }
             for (let n = 0; cursor !== undefined; n++) {
@@ -1116,12 +1148,23 @@ export class OrcaDriver {
                 const frames = checkoutFrames(text);
                 if (frames.complete.length > 0 && !frames.incomplete)
                     break; // whole frames, nothing dangling
-                if (term.limited !== true)
+                if (got.kind === "complete")
                     break; // the last page: the scrollback was read to its end
                 const next = str(term.nextCursor);
-                // A limited page with no next cursor, or the same one, says more scrollback exists that no
-                // read can reach: unread, never absent.
-                if (next === undefined || next === cursor) {
+                const advancing = next !== undefined && next !== cursor;
+                if (got.kind === "unread") {
+                    // F: no absence rests on this page (`unknown`), but a cursor that still advances toward more
+                    // scrollback — the page says limited, or its next cursor is short of the latest one — is
+                    // followed for positive proof, inside PROOF_PAGES and the ceiling.
+                    if (advancing && (term.limited === true || next !== str(term.latestCursor))) {
+                        cursor = next;
+                        continue;
+                    }
+                    break;
+                }
+                // A partial page that is not limited, or a limited one with no next cursor or the same one, says
+                // more scrollback exists that no read can reach: unread, never absent.
+                if (term.limited !== true || !advancing) {
                     stop = "stalled";
                     break;
                 }
@@ -1139,9 +1182,10 @@ export class OrcaDriver {
                 return { proven: true, reason: "" };
             const why = `${late ? "read past the ceiling, " : ""}${stop === "cut" ? "the ceiling cut off paging, "
                 : stop === "exhausted" ? `paging stopped at ${PROOF_PAGES} pages with scrollback unread, `
-                    : stop === "stalled" ? "a limited read gave no next cursor with scrollback unread, " : ""}`;
+                    : stop === "stalled" ? "a limited read gave no next cursor with scrollback unread, " : ""}${unknown ? "a page carried missing, non-boolean or contradictory paging metadata, " : ""}`;
             const read = described(why);
-            return { ...read, seen: read.seen ?? (stop || late ? "unread" : "absent") };
+            // F: absent only when every page read said, explicitly and consistently, how complete it was.
+            return { ...read, seen: read.seen ?? (stop || late || unknown ? "unread" : "absent") };
         }
         catch (error) {
             // A read that failed midway keeps what was already read as evidence; what it could not read is

package/dist/gates/run-gates.d.ts

@@ -109,7 +109,8 @@ export declare function screenCostRatio(baseline: Baseline, selected: readonly s
 /** A retry base no runner invocation parses. evaluateManifestedTest builds its stranded single-fork
  * retry from the base it is handed, and one it cannot parse throws before any spawn — so this base
  * disables that inner recovery: a worker-RPC-stranded re-observation comes back infra (the caller
- * parks it as ambiguous) instead of launching a second execution. */
+ * parks it as ambiguous) instead of launching a second execution. runVitestManifestGate reads it as
+ * the mark of a diagnostic subset, which never buys the outer timeout-shaped remeasurement either. */
 export declare const REOBSERVATION_RETRY_BASE = "tickmarkr-reobservation-refuses-stranded-retry";
 /** OBS-1106 residual: ONE isolated re-observation of a timeout-shaped red's attributed failing files on
  * the same checkout, narrowed exactly as a screen is. Never cached and never a verdict: the caller