tickmarkr 2.6.6 → 2.6.7

package/dist/cli/commands/fleet.js

@@ -281,8 +281,15 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         : readClaudeAliasIdentity(cwd, model) ?? CLAUDE_ALIAS_IDENTITY_STAMPS[model];
     // One ranking universe for the whole screen: every unclassified row bands fleet-relatively
     // against the same set, so a suggestion never depends on which adapter group renders first.
+    // T5: a displayed row's real members — every id doctor actually served among its collapsed variants
+    // (the bare id only when served, never the display label alone) — folded constituents append theirs.
+    // Each real id is ONE member even when doctor's list repeats it, so one act takes one reason from it.
     const detectedRows = fleetUnclassifiedModels(cfg, health, adapters)
-        .map((row) => ({ ...row, resolvedModel: resolvedCatalogModel(row.adapter, row.model) }));
+        .map((row) => ({
+        ...row,
+        resolvedModel: resolvedCatalogModel(row.adapter, row.model),
+        members: [...new Set([row.model, ...(row.variants ?? [])])].filter((id) => health[row.adapter]?.models?.includes(id)),
+    }));
     const catalogRanking = catalogTierRanking(cfg, catalog, detectedRows, resolvedCatalogModel);
     const foldedRows = [];
     const folds = new Map();
@@ -296,6 +303,8 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         if (first) {
             first.foldedModels ??= [first.model];
             first.foldedModels.push(row.model);
+            // T5: a collapsed constituent keeps every variant when it is catalog-folded
+            first.members = [...new Set([...first.members, ...row.members])];
         }
         else {
             foldedRows.push(next);
@@ -347,9 +356,26 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 ...unclassified
                     .filter((row) => !editable.tiers[adapter.id]?.[row.model])
                     .map((row) => {
-                    const evidence = rowEvidence(adapter.id, row.classifyModel ?? row.model, row.advisory.coverage === "covered" ? row.advisory.evidence : undefined);
+                    const found = rowEvidence(adapter.id, row.classifyModel ?? row.model, row.advisory.coverage === "covered" ? row.advisory.evidence : undefined);
+                    // T5: each member keeps its own recorded identity and auth verdict; a group is unauthed as a
+                    // row only when every member is — one member's failed probe never blocks the others' reach
+                    const grouped = row.members.length > 1 || (row.members.length === 1 && row.members[0] !== row.model);
+                    const members = grouped ? row.members.map((model) => {
+                        const identity = resolvedModelIdentity(adapter.id, model);
+                        const probed = health[adapter.id]?.modelAuth?.[model];
+                        return {
+                            model,
+                            ...(identity !== undefined ? { identity } : {}),
+                            ...(probed?.authed === false ? { unauthed: probed.reason ?? "probe failed" } : {}),
+                        };
+                    }) : undefined;
+                    const { unauthed: _unauthed, ...authedEvidence } = found ?? {};
+                    const evidence = members?.some((member) => member.unauthed === undefined) && found?.unauthed !== undefined
+                        ? (Object.keys(authedEvidence).length ? authedEvidence : undefined)
+                        : found;
                     return {
                         model: row.model,
+                        ...(members ? { members } : {}),
                         detectedAt: row.detectedAt,
                         ...(row.classifyModel ? { classifyModel: row.classifyModel } : {}),
                         ...(row.variants ? { variants: row.variants } : {}),
@@ -474,15 +500,18 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         ? { ...initial, allowOut: [...new Set([...(initial.allowOut ?? []), ...seeds.map((seed) => seed.entry)])].sort() }
         : initial);
     const FLAT_SCOPES = DENY_SCOPES.filter((scope) => scope.path.length === 3);
-    const seedChannel = (seed) => ({ adapter: seed.adapter, model: seed.displayModel, ...(seed.identity !== undefined ? { identity: seed.identity } : {}) });
+    const seedChannel = (seed) => ({ adapter: seed.adapter, model: seed.model, ...(seed.identity !== undefined ? { identity: seed.identity } : {}) });
     // an allow-complement entry excludes a seeded channel by the allow form's own matching (adapter id,
     // model, adapter:model, recorded identity) — the seed's spelling is one such entry, never the only one
     const seedRow = (seed) => ({
         adapter: seed.adapter,
-        models: [seed.displayModel],
-        ...(seed.identity !== undefined ? { identities: { [seed.displayModel]: seed.identity } } : {}),
+        models: [seed.model],
+        ...(seed.identity !== undefined ? { identities: { [seed.model]: seed.identity } } : {}),
     });
-    const allowExcludes = (staged, seed) => (staged.allowOut ?? []).some((entry) => universeEntryMatches(seedRow(seed), seed.displayModel, entry));
+    const allowExcludes = (staged, seed) => (staged.allowOut ?? []).some((entry) => universeEntryMatches(seedRow(seed), seed.model, entry));
+    // T5: the real channels a displayed row stands for (fleet's own derivation above); an ungrouped row is one
+    const rowMembers = (row) => ("members" in row && row.members)
+        || [{ model: ("classifyModel" in row && row.classifyModel) || row.model, ...(row.evidence?.identity !== undefined ? { identity: row.evidence.identity } : {}) }];
     // membership keeps the channel out: its allow complement or a flat (all-seats) deny entry
     const excludedIn = (staged, seed) => allowExcludes(staged, seed)
         || FLAT_SCOPES.some((scope) => (staged[scope.key] ?? []).some((entry) => entryMatchesChannel(entry, seedChannel(seed), true)));
@@ -573,12 +602,9 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 // own flat-deny lift: a row the baseline membership kept out that the staged one admits; a lone or
                 // unrelated tier stays user
                 const own = admitted.some((seed) => seed.adapter === adapter && seed.model === model)
-                    || (modelGroups.find((group) => group.adapter === adapter)?.rows ?? [])
-                        .filter((row) => row.model === model || ("classifyModel" in row && row.classifyModel === model))
-                        .some((row) => {
-                        const channel = { adapter, displayModel: row.model, ...(row.evidence?.identity !== undefined ? { identity: row.evidence.identity } : {}) };
-                        return excludedIn(baseline, channel) && !excludedIn(staged, channel);
-                    });
+                    || (modelGroups.find((group) => group.adapter === adapter)?.rows ?? []).flatMap(rowMembers)
+                        .filter((member) => member.model === model)
+                        .some((member) => excludedIn(baseline, { adapter, ...member }) && !excludedIn(staged, { adapter, ...member }));
                 edits.push({ name: `tiers.${adapter}.models.${model}`, destination: own ? family() : "user" });
             }
         }
@@ -607,17 +633,22 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     // the browser never showed, or whose spelling names no channel, is refused.
     const editingUniverse = (candidate, seeds) => {
         const target = universeOf(candidateChannels(candidate));
+        // T5 review: the seed's OWN channel must be in the universe — its entry matching another member's
+        // recorded identity (C-high recorded as C-low) never stands for an unauthed or unprobed C-low
         const covers = (seed) => target.some((row) => row.adapter === seed.adapter
-            && row.models.some((model) => universeEntryMatches(row, model, seed.entry)));
+            && row.models.includes(seed.model) && universeEntryMatches(row, seed.model, seed.entry));
         for (const seed of seeds) {
             if (covers(seed))
                 continue;
-            const shown = modelGroups.some((group) => group.adapter === seed.adapter && group.rows.some((row) => row.model === seed.displayModel));
+            // T5: a seed names a real member of the row it was staged from — never that row's display label
+            const shown = modelGroups.some((group) => group.adapter === seed.adapter
+                && group.rows.some((row) => row.model === seed.displayModel && rowMembers(row).some((member) => member.model === seed.model)));
             const row = target.find((candidateRow) => candidateRow.adapter === seed.adapter);
             if (shown && row) {
-                row.models = [...row.models, seed.displayModel];
+                if (!row.models.includes(seed.model))
+                    row.models = [...row.models, seed.model];
                 if (seed.identity !== undefined)
-                    row.identities = { ...row.identities, [seed.displayModel]: seed.identity };
+                    row.identities = { ...row.identities, [seed.model]: seed.identity };
             }
             if (!covers(seed))
                 throw new ConfigError(`the seeded allow entry ${seed.entry} names no channel of the discovered fleet — re-probe with tickmarkr doctor, then classify it again`);
@@ -1282,24 +1313,36 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         // and it was not configured at probe time), so it stays unroutable — invisible in every
         // picker — until the next probe. Name the step, or the classify flow reads as broken.
         const unprobed = [];
+        // T5: a grouped classification admits every member's real id, yet a member doctor recorded unauthed
+        // stays unroutable — named, never implied routable by its group's admission
+        const unauthed = [];
         for (const [adapter, models] of Object.entries(write.edited.tiers)) {
             for (const [model, assigned] of Object.entries(models)) {
                 if (assigned === null || assigned === undefined)
                     continue;
                 if (JSON.stringify(write.initial.tiers[adapter]?.[model]) === JSON.stringify(assigned))
                     continue;
-                if (health[adapter]?.modelAuth?.[model] === undefined)
+                const probed = health[adapter]?.modelAuth?.[model];
+                if (probed === undefined)
                     unprobed.push(`${adapter}:${model}`);
+                else if (probed.authed === false)
+                    unauthed.push(`${adapter}:${model}`);
             }
         }
         // B2: a repo-shadowed save says what still applies here — never claimed applied
         const head = [`fleet: wrote ${pending.path}`, ...(pending.destination === "user"
                 ? repoShadowNotes(result.review.before, result.review.after).map((note) => `fleet: ${note}`)
                 : [])].join("\n");
-        if (!unprobed.length)
-            return head;
-        const named = unprobed.slice(0, 3).join(", ") + (unprobed.length > 3 ? `, +${unprobed.length - 3} more` : "");
-        return `${head}\nfleet: ${unprobed.length} newly classified model(s) have no probe verdict yet (${named}) — run \`tickmarkr fleet --fresh\` to probe them; unverified models stay unroutable`;
+        const listed = (ids) => ids.slice(0, 3).join(", ") + (ids.length > 3 ? `, +${ids.length - 3} more` : "");
+        return [
+            head,
+            ...(unprobed.length
+                ? [`fleet: ${unprobed.length} newly classified model(s) have no probe verdict yet (${listed(unprobed)}) — run \`tickmarkr fleet --fresh\` to probe them; unverified models stay unroutable`]
+                : []),
+            ...(unauthed.length
+                ? [`fleet: ${unauthed.length} newly classified model(s) are unauthed (${listed(unauthed)}) — re-probe with tickmarkr doctor; unauthed models stay unroutable`]
+                : []),
+        ].join("\n");
     };
     return {
         props,

package/dist/cli/commands/init.js

@@ -130,13 +130,24 @@ you were handed the whole picture — list the repository root, open every guida
   predate a project rename, so **search by CONCEPT, not by the current product name.** A memory nobody opens
   is worse than none: every seat assumes the lesson is recorded somewhere and no seat looks.
 - **The gates are the product.** Seven, defined in \`src/graph/schema.ts\`:
-  \`build test lint evidence scope acceptance review\`. **That is DECLARATION order, not execution order** —
-  the first five run as a battery that stops at its first red, then \`acceptance\` and \`review\` run
-  CONCURRENTLY (\`run-gates.ts:39\`, *"judge ‖ review"*). One repair reorders them: a repair the REVIEW sent
-  back (carried \`review:material\`, test selection on, no required repair test) runs build, lint, evidence and
-  scope, then \`acceptance\` ‖ \`review\`, then its test screen, so a review that re-reds an unchanged subject
-  starts no test at all; a test-red repair keeps the battery first. Either way nothing merges until the FULL
-  suite has passed on the merge-candidate commit. The first five are MANDATORY; only \`acceptance\` and
+  \`build test lint evidence scope acceptance review\`. **That is DECLARATION order, not execution order.**
+  The cheap checks run first and stop at their first red: \`build\`, \`lint\`, then \`evidence\` and \`scope\`.
+  A fresh or semantic-repair candidate then runs \`acceptance\` ‖ \`review\` CONCURRENTLY (\`run-gates.ts\`,
+  *"judge ‖ review"*) before any test payload: a decisive semantic red ends the round with zero diagnostic
+  or full test-gate runs (a required acceptance oracle still executes); otherwise ONE full verification job
+  follows, with no selected screen. Only an attributed behavioral test-red repair may buy one diagnostic
+  first — every required failing file plus conservatively selected tests reaching the diff — admitted only
+  on comparable harness timing with ratio <= 0.15 AND estimated cost <= 60000 ms; its behavioral red stops
+  the round before semantics, otherwise semantics precede the full job. Disabled, unsupported, over-cap or
+  unknown-cost selection skips the diagnostic instead of running a full suite before semantics, and a
+  killed diagnostic is never green. A seatless or no-verdict review lets acceptance finish and publish and
+  the full job run in-round, and stays unsatisfied until review-only recovery; a seatless acceptance
+  cancels its sibling, records the unrun test (\`testOwed\`) and every enabled gate still owed (an unrecorded
+  review included), cannot merge and parks infra; an actual cancellation or throw awaits cleanup and leaves
+  no mergeable partial set. Test-only verification and an explicit full recheck keep their full scope with
+  no invented semantics and no diagnostic. Nothing merges until the FULL suite has passed on the exact
+  merge-candidate commit; an exact full green answers only after identity, environment, cleanliness and
+  current complete-manifest checks. The first five are MANDATORY; only \`acceptance\` and
   \`review\` may be omitted per task. Implementations are in \`src/gates/\` — \`baseline.ts\` (build/test/lint,
   diffed against a recorded baseline so pre-existing failures are forgiven), \`evidence.ts\`, \`scope.ts\`,
   \`acceptance.ts\` (its judge reads the DIFF and every criterion must cite a changed hunk), \`review.ts\`

package/dist/cli/help.d.ts

@@ -186,6 +186,7 @@ export declare const COMMAND_HELP: {
             "--pct <0..100>": string;
             "--threshold-pct <0..100>": string;
             "--stand-down": string;
+            "--status": string;
         };
         examples: string[];
     };

package/dist/cli/help.js

@@ -148,17 +148,22 @@ export const COMMAND_HELP = {
         ],
     },
     beat: {
-        usage: "beat <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> [options]",
-        description: "Write one supervision beat using the recorded arm. Stood-down arms stay DISARMED until explicitly re-armed; stopped beats become STALE.",
+        usage: "beat <start|stop|status> <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> | beat <tier> --seat <identity> [options]",
+        description: "start launches one detached --loop beat per tier and exits 0 only after reading back that child's own advancing beat; stop retires only that recorded generation and reads back DISARMED; status is read-only and exits nonzero for STALE, MISMATCH or UNREADABLE. The legacy <tier> form writes one supervision beat using the recorded arm: stood-down arms stay DISARMED until explicitly re-armed; stopped beats become STALE.",
         options: {
-            "--seat <identity>": "Required: identify the supervising pane or agent.",
+            "--seat <identity>": "Required for start, stop and every write: identify the supervising pane or agent; optional for status.",
             "--new-arm": "Create a new durable arm, allowing beats to resume after stand-down; the hand-off step for a seat taking over a stood-down tier (combine with --arm-id and --pct on a context tier).",
-            "--loop": "Create a new durable arm and beat in this process every 10 seconds; exit within one interval after stand-down.",
+            "--loop": "Create a new durable arm and beat in this process every 10 seconds; exit nonzero with its reason within one interval after stand-down, supersession or a refused write.",
             "--arm-id <identity>": "Name a newly created arm; with --pct, identify the context observation arm. Never refuses a tick.",
             "--pct <0..100>": "Report current context consumption percentage.",
             "--threshold-pct <0..100>": "Set the context warning threshold (default 75).",
             "--stand-down": "Record an explicit handoff and stand down this tier. A later one-shot tick on the old arm exits non-zero; context observations still raise and discharge the clear duty.",
-        }, examples: ["beat overseer --seat supervisor", "beat overseer --seat supervisor --loop", "beat overseer --seat supervisor --stand-down", "beat overseer --seat supervisor --new-arm"],
+            "--status": "Legacy spelling of beat status <tier>: the same read-only result, writing nothing.",
+        }, examples: [
+            "beat start overseer --seat supervisor", "beat status overseer --seat supervisor", "beat stop overseer --seat supervisor",
+            "beat overseer --seat supervisor", "beat overseer --seat supervisor --loop", "beat overseer --seat supervisor --stand-down",
+            "beat overseer --seat supervisor --new-arm", "beat overseer --status",
+        ],
     },
     version: {
         usage: "version [--dist]", description: "Print the installed package version. Top-level aliases: --version and -v.",

package/dist/cli/index.d.ts

@@ -45,7 +45,7 @@ export declare const COMMANDS: {
     eval: typeof evalCommand;
 };
 export type RegisteredCommand = keyof typeof COMMANDS;
-export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> preview locally with --preview; draft after confirmation or --yes (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          discover and validate fixtures, seed isolated temp repos, then clean them up\n  run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)\n  status        live run state (--watch --events: JSON documents on stdout, keepalives on stderr; 2>&1 corrupts the stream)\n  stats         all-run channel delivery, red, rescue, author and reviewer statistics\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 verdict/JSON on stdout, progress on stderr; 2>&1 corrupts the verdict stream (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md writes Markdown to stdout; redirect to save a record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open Home, Run or Evidence (--view home|run|evidence; --setup <id> opens Run Parks)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   record one supervision beat for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume\n  version       print the installed version (--dist adds build location and fingerprint)\n\nUse tickmarkr <command> --help (or -h) for all options and examples.\nUse tickmarkr profile <operation> --help for nested profile help.";
+export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> preview locally with --preview; draft after confirmation or --yes (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          discover and validate fixtures, seed isolated temp repos, then clean them up\n  run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)\n  status        live run state (--watch --events: JSON documents on stdout, keepalives on stderr; 2>&1 corrupts the stream)\n  stats         all-run channel delivery, red, rescue, author and reviewer statistics\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 verdict/JSON on stdout, progress on stderr; 2>&1 corrupts the verdict stream (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md writes Markdown to stdout; redirect to save a record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open Home, Run or Evidence (--view home|run|evidence; --setup <id> opens Run Parks)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   supervision beats for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required: beat start|stop|status <tier> owns one detached loop per tier (status is read-only); the legacy beat <tier> records one beat (--stand-down to hand off), and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume\n  version       print the installed version (--dist adds build location and fingerprint)\n\nUse tickmarkr <command> --help (or -h) for all options and examples.\nUse tickmarkr profile <operation> --help for nested profile help.";
 export declare function dispatch(cmd: string | undefined, argv: string[], commands?: CommandMap): Promise<{
     out: string;
     code: number;

package/dist/cli/index.js

@@ -46,7 +46,7 @@ usage: tickmarkr <command>
   profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)
   ui            open Home, Run or Evidence (--view home|run|evidence; --setup <id> opens Run Parks)
   unlock        remove a stale/garbage run lock (refuses if the holder is alive)
-  beat <tier>   record one supervision beat for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop
+  beat <tier>   supervision beats for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required: beat start|stop|status <tier> owns one detached loop per tier (status is read-only); the legacy beat <tier> records one beat (--stand-down to hand off), and status reads the tier STALE once the beats stop
   approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume
   version       print the installed version (--dist adds build location and fingerprint)
 

package/dist/gates/baseline.d.ts

@@ -125,6 +125,9 @@ export interface BaselineCommand {
     /** VL-1: every per-file duration the runner named, so a later per-file hang budget (test-manifest.ts)
      * can be derived per file rather than from one slowest-file number; null when unavailable. */
     fileDurations?: BaselineFileDuration[] | null;
+    /** v2.6.7 close: set when fileTiming classified each duration's outcome (`failed` on a red file). A red capture
+     * without it (an older binary, a cached or hand-supplied baseline) never says which files were red. */
+    fileOutcomes?: true;
     /** The ceiling that measurement implies, persisted so every later battery uses the same number. */
     ceilingMs?: number;
     /**
@@ -145,6 +148,8 @@ export interface BaselineCommand {
 export interface BaselineFileDuration {
     file: string;
     durationMs: number;
+    /** The file was RED in this capture (× or ❯): its duration ended early and is no measure of its green runtime. */
+    failed?: true;
 }
 /**
  * OBS-1123: WHICH capture a forgiveness rests on — the commit it measured and when it was published.
@@ -175,6 +180,10 @@ export type FailureClassification = "regression" | "infra";
  * unreadable-runner case the existing fail-closed path already owns.
  */
 export declare function classifyFailureOutput(output: string): FailureClassification | undefined;
+/** The per-file timings a consumer may read as green runtimes. A red capture that never classified its files
+ * (no fileOutcomes) marks every file failed, so each is budgeted and costed as untimed — never as the early-ending
+ * time of a run that may have been red for it. */
+export declare function classifiedFileDurations(entry: BaselineCommand | undefined): BaselineFileDuration[] | null | undefined;
 export declare const UNRECOGNIZED_FAILURE = "<unrecognized failure output>";
 export declare function fingerprint(output: string): string[];
 /**

package/dist/gates/baseline.js

@@ -430,7 +430,7 @@ const normalizeLine = (l) => l.replace(/\d+/g, "#").replace(/\s+/g, " ").trim();
 // turbo-prefixed, but a test-name timing has no parenthesized file tally and therefore cannot enter
 // this measurement. These are observations of runner output, not a promise that every runner exposes
 // them — callers record null, never zero, when no line matches.
-const FILE_DURATION_RE = /^\s*(?:(?:[\w@./-]+:\s*)*)[✓✔×❯]\s+(?:\|[^|\r\n]+\|\s+)?(\S+)\s+\([^\r\n)]*\)\s+(\d+(?:\.\d+)?)\s*(ms|s|m)\b/;
+const FILE_DURATION_RE = /^\s*(?:(?:[\w@./-]+:\s*)*)([✓✔×❯])\s+(?:\|[^|\r\n]+\|\s+)?(\S+)\s+\([^\r\n)]*\)\s+(\d+(?:\.\d+)?)\s*(ms|s|m)\b/;
 const durationUnitMs = (unit) => unit === "m" ? 60_000 : unit === "s" ? 1_000 : 1;
 function fileTiming(output, wallClockMs) {
     const files = [];
@@ -438,9 +438,10 @@ function fileTiming(output, wallClockMs) {
         const match = FILE_DURATION_RE.exec(line.replace(ANSI_RE, ""));
         if (!match)
             continue;
-        const durationMs = Number(match[2]) * durationUnitMs(match[3]);
+        const durationMs = Number(match[3]) * durationUnitMs(match[4]);
+        // vitest marks a red file ❯ (suiteFail) and a red test × (taskFail)
         if (Number.isFinite(durationMs))
-            files.push({ file: match[1], durationMs });
+            files.push({ file: match[2], durationMs, ...(match[1] === "×" || match[1] === "❯" ? { failed: true } : {}) });
     }
     if (!files.length)
         return { fileDurationSumMs: null, impliedParallelism: null, longestFile: null, fileDurations: null };
@@ -451,8 +452,18 @@ function fileTiming(output, wallClockMs) {
         impliedParallelism: wallClockMs > 0 ? fileDurationSumMs / wallClockMs : null,
         longestFile,
         fileDurations: files,
+        fileOutcomes: true,
     };
 }
+/** The per-file timings a consumer may read as green runtimes. A red capture that never classified its files
+ * (no fileOutcomes) marks every file failed, so each is budgeted and costed as untimed — never as the early-ending
+ * time of a run that may have been red for it. */
+export function classifiedFileDurations(entry) {
+    const files = entry?.fileDurations;
+    if (!Array.isArray(files) || entry?.fileOutcomes || entry?.exitCode === 0)
+        return files;
+    return files.map((f) => ({ ...f, failed: true }));
+}
 // A failing command whose output holds no shape any runner here names. The marker is content-free and
 // constant: downstream consumers (tip verify journals fingerprint counts) still see that the command
 // failed, while no line of the output — narration, status strip, stack trace — can enter the set. Being

package/dist/gates/cache.js

@@ -53,7 +53,7 @@ export function baselineIdentity(baseline) {
         return "none";
     // Measurements control execution budgets, not which failures the baseline forgives.
     const commands = Object.fromEntries(Object.entries(baseline.commands).map(([gate, entry]) => {
-        const { durationMs: _duration, fileDurationSumMs: _sum, impliedParallelism: _parallelism, longestFile: _longest, fileDurations: _files, ceilingMs: _ceiling, ...evidence } = entry;
+        const { durationMs: _duration, fileDurationSumMs: _sum, impliedParallelism: _parallelism, longestFile: _longest, fileDurations: _files, fileOutcomes: _outcomes, ceilingMs: _ceiling, ...evidence } = entry;
         return [gate, evidence];
     }));
     return createHash("sha256").update(canonicalJson(commands)).digest("hex").slice(0, 16);

package/dist/gates/review.js

@@ -535,6 +535,13 @@ carriedAuthors = [], operatorContext) {
         ? `You may run at most the task's own test files explicitly named in files[]; these are the only suites you may run: ${ownTestFiles.map((file) => `\`${file}\``).join(", ")}.`
         : "No suite may be run: files[] names no explicit test file owned by this task.";
     const responseRequirement = reviewResponseRequirement(nonce);
+    // D-966 (T3 E): a reviewer that stopped at the first example of a class drip-fed it one round at a
+    // time — T5's rounds carried 2→1→1→1→2→1 findings and T10's 3→2→1→1→1, each round's repair fixing
+    // the case it was shown while its same-class siblings waited for the next review. The closed note
+    // tuple asks for every counterexample ACTUALLY FOUND in scope at once, plus the boundary searched and
+    // what stays uncertain, so the repair sees the class and the next round knows what was covered. It
+    // rides the existing note text (details → repair brief unchanged) and never asks for an exhaustive
+    // search the reviewer cannot honestly make; uncertainty alone stays out of the material bar.
     const prompt = `TICKMARKR-REVIEW
 ${responseRequirement}
 
@@ -580,6 +587,14 @@ acceptance criterion it violates (or to the regression this diff introduces), st
 and marks its evidence executed (you ran the reproducer), static (you traced it by reading) or blocked (it
 could not run here). Blocked evidence never turns a finding into a pass, and a worker's own case table or
 enumeration never resolves a finding: judge the diff itself.
+Report the whole class in this one review, never only its first example. Each material finding's "note" is one
+line carrying the closed tuple "rule: <the goal clause, criterion or regressed behaviour violated> | found:
+<every counterexample you ACTUALLY FOUND inside the declared scope, each as path:line input → consequence,
+joined by "; "> | searched: <the boundary you actually searched: files, symbols, call sites> | uncertain:
+<what lies outside that boundary or could not be established inside it>". Found one counterexample, list one;
+found several, list every one in the same finding. Never list a case you did not find. Your search is bounded:
+never claim it covered every input, caller or path beyond the boundary you name, and remaining uncertainty
+alone is never a material finding — record it under uncertain, or as a deferred minor with its rationale.
 
 Respond with ONLY this JSON:
 {"nonce": "${nonce}", "approve": true|false, "resolved": [], "reraised": [], "findings": [{"note": "...", "severity": "material"|"minor", "defer": false, "rationale": ""}], "comments": [{"path": "path/to/file", "line": 42, "body": "actionable feedback", "finding": 1}]}

package/dist/gates/run-gates.d.ts

@@ -98,14 +98,26 @@ export interface GateContext {
  * a command that already has `--` takes them directly. Every path is quoted — config flows into a shell.
  */
 export declare function testCommandForFiles(testCmd: string, files: string[]): string;
-/** OBS-635: a screen costing at least this share of the full suite runs the full suite instead. */
-export declare const SCREEN_PROMOTION_RATIO = 0.75;
+/** v2.6.7 T1 (closed order table): an attributed test-red diagnostic is admitted only when BOTH hold. */
+export declare const DIAGNOSTIC_MAX_RATIO = 0.15;
+export declare const DIAGNOSTIC_MAX_ESTIMATE_MS = 60000;
+export interface DiagnosticAdmission {
+    admitted: boolean;
+    reason: "diagnostic-admitted" | "diagnostic-unknown-cost" | "diagnostic-capacity-mismatch" | "diagnostic-cost-ratio" | "diagnostic-cost-estimate";
+    costRatio?: number;
+    estimatedMs?: number;
+}
 /**
- * The screen's share of the full suite's cost, from the per-file durations the harness measured at
- * baseline capture — never a worker's timing. Undefined (unknown) unless every selected file has a
- * measured duration and the measured total is positive; unknown keeps the conservative screen path.
+ * The diagnostic's admission evidence, from the per-file durations the harness measured at baseline
+ * capture — never a worker's timing. Unknown (any selected file unmeasured, any measurement that is not a
+ * finite number > 0 ms, an infra baseline, or no positive total) skips: an expensive or unknown screen must
+ * never become a full suite before semantics.
+ * So does timing recorded under a malformed or different capacity (git.ts sameCapacity): it divided the
+ * machine by another number, so it is not comparable evidence about this one.
+ * `estimatedMs` is the serial sum of those files: admission evidence, not a kill ceiling and not a
+ * claim about the parallel-plus-serial wall time the runner will actually take.
  */
-export declare function screenCostRatio(baseline: Baseline, selected: readonly string[]): number | undefined;
+export declare function diagnosticAdmission(baseline: Baseline, selected: readonly string[]): DiagnosticAdmission;
 /** A retry base no runner invocation parses. evaluateManifestedTest builds its stranded single-fork
  * retry from the base it is handed, and one it cannot parse throws before any spawn — so this base
  * disables that inner recovery: a worker-RPC-stranded re-observation comes back infra (the caller