tickmarkr 2.6.7 → 2.6.9

package/dist/adapters/catalog-remote.js

@@ -505,9 +505,12 @@ export async function refreshCatalogCommand(opts) {
     let modelsDev = current.catalog.modelsDev;
     let modelsDevUpdated = false;
     try {
-        modelsDev = await fetchCatalog(fetcher, MODELS_DEV_CATALOG_URL, {}, timeoutMs, (r) => r.json());
-        if (!validModelsDevCatalog(modelsDev))
+        // v2.6.9 (queue row 97): validate before the payload replaces the spine — an invalid payload left in
+        // modelsDev would be written beside an updated sibling leg and make the whole cache unreadable.
+        const fetched = await fetchCatalog(fetcher, MODELS_DEV_CATALOG_URL, {}, timeoutMs, (r) => r.json());
+        if (!validModelsDevCatalog(fetched))
             throw new Error("models.dev catalog schema is invalid");
+        modelsDev = fetched;
         modelsDevUpdated = true;
         legAt.modelsDev = stamp;
         legs.push({ leg: "models.dev", status: "updated", detail: "fetched", retry: "next retry after this leg is stale" });

package/dist/adapters/codex.d.ts

@@ -3,6 +3,7 @@ export declare function readCodexModelsCache(path?: string): {
     models: string[];
     fetchedAt?: string;
     retirements?: Record<string, ModelRetirement | null>;
+    hidden?: string[];
 };
 export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ \"$tkr_gitdir\" != \"$tkr_common\" ]; then printf '\"%s\",' \"$tkr_gitdir\"; fi; printf '\"%s/objects\",\"%s/refs\",\"%s/logs\"' \"$tkr_common\" \"$tkr_common\" \"$tkr_common\")]\"";
 export declare const CODEX_TRUST_DIALOG: TrustDialog;

package/dist/adapters/codex.js

@@ -61,23 +61,29 @@ function codexSessionDayDirs(sessions, sinceMs) {
 // Fails OPEN to { models: [] } on missing/corrupt cache. Version drift observed (installed CLI
 // 0.143.0 vs cache client_version 0.144.0, 2026-07-10) — hence the defensive try/catch and no shape
 // assumptions. CODEX_HOME is codex's own relocation env. fetchedAt is the honest codex knowledge age.
-// v2.6.4 T2 (B1a): each listed entry's `upgrade` is the CLI's own retirement notice (0.159.0 cache,
-// 2026-09-29: gpt-5.5 → {model: gpt-5.6-sol, retirement_at: 2026-10-14T19:00:00Z}; every other listed
-// id carries upgrade: null). null records known clean; a malformed or absent `upgrade` records nothing,
-// so that id stays unknown. An unreadable cache returns no retirements at all (unknown, never clean).
+// v2.6.4 T2 (B1a): each entry's `upgrade` is the CLI's own retirement notice; its successor is whatever
+// that notice names — never a fixed id in this file. A listed row with upgrade: null records known clean;
+// a malformed or absent `upgrade` records nothing, so that id stays unknown. v2.6.9 (queue row 64): the CLI
+// HIDES a model before it retires it (0.162.0, 2026-10-08: gpt-5.5 visibility "hide" with a dated
+// upgrade), so a valid dated notice is read from hidden rows too; a hidden row still never lists, and a
+// hidden row without a dated notice records nothing (delisted is not known clean). `hidden` names every
+// visibility "hide" row (D-1526: routing evidence). An unreadable cache returns neither (unknown, never clean).
 export function readCodexModelsCache(path) {
     const p = path ?? join(process.env.CODEX_HOME || join(homedir(), ".codex"), "models_cache.json");
     try {
         const d = JSON.parse(readFileSync(p, "utf8"));
-        const listed = (d.models ?? [])
-            .filter((m) => m?.visibility === "list" && typeof m.slug === "string" && m.slug.length > 0 && MODEL_ID_RE.test(m.slug));
+        const rows = (d.models ?? [])
+            .filter((m) => typeof m?.slug === "string" && m.slug.length > 0 && MODEL_ID_RE.test(m.slug));
+        const listed = rows.filter((m) => m.visibility === "list");
         const retirements = {};
-        for (const m of listed) {
+        for (const m of rows) {
             const notice = codexRetirement(m.upgrade);
-            if (notice !== undefined)
-                retirements[m.slug] = notice;
+            if (notice === undefined || (notice === null && m.visibility !== "list"))
+                continue;
+            retirements[m.slug] = notice;
         }
-        return { models: listed.map((m) => m.slug), fetchedAt: typeof d.fetched_at === "string" ? d.fetched_at : undefined, retirements };
+        const hidden = rows.filter((m) => m.visibility === "hide").map((m) => m.slug);
+        return { models: listed.map((m) => m.slug), fetchedAt: typeof d.fetched_at === "string" ? d.fetched_at : undefined, retirements, hidden };
     }
     catch {
         return { models: [] };
@@ -305,6 +311,8 @@ export const codex = {
     listModelsFetchedAt: () => readCodexModelsCache().fetchedAt,
     // v2.6.4 T2 (B1a): the cache's per-model retirement notices, persisted beside models in doctor.json.
     listModelsRetirements: () => readCodexModelsCache().retirements,
+    // v2.6.9 (D-1526): the ids the cache marks hidden, persisted beside models as routing evidence.
+    listModelsHidden: () => readCodexModelsCache().hidden,
     collectUsage(cwd, sinceMs) {
         try {
             const real = realpathSync(cwd);

package/dist/adapters/model-lints.js

@@ -497,13 +497,15 @@ function storedRetirement(record, model) {
         return { retiresAt: n.retiresAt };
     return typeof n.successor === "string" && MODEL_ID_RE.test(n.successor) ? { retiresAt: n.retiresAt, successor: n.successor } : undefined;
 }
-// Configured AND listed models only — a configured id the CLI stopped listing already carries the
-// tombstone advisory. The CLI's notice is quoted as-is: its successor is the CLI's upgrade target, never
-// a tier or benchmark claim, and no model name or visibility is read as one. Advisory: routing unchanged.
-function retirementLints(id, listedConfigured, record, nowMs) {
+// Configured models the CLI lists, plus configured models it stopped listing that still carry a dated
+// notice (the CLI hides a model before retiring it); any other unlisted id carries the bare tombstone
+// advisory instead. The CLI's notice is quoted as-is: its successor is the CLI's upgrade target, never
+// a tier or benchmark claim, and no model name or visibility is read as one. The notice never changes routing;
+// the CLI's hide does (D-1526), so a hidden id's lint says it is not routed instead of "routing unchanged".
+function retirementLints(id, configured, listed, hiddenIds, record, nowMs) {
     const lints = [];
     const unknown = [];
-    for (const model of listedConfigured) {
+    for (const model of configured) {
         const notice = storedRetirement(record, model);
         if (notice === undefined) {
             unknown.push(model);
@@ -511,12 +513,14 @@ function retirementLints(id, listedConfigured, record, nowMs) {
         }
         if (!notice)
             continue; // listed with no notice: known clean
+        const hidden = listed.includes(model) ? "" : " (the CLI no longer lists it)";
+        const routing = hiddenIds.includes(model) && !listed.includes(model) ? "not routed while the CLI hides it" : "routing unchanged";
         const successor = notice.successor
             ? `successor ${notice.successor} (named by the CLI — not a tier claim; classify it per benchmark policy)`
             : "no successor named";
         lints.push(nowMs >= Date.parse(notice.retiresAt)
-            ? `${id}: ${model} retired ${notice.retiresAt} per the CLI's notice; ${successor} — tombstone it (${model}: null overlay) or verify the id (advisory — routing unchanged)`
-            : `${id}: ${model} retires ${notice.retiresAt} per the CLI's notice; ${successor} — tombstone it (${model}: null overlay) before then (advisory — routing unchanged)`);
+            ? `${id}: ${model} retired ${notice.retiresAt} per the CLI's notice${hidden}; ${successor} — tombstone it (${model}: null overlay) or verify the id (advisory — ${routing})`
+            : `${id}: ${model} retires ${notice.retiresAt} per the CLI's notice${hidden}; ${successor} — tombstone it (${model}: null overlay) before then (advisory — ${routing})`);
     }
     if (unknown.length) {
         const why = record && typeof record === "object"
@@ -555,19 +559,25 @@ export function modelLints(cfg, health, adapters, opts) {
         }
         const h = health[id];
         const detected = h?.models ?? []; // MANDATORY default: pre-v1.5 files lack a populated models array
+        const configured = Object.keys(cfg.tiers[id]?.models ?? {});
+        // a configured id the CLI stopped listing but still carries a dated notice for gets the dated lint, not the bare one
+        const noticed = (model) => !!adapter.listModelsRetirements && !!storedRetirement(h?.modelRetirements, model);
         if (detected.length === 0) {
             if (h?.installed)
                 lints.push(`${id}: no detection data — run tickmarkr doctor`);
+            // D-1526: a cache holding only hidden rows lists nothing, yet its dated notices are still the CLI's word
+            if (adapter.listModelsRetirements)
+                lints.push(...retirementLints(id, configured.filter(noticed), detected, h?.modelsHidden ?? [], h?.modelRetirements, nowMs));
             continue; // no data to diff or age
         }
-        const configured = Object.keys(cfg.tiers[id]?.models ?? {});
         for (const model of configured) {
-            if (!detected.includes(model)) {
+            if (!detected.includes(model) && !noticed(model)) {
                 lints.push(`${id}: tiers lists ${model} — CLI no longer reports it; tombstone it (${model}: null overlay) or verify the id`);
             }
         }
-        if (adapter.listModelsRetirements)
-            lints.push(...retirementLints(id, configured.filter((m) => detected.includes(m)), h?.modelRetirements, nowMs));
+        if (adapter.listModelsRetirements) {
+            lints.push(...retirementLints(id, configured.filter((m) => detected.includes(m) || noticed(m)), detected, h?.modelsHidden ?? [], h?.modelRetirements, nowMs));
+        }
         const extra = collapseUnclassified(detected, new Set(configured));
         if (extra.length) {
             const shown = extra.slice(0, cap).map((row) => row.model).join(", ");

package/dist/adapters/model-windows.js

@@ -49,7 +49,6 @@ const VENDORED_MODEL_WINDOW_CLAIMS = [
     { modelId: "gpt-6-sol", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-6-luna", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-5.6-sol", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
-    { modelId: "gpt-5.5", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-5.6-terra", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-5.6-luna", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "composer-2.5", window: 200_000, source: CURSOR_SOURCE, readDate: READ_DATE },

package/dist/adapters/registry.js

@@ -107,14 +107,18 @@ function modelListValidated(h) {
     return !!h?.modelsDetectedAt && Array.isArray(h.models);
 }
 export function invalidConfiguredModels(cfg, adapterId, h) {
+    const configured = Object.keys(cfg.tiers[adapterId]?.models ?? {});
+    // v2.6.9 (queue row 64, D-1526): an id the CLI's own list marks hidden is positive evidence it stopped offering
+    // it — out whatever the overlap below. The fail-open that follows covers only ids with no such evidence.
+    const hidden = new Set(h?.modelsHidden ?? []);
+    const hiddenConfigured = configured.filter((m) => hidden.has(m) && !(h?.models ?? []).includes(m));
     if (!modelListValidated(h))
-        return [];
+        return hiddenConfigured;
     const listed = new Set(h.models);
-    const configured = Object.keys(cfg.tiers[adapterId]?.models ?? {});
     // Fail open until the CLI list intersects at least one configured model — proves the list is authoritative
     // for this adapter's tier namespace (MODEL-04: unrelated detected ids must not invalidate routing).
     if (!configured.some((m) => listed.has(m)))
-        return [];
+        return hiddenConfigured;
     return configured.filter((m) => !listed.has(m));
 }
 export function modelAliasExclusions(cfg, adapters, health) {

package/dist/adapters/types.d.ts

@@ -51,6 +51,7 @@ export interface AuthHealth {
     modelAuth?: Record<string, ModelAuth>;
     modelIdentities?: Record<string, string>;
     modelRetirements?: Record<string, ModelRetirement | null>;
+    modelsHidden?: string[];
     codexCommit?: CodexCommitStatus;
     launchServices?: LaunchServicesRecord;
 }
@@ -206,6 +207,7 @@ export interface WorkerAdapter {
     listModels?(): Promise<string[]>;
     listModelsFetchedAt?(): string | undefined;
     listModelsRetirements?(): Record<string, ModelRetirement | null> | undefined;
+    listModelsHidden?(): string[] | undefined;
     collectUsage?(cwd: string, sinceMs: number): TokenUsage | undefined;
     contextUsage?(session: SessionRef): ContextUsage | null;
     readSessionTranscript?(session: SessionRef): {

package/dist/cli/commands/beat.d.ts

@@ -1,8 +1,8 @@
 import { type SupervisionTier } from "../../run/supervision.js";
-import { type BeatLifecycleDeps } from "../../run/beat-lifecycle.js";
+import { type BeatLifecycleDeps, type ClaimGuard } from "../../run/beat-lifecycle.js";
 export declare function beat(argv: string[], cwd?: string, deps?: BeatLifecycleDeps): Promise<string | {
     out: string;
     code: number;
 }>;
-/** Record an explicit hand-off: the tier reads DISARMED, a stood-down tier, not a dead one. */
-export declare function standDownTier(repoRoot: string, tier: SupervisionTier, seat: string): string;
+/** Record an explicit hand-off: the tier reads DISARMED, a stood-down tier, not a dead one. `held`: the writer's claimed-act guard. */
+export declare function standDownTier(repoRoot: string, tier: SupervisionTier, seat: string, held?: ClaimGuard): string;

package/dist/cli/commands/beat.js

@@ -1,6 +1,6 @@
 import { parseArgs } from "node:util";
-import { SUPERVISION_BEAT_MS, SUPERVISION_DEFAULT_THRESHOLD_PCT, SUPERVISION_STALE_MS, SUPERVISION_TIERS, beatSupervision, locateSupervisionRoot, newSupervisionArm, publishStandDown, readSupervisionArm, resolveSupervisionRoot, } from "../../run/supervision.js";
-import { BEAT_GENERATION_ENV, beatStatus, defaultBeatDeps, startBeat, stopBeat, withLegacyClaim, } from "../../run/beat-lifecycle.js";
+import { SUPERVISION_BEAT_MS, SUPERVISION_DEFAULT_THRESHOLD_PCT, SUPERVISION_STALE_MS, SUPERVISION_TIERS, beatSupervision, locateSupervisionRoot, newSupervisionArm, publishStandDown, readSupervisionArm, resolveSupervisionRoot, supervisionStatus, } from "../../run/supervision.js";
+import { BEAT_GENERATION_ENV, beatStatus, defaultBeatDeps, startBeat, stopBeat, supervised, unclaimed, withLegacyClaim, } from "../../run/beat-lifecycle.js";
 // Two forms share one strict parser. The lifecycle verbs `start|stop|status <tier>` own a DETACHED loop
 // (src/run/beat-lifecycle.ts); the legacy `<tier>` form keeps its duties: one-shot ticks reuse a durable
 // arm, only --new-arm (or --loop) acknowledges a stand-down, and --status is the read-only status verb.
@@ -35,10 +35,24 @@ export async function beat(argv, cwd = process.cwd(), deps = defaultBeatDeps())
         return startBeat(repoRoot, tier, seat, deps);
     if (verb === "stop")
         return stopBeat(repoRoot, tier, seat, deps);
+    // Every legacy writer reclaims a claim whose recorded pids are all confirmed dead (a writer killed inside its claimed
+    // tick), recovers what a killed taker or writer left (its removal lock or pid-named lock entry, act marker, stage
+    // directory) and retires a dead or abandoned generation recorded for its seat (stood down, owner removed, nothing
+    // signalled); each such notice leads the final result or refusal, so a recovery is never reported as a plain write.
+    const notices = [];
+    const told = (message) => [...notices, message].join("\n");
+    try {
+        return told(await legacyWrite(repoRoot, tier, seat, values, deps, (notice) => { notices.push(notice); }));
+    }
+    catch (error) {
+        throw notices.length > 0 && error instanceof Error ? new Error(told(error.message)) : error;
+    }
+}
+async function legacyWrite(repoRoot, tier, seat, values, deps, noticed) {
     const generation = deps.env[BEAT_GENERATION_ENV]?.trim() || undefined;
-    const writer = (settled = false, arm) => ({ generation, seat, settled, arm, deps });
+    const writer = (settled = false, arm) => ({ generation, seat, settled, arm, deps, noticed });
     if (values["stand-down"]) {
-        return withLegacyClaim(repoRoot, tier, writer(), (recheck) => { recheck(); return standDownTier(repoRoot, tier, seat); });
+        return withLegacyClaim(repoRoot, tier, writer(), (recheck, held) => { recheck(); return standDownTier(repoRoot, tier, seat, held); });
     }
     const loop = values.loop === true;
     const armId = values["arm-id"];
@@ -52,11 +66,18 @@ export async function beat(argv, cwd = process.cwd(), deps = defaultBeatDeps())
     // arm id + epoch) is on record; every other writer only while no detached beat owns the tier. `created` marks
     // the arm this same claim just published: an owned re-arm rebinds the owner record to it — only while that arm
     // and the owner checked before it are still the ones on disk — and is checked again as that new generation
-    // before its beat. A running loop carries its arm into every check. A claim someone else holds refuses with
-    // no bytes changed.
-    const tick = (recheck, arm, created = false) => {
+    // before its beat. A running loop carries its arm into every check. Each supervision write (arm, beat, marker)
+    // is staged and committed record by record, each rename one claimed act under `held` (supervised): inside it this
+    // same ownership check runs again, every record must still be what the write was staged from, and the claim is
+    // verified last — a claim lost, or an owner or arm replaced, before a commit lands nothing further. A claim someone
+    // else holds is waited out under the ONE finite policy (BEAT_CLAIM_WAIT: 20 attempts 250 ms apart, shared with
+    // stop), then refuses BUSY with no bytes changed — unless every pid it records is confirmed dead, when it is
+    // reclaimed with a notice.
+    const tick = (recheck, held, arm, created = false) => {
         recheck(arm, created);
-        if (beatSupervision(repoRoot, tier, seat, observe(arm), { arm, armId, loop }))
+        // The fence travels with the beat: a stand-down that landed while this beat was committed still dominates it.
+        if (supervised(repoRoot, tier, held, (root) => beatSupervision(root, tier, seat, observe(arm), { arm, armId, loop })) &&
+            supervisionStatus(repoRoot, tier).state !== "DISARMED")
             return;
         const current = arm && readSupervisionArm(repoRoot, tier);
         if (arm && (current?.armId !== arm.armId || current.armEpoch !== arm.armEpoch)) {
@@ -65,22 +86,21 @@ export async function beat(argv, cwd = process.cwd(), deps = defaultBeatDeps())
         throw new Error(`${tier} DISARMED — stood down; use --new-arm to resume beating`);
     };
     if (values["new-arm"] || loop) {
-        const arm = await withLegacyClaim(repoRoot, tier, writer(), (recheck) => {
+        const arm = await withLegacyClaim(repoRoot, tier, writer(), (recheck, held) => {
             recheck();
-            const created = newSupervisionArm(repoRoot, tier, armId);
-            tick(recheck, created, true);
+            const created = supervised(repoRoot, tier, held, (root) => newSupervisionArm(root, tier, armId));
+            tick(recheck, held, created, true);
             return created;
         });
-        // ponytail: a running loop outlasts a brief claim holder (a repeat start, a status-side stop) for ~5 s of
-        // retries, then refuses nonzero; a per-tick deadline if holders ever legitimately run longer.
-        const waits = { tries: 20, sleep: deps.sleep };
+        // ponytail: every tick outlasts a brief claim holder (a repeat start, a stop) for ~5 s of retries, then
+        // refuses nonzero; a per-tick deadline if holders ever legitimately run longer.
         while (loop) {
             await deps.sleep(SUPERVISION_BEAT_MS);
-            await withLegacyClaim(repoRoot, tier, writer(true, arm), (recheck) => tick(recheck, arm), waits);
+            await withLegacyClaim(repoRoot, tier, writer(true, arm), (recheck, held) => tick(recheck, held, arm));
         }
     }
     else
-        await withLegacyClaim(repoRoot, tier, writer(), (recheck) => tick(recheck));
+        await withLegacyClaim(repoRoot, tier, writer(), (recheck, held) => tick(recheck, held));
     return `${tier} ARMED as ${seat} — beat again every ${SUPERVISION_BEAT_MS / 1_000}s; the tier reads STALE ${SUPERVISION_STALE_MS / 1_000}s after the last beat`;
 }
 /** Unknown, duplicate, conflicting or empty options refuse here — before anything is read or written. */
@@ -138,9 +158,9 @@ function percentage(raw, name) {
     }
     return value;
 }
-/** Record an explicit hand-off: the tier reads DISARMED, a stood-down tier, not a dead one. */
-export function standDownTier(repoRoot, tier, seat) {
-    publishStandDown(repoRoot, tier, seat);
+/** Record an explicit hand-off: the tier reads DISARMED, a stood-down tier, not a dead one. `held`: the writer's claimed-act guard. */
+export function standDownTier(repoRoot, tier, seat, held = unclaimed) {
+    supervised(repoRoot, tier, held, (root) => publishStandDown(root, tier, seat));
     return `${tier} DISARMED — ${seat} handed off; status reads it stood down, not dead`;
 }
 const isTier = (v) => SUPERVISION_TIERS.includes(v ?? "");

package/dist/cli/commands/doctor.js

@@ -600,6 +600,9 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             const retirements = a.listModelsRetirements?.();
             if (retirements)
                 health[a.id].modelRetirements = retirements;
+            const hidden = a.listModelsHidden?.(); // v2.6.9 (D-1526): the CLI's hidden flag, read by routing
+            if (hidden)
+                health[a.id].modelsHidden = hidden;
         }
         catch { /* fail open: leave models as-is, doctor stays healthy */ }
     }

package/dist/cli/commands/fleet.js

@@ -1265,6 +1265,8 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         steeringOptionsFor,
         reviewAdvisories,
         reviewOverlay,
+        // B-KEYS r2 (D-1446): the editor's row memo keys on both overlay layers' bytes — previewCfg's own key
+        layerStamp: () => `${currentUserText()}\u0000${currentRepoOverlayText(cwd)}`,
         reloadGuard,
         stagedRouting,
         holderOf,

package/dist/cli/commands/plan.js

@@ -11,7 +11,7 @@ import { DEFAULT_CONFIG, effectiveReviewPolicy, overlayPreferShapes, ROUTING_MOD
 import { batteryPriority, chainDepth, dispatchWaves, graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
 import { filesGlob } from "../../graph/files-glob.js";
 import { renderAcceptanceItem } from "../../graph/schema.js";
-import { pendingDaemonApprovalActions, resolveRunMode } from "../../run/daemon.js";
+import { pendingDaemonApprovalActions, replayedReviewerDemotions, resolveRunMode } from "../../run/daemon.js";
 import { disallowedBy, excludedChannels, exclusionLine, observedSeat, routingEntrySeatLines } from "../../route/preference.js";
 import { decayWeight, HALF_LIFE_RUNS, staffLedEvidence } from "../../route/profile.js";
 import { resolvedFloor, route, RoutingError } from "../../route/router.js";
@@ -193,22 +193,20 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             .filter((event) => event.event === "gate-result" && event.data.gate === "review" && typeof event.data.reviewer === "string")
             .map((event) => event.data.reviewer)
         : [];
-    // daemon.ts replayedReviewerExclusions: a journaled review-pool-demotion is excluded from every review
-    // pick of the resumed run this plan previews (reviewer role only).
-    const replayedReviewerExclusions = [...new Set((matchingEvents ?? [])
-            .filter((event) => event.event === "review-pool-demotion" && typeof event.data.reviewer === "string")
-            .map((event) => event.data.reviewer))];
-    const demotedReviewers = new Set(replayedReviewerExclusions);
+    // daemon.ts demotedReviewers: a journaled review-pool-demotion is a SOFT preference in the resumed run
+    // this plan previews (ranked last, never excluded; reviewer role only) — never a launch-caused one (v2.6.8 T1).
+    const demotedReviewers = replayedReviewerDemotions(matchingEvents ?? []);
     // daemon.ts demotedChannels: the resumed run's worker exclusions (journal replayExcludedChannels).
     const runJournal = matchingRunId ? Journal.open(cwd, matchingRunId) : undefined;
     const demotedWorkers = runJournal?.replayExcludedChannels() ?? new Set();
-    // run-gates.ts retired (OBS-1025 add.2): seats with two no-verdicts this run are out of every pick, tallied
-    // as daemon.ts seeds reviewNoVerdicts — noVerdict rows only, and a checkout-proof timeout never strikes.
+    // run-gates.ts retired (OBS-1025 add.2): seats with two real no-verdicts this run are out of every pick,
+    // tallied as daemon.ts seeds reviewNoVerdicts — noVerdict rows only, and a launch failure (any
+    // launchCause, or none) never strikes (v2.6.8 T1).
     const noVerdicts = new Map();
     for (const event of matchingEvents ?? []) {
         if (event.event !== "review-no-verdict" || event.data.noVerdict !== true || typeof event.data.reviewer !== "string")
             continue;
-        if (event.data.cause === "seat-launch-failed" && event.data.launchCause === "checkout-proof-timeout")
+        if (event.data.cause === "seat-launch-failed")
             continue;
         noVerdicts.set(event.data.reviewer, (noVerdicts.get(event.data.reviewer) ?? 0) + 1);
     }
@@ -412,15 +410,15 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
         // Never dispatched, daemon.ts subjectAuthors is just the fresh author; its vendor stays off the review.
         const authors = [channelKey(author)];
         const authorVendors = carriedAuthorVendors(pools.review, authors);
-        // Production's inputs as the task's first review round sees them: excludeReviewers = daemon badReviewers =
-        // replayedReviewerExclusions. run-gates.ts:1303 floors on THIS task's journaled reviewers at their dispatched
-        // tiers (daemon taskReviewers) ∪ excludeReviewers, so a replayed exclusion RAISES the floor; :1305 picks
-        // with excludeReviewers ∪ retired. prefer only reorders (the seat count below passes none).
-        const priorReviewers = [...(matchingEvents ?? []).filter((e) => e.taskId === task.id && typeof e.data.reviewer === "string"
-                && ((e.event === "gate-result" && e.data.gate === "review") || e.event === "review-no-verdict"))
-                .map((e) => ({ reviewer: e.data.reviewer, tier: e.data.reviewerTier })), ...replayedReviewerExclusions];
+        // Production's inputs as the task's first review round sees them: excludeReviewers = daemon badReviewers,
+        // empty at resume (a replayed demotion is soft). run-gates floors on THIS task's journaled reviewers at their
+        // dispatched tiers (daemon taskReviewers) ∪ excludeReviewers, and picks with excludeReviewers ∪ retired.
+        // prefer only reorders (the seat count below passes none).
+        const priorReviewers = (matchingEvents ?? []).filter((e) => e.taskId === task.id && typeof e.data.reviewer === "string"
+            && ((e.event === "gate-result" && e.data.gate === "review") || e.event === "review-no-verdict"))
+            .map((e) => ({ reviewer: e.data.reviewer, tier: e.data.reviewerTier }));
         const reviewFloor = gateReviewerFloor(task, cfg, author, pools.review, priorReviewers).floor;
-        const exclusions = [...replayedReviewerExclusions, ...retiredReviewers];
+        const exclusions = retiredReviewers;
         const reviewer = pickReviewer(author, pools.review, exclusions, cfg.review.prefer ?? [], reviewFloor, reviewHistory, (seat, count) => { rotationSeat = seat; rotationCount = count; }, demotedReviewers, authorVendors, authors);
         if (!reviewer)
             return { line: "none — no cross-vendor reviewer available", cost: 0 };

package/dist/cli/commands/verify.js

@@ -13,7 +13,7 @@ import { runGates } from "../../gates/run-gates.js";
 import { getTask, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { executionSignal } from "../../run/execution-budget.js";
-import { linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
+import { addDetachedWorktree, linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
 import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
 import { withRepositoryLease } from "../../run/lease.js";
 import { isPidLive } from "../../run/lock.js";
@@ -417,7 +417,9 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
         }
         const baseDir = mkdtempSync(join(stateDir, `base-${mergeBase.slice(0, 12)}-${process.pid}-`));
         try {
-            await shGitOk(`git worktree add --detach '${baseDir}' '${mergeBase}'`, cwd);
+            const added = await addDetachedWorktree(cwd, baseDir, mergeBase);
+            if (added.code !== 0)
+                throw new Error(`command failed (${added.code}): git worktree add --detach '${baseDir}' '${mergeBase}'\n${added.stderr || added.stdout}`);
             linkNodeModules(cwd, baseDir, { force: true });
             const baseline = await captureBaseline(baseDir, subset);
             if (baseline.refusal)

package/dist/cli/help.js

@@ -149,7 +149,10 @@ export const COMMAND_HELP = {
     },
     beat: {
         usage: "beat <start|stop|status> <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> | beat <tier> --seat <identity> [options]",
-        description: "start launches one detached --loop beat per tier and exits 0 only after reading back that child's own advancing beat; stop retires only that recorded generation and reads back DISARMED; status is read-only and exits nonzero for STALE, MISMATCH or UNREADABLE. The legacy <tier> form writes one supervision beat using the recorded arm: stood-down arms stay DISARMED until explicitly re-armed; stopped beats become STALE.",
+        description: "start launches one detached --loop beat per tier and exits 0 only after reading back that child's own advancing beat; stop retires only that recorded generation and reads back DISARMED; status is read-only and exits nonzero for STALE, MISMATCH, UNREADABLE or a dead invocation's leftovers. The legacy <tier> form writes one supervision beat using the recorded arm: stood-down arms stay DISARMED until explicitly re-armed; stopped beats become STALE. " +
+            "Legacy migration: start refuses a legacy (unowned) ARMED/STALE arm nonzero and prints its exit under the RECORDED seat — `tickmarkr beat <tier> --seat <seat> --stand-down` (`--seat=<seat>` when the seat begins with a dash), after \"stop pid <N> first\" when its --loop writer is still alive (tickmarkr never signals a process it did not launch, nor takes its live claim; an arm with no recorded seat gets no invented one) — then start owns the tier and reads back ARMED. A writer stopped inside its claimed tick does not strand that step: the --stand-down reclaims the claim it died holding, printing the notice; while the writer lives, the step waits and refuses BUSY. " +
+            "Claims — actors IN: compliant claim contenders (start, stop and each legacy write — one-shot, --new-arm, --loop tick, --stand-down — through this CLI), a crashed owner (holder pid ESRCH or a zombie, its claim and records left behind) and a killed compliant recovery or release taker (dead at any step of the one claim-removal path); OUT, the one residual: an external writer editing, replacing or deleting claim, lock or record files outside this CLI, under which nothing beyond the identity MISMATCH refusals is promised (its edit between a final claim check and the mutation's own system call is not seen — there is no filesystem compare-and-rename). A claim records its holder pid and birth (its runtime's own start record, read with no process probe) and, for a launch claim, the launched writer publishing under it. Every claimant takes over a held claim only when every pid read from that claim's own bytes is confirmed dead (ESRCH or a zombie) — the legacy {tier, token, pid, claimedAt} claim included — printing the reclaim notice with its final result even when it then had to wait or refuse; a live, reused or unreadable holder or writer is never taken over: start tries once, every other claimant waits at most 20 attempts 250 ms apart, then refuses BUSY with nothing written. A launched writer acts under its launcher's claim only while that launcher is not confirmed dead, recording itself as the claim's writer before its first act; once the launcher is dead, a writer past its first beat releases that claim itself (with a notice) and takes the tier claim like any writer — or, when that launcher died before binding its arm epoch, exits right after the release, leaving an abandoned launch the next start, stop or legacy write retires — and one still launching refuses having written nothing; a killed start neither strands stop nor lets recovery take the claim from a live writer. Under its launcher's claim the writer checks nothing after its last act (each act verified the claim last), so start's release after its read-back never ends the loop it launched. A claim is removed in one way only, by recovery and by its holder's release alike: under a per-claim removal lock that appears already naming its taker's pid and birth, once no claimed act is running under those bytes (a release waits up to 2 s, a recovery refuses BUSY), the checked bytes are moved aside into the lock and kept only when they are exactly those bytes — other bytes found there are put straight back, and a claim linked while that removal is under way is never acted under: its claimant withdraws exactly the claim it linked and refuses BUSY (its next attempt links afresh). Claim bytes an invocation could not remove — another live taker held them or moved them aside, even on a mistaken death proof, or its release was refused — stay provably that process's strand wherever they are (its pid, its checked birth and a token none of its invocations still holds): while a live taker holds them every claimant is BUSY naming it; once none does, that process's own next start, stop or legacy write withdraws them from the claim path, or discards them from a killed taker's lock instead of restoring them, with a notice; its own status reports them as its stranded claim wherever they are — on the claim path or moved aside into a live or dead taker's lock, naming that taker — with the recovery command (to run once a live taker has finished or exited); and once that process has exited they are a dead claim any start, stop or legacy write reclaims — so no caller, a long-lived bridge included, needs to exit before recovery completes, and no claim is left that nobody acts under and nobody can recover. Killed-taker recovery: a lock whose taker is confirmed dead is recovered by the next start, stop or legacy write with a notice naming that taker — bytes it moved aside are discarded when every pid they record is dead, otherwise restored — and that invocation also removes the act markers, <tier>.stage.<pid>.<id> directories and the pid-named entry a taker killed while assembling or releasing its lock (before its owner entry is written, or after it is moved out) left, each with a notice naming the dead pid; a live or unprovable taker's lock is never taken (BUSY, naming it). \"Never taken over\" therefore means: only a claim or lock proven dead is reclaimed, exactly as checked; nothing live or unknown is taken, and no claim, lock or stage directory is ever the operator's to remove by hand. Dead owners recover the same way: a generation whose recorded pid is confirmed dead, or a launch abandoned before it bound its pid or arm epoch (no launch holds the claim and no recorded process is alive), is retired — its owner record removed, nothing signalled — by the next stop (which stands its arm down and reads back DISARMED), by start (which stands it down, then launches and reads back ARMED) or by a legacy write from that seat (whose requested write then proceeds: a one-shot records its beat on that arm, --stand-down stands it down, --new-arm/--loop replace it), each printing the recovery; an owner whose recorded process lives is never retired this way. Every claimed mutation — each owner record rename, log open, spawn, signal and removal, and each record a staged stand-down, arm or beat write changed — is one claimed act: it marks the claim, re-runs its owner-generation check inside the act (a staged write also compares every supervision record with what it was staged from), then verifies the claim LAST, immediately before the mutation. No claim removal lands inside an act, and a claim, owner or arm replaced before that final check lands nothing further: nothing more is written, signalled or removed and the invocation refuses nonzero at its next check, its release included (a launched writer under its launcher's claim has no release: what its acts landed, they landed under the verified claim). Status (beat status <tier> and the legacy <tier> --status) only observes: over a dead claim or a killed taker's or writer's leftovers it changes no file, exits nonzero naming the dead pids and prints the command that recovers them, and it names every live holder (the claim's, and each removal lock's taker) beside the state it reads, `tickmarkr beat stop <tier> --seat <seat>` (the recorded seat, else the one given, quoted as one shell word) — start or a legacy write recovers the same way; status never does. " +
+            "Identity: Linux teardown argv ([comm]) and a child dying mid-read stay UNREADABLE until a complete read or confirmed death (\"died before its beat read back\"); on Darwin a missing or unusable lsof refuses UNREADABLE naming lsof, and restoring lsof restores start/status/stop.",
         options: {
             "--seat <identity>": "Required for start, stop and every write: identify the supervising pane or agent; optional for status.",
             "--new-arm": "Create a new durable arm, allowing beats to resume after stand-down; the hand-off step for a seat taking over a stood-down tier (combine with --arm-id and --pct on a context tier).",
@@ -157,7 +160,7 @@ export const COMMAND_HELP = {
             "--arm-id <identity>": "Name a newly created arm; with --pct, identify the context observation arm. Never refuses a tick.",
             "--pct <0..100>": "Report current context consumption percentage.",
             "--threshold-pct <0..100>": "Set the context warning threshold (default 75).",
-            "--stand-down": "Record an explicit handoff and stand down this tier. A later one-shot tick on the old arm exits non-zero; context observations still raise and discharge the clear duty.",
+            "--stand-down": "Record an explicit handoff and stand down this tier. A later one-shot tick on the old arm exits non-zero; context observations still raise and discharge the clear duty. With the recorded seat it is the legacy migration step start prints — it reclaims a claim the stopped writer died holding, never a live one; then start owns the tier.",
             "--status": "Legacy spelling of beat status <tier>: the same read-only result, writing nothing.",
         }, examples: [
             "beat start overseer --seat supervisor", "beat status overseer --seat supervisor", "beat stop overseer --seat supervisor",

package/dist/config/config.js

@@ -551,20 +551,21 @@ export const DEFAULT_CONFIG = {
         // astra=frontier and luna=cheap follow the provider's own descriptions in the local cache (read
         // 2026-09-29: "Frontier intelligence for the most demanding work" / "Fast and affordable model for
         // easier tasks"); sol=frontier keeps the shipped workhorse-family mapping (gpt-5.6-sol above) by
-        // continuity. Learned routing or an overlay may retier on evidence. gpt-5.5 stays seeded until its
-        // CLI-announced retirement (2026-10-14T19:00:00Z → gpt-5.6-sol); gpt-5.6-sol is not retiring.
-        // Windows: the same snapshot lists context_window=272000 for all seven — the budget the CLI launches
+        // continuity. Learned routing or an overlay may retier on evidence. v2.6.9 (queue row 64): gpt-5.5 left
+        // the seed — the CLI hides it and announces its retirement (2026-10-14T19:00:00Z); its successor is
+        // whatever the CLI's notice names (doctor quotes it), never a fixed id here.
+        // Windows: the same snapshot lists context_window=272000 for the six still seeded — the budget the CLI launches
         // with, and the authority for these seeds. The API's published 1,050,000 is a different surface and is
         // not contradicted. A later cache listing more ids (gpt-6.1-sol) does not widen this sealed set.
         codex: {
             vendor: "openai", channel: "sub",
             models: {
                 "gpt-6-astra": "frontier", "gpt-6-sol": "frontier", "gpt-6-luna": "cheap",
-                "gpt-5.6-sol": "frontier", "gpt-5.5": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap",
+                "gpt-5.6-sol": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap",
             },
             windows: {
                 "gpt-6-astra": 272_000, "gpt-6-sol": 272_000, "gpt-6-luna": 272_000,
-                "gpt-5.6-sol": 272_000, "gpt-5.5": 272_000, "gpt-5.6-terra": 272_000, "gpt-5.6-luna": 272_000,
+                "gpt-5.6-sol": 272_000, "gpt-5.6-terra": 272_000, "gpt-5.6-luna": 272_000,
             },
         },
         // grok-4.5 (xAI, released 2026-07-08) → mid: AA Intelligence 54 (#4), Terminal-Bench 2.1 83.3%

package/dist/drivers/herdr.js

@@ -4,7 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { declaredInputBoxForWorkerName, matchesEmptyInputBox, matchesInputBox, matchesOccupiedInputBox, missingInputStateDeclarations, shq } from "../adapters/types.js";
 import { consumePaneLaunchIntent, PANE_IDENTITY_ENV, paneIdentityLine } from "../brand.js";
-import { createWorktree, sh } from "../run/git.js";
+import { createWorktree, sh, shGit } from "../run/git.js";
 import { Journal } from "../run/journal.js";
 import { readSupervision, readWatchBoard, requestWatchBoardStop, reserveWatchBoard, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
 import { canonicalWorktreePath } from "./orca.js";
@@ -487,7 +487,7 @@ export class HerdrDriver {
         if (typeof pane.cwd !== "string" || canonicalWorktreePath(pane.cwd) !== checkout) {
             throw new Error(`herdr adopt: pane ${pane.pane_id} labelled ${slot.name} sits in ${pane.cwd ?? "an unreported cwd"}, not the task checkout ${checkout} — foreign`);
         }
-        const top = await sh("git rev-parse --show-toplevel", checkout);
+        const top = await shGit("git rev-parse --show-toplevel", checkout);
         if (top.code !== 0 || canonicalWorktreePath(top.stdout.trim()) !== checkout) {
             throw new Error(`herdr adopt: ${checkout} is not its own git checkout — no checkout proof for ${slot.name}`);
         }

package/dist/drivers/orca.d.ts

@@ -32,10 +32,13 @@ export declare class OrcaError extends Error {
     readonly code?: string;
     readonly runtimeId?: string;
     readonly launchCause?: SeatLaunchCause;
+    /** v2.6.8 T1: the CLI was killed at the timeout it was handed — the one evidence that a deadline interrupted it. */
+    readonly timedOut?: boolean;
     constructor(family: string, reason: string, raw: string, opts?: {
         code?: string;
         runtimeId?: string;
         launchCause?: SeatLaunchCause;
+        timedOut?: boolean;
     });
 }
 /** The slot cannot be addressed: dead/unknown terminal record, or a handle that cannot be recovered
@@ -86,9 +89,12 @@ export declare function canonicalWorktreePath(path: string): string;
 /** The proof line a worker terminal prints first: create, recovery and focus read it back. */
 export declare const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 /** E1: the one typed launch cause a driver attaches to its launch failure. `checkout-proof-timeout`
- *  means the terminal printed NO proof frame by the ceiling — a slow host, not a misplaced seat. A
- *  foreign or malformed frame is placement evidence and carries no cause (never a timeout exemption). */
+ *  means the terminal printed NO proof frame by the ceiling — or (v2.6.8 T1) a read the ceiling
+ *  interrupted left the own frame's prefix unfinished — a slow host, not a misplaced seat. A complete
+ *  foreign frame, or a malformed one read whole (in a page landing late or at the ceiling too), is
+ *  placement evidence and carries no cause. */
 export type SeatLaunchCause = "checkout-proof-timeout";
+export declare function withLaunchGuard<T>(guard: () => void, run: () => Promise<T>): Promise<T>;
 /** The exact bytes the create command prints as its first line. */
 export declare function checkoutProofLine(checkout: string): string;
 /** Every complete frame in a scrollback, decoded and canonicalized; whether an incomplete one was seen. */
@@ -266,12 +272,14 @@ export declare class OrcaDriver implements ExecutorDriver {
      * the terminal record must name `handle` and `_meta.runtimeId` must be `runtimeId` — the runtime
      * that supplied the ownership listing — else another terminal's or another runtime's bytes were
      * answered and nothing is proven. Proven means provesCheckout: exact canonical full-path equality
-     * of a complete frame, no other checkout named, no incomplete frame.
+     * of a complete frame, no other checkout named, no incomplete frame or unparseable mark — in the pages
+     * or the anchor's tail (v2.6.8 T1).
      * E1: with a `deadline` (create's window) there is ONE absolute deadline: a read is issued only while
      * budget is left and is handed exactly that budget, and a page that still lands past it is late —
      * nothing late proves the checkout. `seen` is what the scrollback showed, for the typed timeout:
      * `misplaced` — a frame naming another checkout, a cut frame or an unparseable mark in anything read
-     * (the anchor's tail and every page included, even when paging stopped or a later read threw);
+     * (the anchor's tail and every page included, even when paging stopped, a later read threw or the page's
+     * own cursors were malformed — v2.6.8 T1; the tail read after the pages it overlaps, tailInContext);
      * `absent` — ONLY when every page down to the start of the scrollback was read before the ceiling
      * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
      * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read