tickmarkr 2.6.8 → 2.6.9

package/dist/adapters/catalog-remote.js

@@ -505,9 +505,12 @@ export async function refreshCatalogCommand(opts) {
     let modelsDev = current.catalog.modelsDev;
     let modelsDevUpdated = false;
     try {
-        modelsDev = await fetchCatalog(fetcher, MODELS_DEV_CATALOG_URL, {}, timeoutMs, (r) => r.json());
-        if (!validModelsDevCatalog(modelsDev))
+        // v2.6.9 (queue row 97): validate before the payload replaces the spine — an invalid payload left in
+        // modelsDev would be written beside an updated sibling leg and make the whole cache unreadable.
+        const fetched = await fetchCatalog(fetcher, MODELS_DEV_CATALOG_URL, {}, timeoutMs, (r) => r.json());
+        if (!validModelsDevCatalog(fetched))
             throw new Error("models.dev catalog schema is invalid");
+        modelsDev = fetched;
         modelsDevUpdated = true;
         legAt.modelsDev = stamp;
         legs.push({ leg: "models.dev", status: "updated", detail: "fetched", retry: "next retry after this leg is stale" });

package/dist/adapters/codex.d.ts

@@ -3,6 +3,7 @@ export declare function readCodexModelsCache(path?: string): {
     models: string[];
     fetchedAt?: string;
     retirements?: Record<string, ModelRetirement | null>;
+    hidden?: string[];
 };
 export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ \"$tkr_gitdir\" != \"$tkr_common\" ]; then printf '\"%s\",' \"$tkr_gitdir\"; fi; printf '\"%s/objects\",\"%s/refs\",\"%s/logs\"' \"$tkr_common\" \"$tkr_common\" \"$tkr_common\")]\"";
 export declare const CODEX_TRUST_DIALOG: TrustDialog;

package/dist/adapters/codex.js

@@ -61,23 +61,29 @@ function codexSessionDayDirs(sessions, sinceMs) {
 // Fails OPEN to { models: [] } on missing/corrupt cache. Version drift observed (installed CLI
 // 0.143.0 vs cache client_version 0.144.0, 2026-07-10) — hence the defensive try/catch and no shape
 // assumptions. CODEX_HOME is codex's own relocation env. fetchedAt is the honest codex knowledge age.
-// v2.6.4 T2 (B1a): each listed entry's `upgrade` is the CLI's own retirement notice (0.159.0 cache,
-// 2026-09-29: gpt-5.5 → {model: gpt-5.6-sol, retirement_at: 2026-10-14T19:00:00Z}; every other listed
-// id carries upgrade: null). null records known clean; a malformed or absent `upgrade` records nothing,
-// so that id stays unknown. An unreadable cache returns no retirements at all (unknown, never clean).
+// v2.6.4 T2 (B1a): each entry's `upgrade` is the CLI's own retirement notice; its successor is whatever
+// that notice names — never a fixed id in this file. A listed row with upgrade: null records known clean;
+// a malformed or absent `upgrade` records nothing, so that id stays unknown. v2.6.9 (queue row 64): the CLI
+// HIDES a model before it retires it (0.162.0, 2026-10-08: gpt-5.5 visibility "hide" with a dated
+// upgrade), so a valid dated notice is read from hidden rows too; a hidden row still never lists, and a
+// hidden row without a dated notice records nothing (delisted is not known clean). `hidden` names every
+// visibility "hide" row (D-1526: routing evidence). An unreadable cache returns neither (unknown, never clean).
 export function readCodexModelsCache(path) {
     const p = path ?? join(process.env.CODEX_HOME || join(homedir(), ".codex"), "models_cache.json");
     try {
         const d = JSON.parse(readFileSync(p, "utf8"));
-        const listed = (d.models ?? [])
-            .filter((m) => m?.visibility === "list" && typeof m.slug === "string" && m.slug.length > 0 && MODEL_ID_RE.test(m.slug));
+        const rows = (d.models ?? [])
+            .filter((m) => typeof m?.slug === "string" && m.slug.length > 0 && MODEL_ID_RE.test(m.slug));
+        const listed = rows.filter((m) => m.visibility === "list");
         const retirements = {};
-        for (const m of listed) {
+        for (const m of rows) {
             const notice = codexRetirement(m.upgrade);
-            if (notice !== undefined)
-                retirements[m.slug] = notice;
+            if (notice === undefined || (notice === null && m.visibility !== "list"))
+                continue;
+            retirements[m.slug] = notice;
         }
-        return { models: listed.map((m) => m.slug), fetchedAt: typeof d.fetched_at === "string" ? d.fetched_at : undefined, retirements };
+        const hidden = rows.filter((m) => m.visibility === "hide").map((m) => m.slug);
+        return { models: listed.map((m) => m.slug), fetchedAt: typeof d.fetched_at === "string" ? d.fetched_at : undefined, retirements, hidden };
     }
     catch {
         return { models: [] };
@@ -305,6 +311,8 @@ export const codex = {
     listModelsFetchedAt: () => readCodexModelsCache().fetchedAt,
     // v2.6.4 T2 (B1a): the cache's per-model retirement notices, persisted beside models in doctor.json.
     listModelsRetirements: () => readCodexModelsCache().retirements,
+    // v2.6.9 (D-1526): the ids the cache marks hidden, persisted beside models as routing evidence.
+    listModelsHidden: () => readCodexModelsCache().hidden,
     collectUsage(cwd, sinceMs) {
         try {
             const real = realpathSync(cwd);

package/dist/adapters/model-lints.js

@@ -497,13 +497,15 @@ function storedRetirement(record, model) {
         return { retiresAt: n.retiresAt };
     return typeof n.successor === "string" && MODEL_ID_RE.test(n.successor) ? { retiresAt: n.retiresAt, successor: n.successor } : undefined;
 }
-// Configured AND listed models only — a configured id the CLI stopped listing already carries the
-// tombstone advisory. The CLI's notice is quoted as-is: its successor is the CLI's upgrade target, never
-// a tier or benchmark claim, and no model name or visibility is read as one. Advisory: routing unchanged.
-function retirementLints(id, listedConfigured, record, nowMs) {
+// Configured models the CLI lists, plus configured models it stopped listing that still carry a dated
+// notice (the CLI hides a model before retiring it); any other unlisted id carries the bare tombstone
+// advisory instead. The CLI's notice is quoted as-is: its successor is the CLI's upgrade target, never
+// a tier or benchmark claim, and no model name or visibility is read as one. The notice never changes routing;
+// the CLI's hide does (D-1526), so a hidden id's lint says it is not routed instead of "routing unchanged".
+function retirementLints(id, configured, listed, hiddenIds, record, nowMs) {
     const lints = [];
     const unknown = [];
-    for (const model of listedConfigured) {
+    for (const model of configured) {
         const notice = storedRetirement(record, model);
         if (notice === undefined) {
             unknown.push(model);
@@ -511,12 +513,14 @@ function retirementLints(id, listedConfigured, record, nowMs) {
         }
         if (!notice)
             continue; // listed with no notice: known clean
+        const hidden = listed.includes(model) ? "" : " (the CLI no longer lists it)";
+        const routing = hiddenIds.includes(model) && !listed.includes(model) ? "not routed while the CLI hides it" : "routing unchanged";
         const successor = notice.successor
             ? `successor ${notice.successor} (named by the CLI — not a tier claim; classify it per benchmark policy)`
             : "no successor named";
         lints.push(nowMs >= Date.parse(notice.retiresAt)
-            ? `${id}: ${model} retired ${notice.retiresAt} per the CLI's notice; ${successor} — tombstone it (${model}: null overlay) or verify the id (advisory — routing unchanged)`
-            : `${id}: ${model} retires ${notice.retiresAt} per the CLI's notice; ${successor} — tombstone it (${model}: null overlay) before then (advisory — routing unchanged)`);
+            ? `${id}: ${model} retired ${notice.retiresAt} per the CLI's notice${hidden}; ${successor} — tombstone it (${model}: null overlay) or verify the id (advisory — ${routing})`
+            : `${id}: ${model} retires ${notice.retiresAt} per the CLI's notice${hidden}; ${successor} — tombstone it (${model}: null overlay) before then (advisory — ${routing})`);
     }
     if (unknown.length) {
         const why = record && typeof record === "object"
@@ -555,19 +559,25 @@ export function modelLints(cfg, health, adapters, opts) {
         }
         const h = health[id];
         const detected = h?.models ?? []; // MANDATORY default: pre-v1.5 files lack a populated models array
+        const configured = Object.keys(cfg.tiers[id]?.models ?? {});
+        // a configured id the CLI stopped listing but still carries a dated notice for gets the dated lint, not the bare one
+        const noticed = (model) => !!adapter.listModelsRetirements && !!storedRetirement(h?.modelRetirements, model);
         if (detected.length === 0) {
             if (h?.installed)
                 lints.push(`${id}: no detection data — run tickmarkr doctor`);
+            // D-1526: a cache holding only hidden rows lists nothing, yet its dated notices are still the CLI's word
+            if (adapter.listModelsRetirements)
+                lints.push(...retirementLints(id, configured.filter(noticed), detected, h?.modelsHidden ?? [], h?.modelRetirements, nowMs));
             continue; // no data to diff or age
         }
-        const configured = Object.keys(cfg.tiers[id]?.models ?? {});
         for (const model of configured) {
-            if (!detected.includes(model)) {
+            if (!detected.includes(model) && !noticed(model)) {
                 lints.push(`${id}: tiers lists ${model} — CLI no longer reports it; tombstone it (${model}: null overlay) or verify the id`);
             }
         }
-        if (adapter.listModelsRetirements)
-            lints.push(...retirementLints(id, configured.filter((m) => detected.includes(m)), h?.modelRetirements, nowMs));
+        if (adapter.listModelsRetirements) {
+            lints.push(...retirementLints(id, configured.filter((m) => detected.includes(m) || noticed(m)), detected, h?.modelsHidden ?? [], h?.modelRetirements, nowMs));
+        }
         const extra = collapseUnclassified(detected, new Set(configured));
         if (extra.length) {
             const shown = extra.slice(0, cap).map((row) => row.model).join(", ");

package/dist/adapters/model-windows.js

@@ -49,7 +49,6 @@ const VENDORED_MODEL_WINDOW_CLAIMS = [
     { modelId: "gpt-6-sol", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-6-luna", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-5.6-sol", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
-    { modelId: "gpt-5.5", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-5.6-terra", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-5.6-luna", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "composer-2.5", window: 200_000, source: CURSOR_SOURCE, readDate: READ_DATE },

package/dist/adapters/registry.js

@@ -107,14 +107,18 @@ function modelListValidated(h) {
     return !!h?.modelsDetectedAt && Array.isArray(h.models);
 }
 export function invalidConfiguredModels(cfg, adapterId, h) {
+    const configured = Object.keys(cfg.tiers[adapterId]?.models ?? {});
+    // v2.6.9 (queue row 64, D-1526): an id the CLI's own list marks hidden is positive evidence it stopped offering
+    // it — out whatever the overlap below. The fail-open that follows covers only ids with no such evidence.
+    const hidden = new Set(h?.modelsHidden ?? []);
+    const hiddenConfigured = configured.filter((m) => hidden.has(m) && !(h?.models ?? []).includes(m));
     if (!modelListValidated(h))
-        return [];
+        return hiddenConfigured;
     const listed = new Set(h.models);
-    const configured = Object.keys(cfg.tiers[adapterId]?.models ?? {});
     // Fail open until the CLI list intersects at least one configured model — proves the list is authoritative
     // for this adapter's tier namespace (MODEL-04: unrelated detected ids must not invalidate routing).
     if (!configured.some((m) => listed.has(m)))
-        return [];
+        return hiddenConfigured;
     return configured.filter((m) => !listed.has(m));
 }
 export function modelAliasExclusions(cfg, adapters, health) {

package/dist/adapters/types.d.ts

@@ -51,6 +51,7 @@ export interface AuthHealth {
     modelAuth?: Record<string, ModelAuth>;
     modelIdentities?: Record<string, string>;
     modelRetirements?: Record<string, ModelRetirement | null>;
+    modelsHidden?: string[];
     codexCommit?: CodexCommitStatus;
     launchServices?: LaunchServicesRecord;
 }
@@ -206,6 +207,7 @@ export interface WorkerAdapter {
     listModels?(): Promise<string[]>;
     listModelsFetchedAt?(): string | undefined;
     listModelsRetirements?(): Record<string, ModelRetirement | null> | undefined;
+    listModelsHidden?(): string[] | undefined;
     collectUsage?(cwd: string, sinceMs: number): TokenUsage | undefined;
     contextUsage?(session: SessionRef): ContextUsage | null;
     readSessionTranscript?(session: SessionRef): {

package/dist/cli/commands/doctor.js

@@ -600,6 +600,9 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             const retirements = a.listModelsRetirements?.();
             if (retirements)
                 health[a.id].modelRetirements = retirements;
+            const hidden = a.listModelsHidden?.(); // v2.6.9 (D-1526): the CLI's hidden flag, read by routing
+            if (hidden)
+                health[a.id].modelsHidden = hidden;
         }
         catch { /* fail open: leave models as-is, doctor stays healthy */ }
     }

package/dist/config/config.js

@@ -551,20 +551,21 @@ export const DEFAULT_CONFIG = {
         // astra=frontier and luna=cheap follow the provider's own descriptions in the local cache (read
         // 2026-09-29: "Frontier intelligence for the most demanding work" / "Fast and affordable model for
         // easier tasks"); sol=frontier keeps the shipped workhorse-family mapping (gpt-5.6-sol above) by
-        // continuity. Learned routing or an overlay may retier on evidence. gpt-5.5 stays seeded until its
-        // CLI-announced retirement (2026-10-14T19:00:00Z → gpt-5.6-sol); gpt-5.6-sol is not retiring.
-        // Windows: the same snapshot lists context_window=272000 for all seven — the budget the CLI launches
+        // continuity. Learned routing or an overlay may retier on evidence. v2.6.9 (queue row 64): gpt-5.5 left
+        // the seed — the CLI hides it and announces its retirement (2026-10-14T19:00:00Z); its successor is
+        // whatever the CLI's notice names (doctor quotes it), never a fixed id here.
+        // Windows: the same snapshot lists context_window=272000 for the six still seeded — the budget the CLI launches
         // with, and the authority for these seeds. The API's published 1,050,000 is a different surface and is
         // not contradicted. A later cache listing more ids (gpt-6.1-sol) does not widen this sealed set.
         codex: {
             vendor: "openai", channel: "sub",
             models: {
                 "gpt-6-astra": "frontier", "gpt-6-sol": "frontier", "gpt-6-luna": "cheap",
-                "gpt-5.6-sol": "frontier", "gpt-5.5": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap",
+                "gpt-5.6-sol": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap",
             },
             windows: {
                 "gpt-6-astra": 272_000, "gpt-6-sol": 272_000, "gpt-6-luna": 272_000,
-                "gpt-5.6-sol": 272_000, "gpt-5.5": 272_000, "gpt-5.6-terra": 272_000, "gpt-5.6-luna": 272_000,
+                "gpt-5.6-sol": 272_000, "gpt-5.6-terra": 272_000, "gpt-5.6-luna": 272_000,
             },
         },
         // grok-4.5 (xAI, released 2026-07-08) → mid: AA Intelligence 54 (#4), Terminal-Bench 2.1 83.3%

package/dist/tui/ink/fleet-app.js

@@ -44,6 +44,18 @@ function ledgerChannelId(line) {
     const slash = head.indexOf("/");
     return slash === -1 ? undefined : `${head.slice(0, slash)}:${head.slice(slash + 1)}`;
 }
+/**
+ * Space picks exactly as Enter does in every single-select overlay (operator field report 2026-10-08,
+ * "can't choose here space key doesn't select" — the reach picker even OPENS on Space). Space keeps its
+ * own meaning only where it has one: the multi-select chains (candidates, prefer) toggle on it, the text
+ * stages (add-model, the classify note) type it, and the review diff confirms only on `y`. The lift
+ * listing is a confirm, not a pick: it clears a deny entry for every channel that entry covers, so only
+ * Enter lifts — a stray Space there does nothing.
+ */
+const spacePicks = (overlay) => overlay.kind === "classify"
+    ? overlay.stage !== "note"
+    : overlay.kind === "presets" || overlay.kind === "assign" || overlay.kind === "poolmode"
+        || overlay.kind === "judge" || overlay.kind === "reach";
 const REACH_CHOICES = [
     { id: "in", label: "in", gloss: "every seat may route here" },
     { id: "out-workers", label: "out · workers", gloss: "workers skip it; judge/review/consult unaffected" },
@@ -991,6 +1003,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
             return true;
         };
         if (overlay) {
+            const pick = key.return || (input === " " && spacePicks(overlay));
             if (overlay.kind === "presets") {
                 const rowCount = modeOptions.length + (overlay.home ? 1 : 0);
                 if (key.escape) {
@@ -1015,7 +1028,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return) {
+                if (pick) {
                     if (overlay.home && overlay.at === modeOptions.length) {
                         setOverlay(null); // custom → the browser IS the full editor
                         return;
@@ -1065,8 +1078,10 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     finish({ kind: "discard" });
                     return;
                 }
+                // the review screen holds every staged edit by definition — `q` takes the same two presses
+                // as every other screen, never one keystroke to lose the session (`n` is the explicit discard)
                 if (input === "q") {
-                    finish({ kind: "quit" });
+                    guardedQuit(armed);
                     return;
                 }
                 if (input === "y") {
@@ -1097,7 +1112,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                         bump();
                         return;
                     }
-                    if (key.return) {
+                    if (pick) {
                         const channel = CHANNELS[overlay.channelAt];
                         ui.channelByAdapter[overlay.adapter] = channel;
                         // OBS-508: a bulk stage waiting on the one first-touch channel answer resumes here.
@@ -1125,7 +1140,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                         bump();
                         return;
                     }
-                    if (key.return) {
+                    if (pick) {
                         // OBS-508: keep the suggested band → the evidence note arrives pre-typed; override the
                         // band → the note starts empty (the suggestion argues for a DIFFERENT tier).
                         const chosen = TIERS[overlay.tierAt];
@@ -1208,7 +1223,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return && rows[overlay.at]) {
+                if (pick && rows[overlay.at]) {
                     const shape = rows[overlay.at].id;
                     ui.map = { ...ui.map, [shape]: { pin: { via: overlay.adapter, model: overlay.model } } };
                     setOverlay(null);
@@ -1305,7 +1320,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return) {
+                if (pick) {
                     const { shape, chain } = overlay.picker;
                     // a pool is the shape's WHOLE declaration: pin and prefer leave with it (schema
                     // exclusivity — pin+pool and pool+prefer both fail config load)
@@ -1383,7 +1398,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return) {
+                if (pick) {
                     const choice = REACH_CHOICES[overlay.at].id;
                     setOverlay(null);
                     applyReach(overlay.target, choice);
@@ -1420,7 +1435,8 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                 bump();
                 return;
             }
-            if (key.return && rows[overlay.at]) {
+            // Space picks too (spacePicks): a judge picker that swallowed it read as "can't choose"
+            if (pick && rows[overlay.at]) {
                 // single-select: one seat or back to the config default — never a chain
                 const picked = rows[overlay.at];
                 ui.judgeSeat = picked === judgeKeepRow ? null : picked;
@@ -2045,7 +2061,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
         const rows = [judgeKeepRow, ...judgeSeats].filter((row) => matches(row, ui.filter));
         const { visible, start, above, below } = windowRows(rows, overlay.at, capacity);
         const selectedSeat = ui.judgeSeat ?? judgeKeepRow;
-        return (_jsxs(OverlayPanel, { title: "pick \u00B7 judge", width: bodyW, children: [_jsx(Text, { dimColor: true, children: "one seat judges acceptance criteria \u2014 failover stays runtime (GATE-09)" }), _jsx(SearchRow, { filter: ui.filter, active: true }), above > 0 && _jsx(ElisionMark, { count: above, side: "above" }), visible.map((label, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: start + index === overlay.at }), label === selectedSeat ? _jsx(Glyph, { kind: "on" }) : _jsx(Text, { children: " " }), _jsx(Text, { bold: start + index === overlay.at, children: ` ${clip(label, bodyW - 10)}` })] }, label))), below > 0 && _jsx(ElisionMark, { count: below, side: "below" })] }));
+        return (_jsxs(OverlayPanel, { title: "pick \u00B7 judge", width: bodyW, children: [_jsx(Text, { dimColor: true, wrap: "truncate", children: clip("Space or Enter picks · Esc keeps · one seat judges acceptance criteria — failover stays runtime (GATE-09)", bodyW - 4) }), _jsx(SearchRow, { filter: ui.filter, active: true }), above > 0 && _jsx(ElisionMark, { count: above, side: "above" }), visible.map((label, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: start + index === overlay.at }), label === selectedSeat ? _jsx(Glyph, { kind: "on" }) : _jsx(Text, { children: " " }), _jsx(Text, { bold: start + index === overlay.at, children: ` ${clip(label, bodyW - 10)}` })] }, label))), below > 0 && _jsx(ElisionMark, { count: below, side: "below" })] }));
     })();
     const modelVisibilityLine = () => {
         const hidden = hiddenModelCount();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.6.8",
+  "version": "2.6.9",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -114,6 +114,9 @@
       "scripts/export-public.sh",
       "scripts/verify-export.sh",
       "tests/scripts/verify-export.test.ts",
+      "scripts/check-analysis.mjs",
+      "scripts/atlas.mjs",
+      "tests/docs/analysis-library.test.ts",
       ".github/workflows/ci.yml",
       "**/*.local.*"
     ]