tickmarkr 2.6.8 → 2.7.0

package/dist/adapters/catalog-remote.js

@@ -505,9 +505,12 @@ export async function refreshCatalogCommand(opts) {
     let modelsDev = current.catalog.modelsDev;
     let modelsDevUpdated = false;
     try {
-        modelsDev = await fetchCatalog(fetcher, MODELS_DEV_CATALOG_URL, {}, timeoutMs, (r) => r.json());
-        if (!validModelsDevCatalog(modelsDev))
+        // v2.6.9 (queue row 97): validate before the payload replaces the spine — an invalid payload left in
+        // modelsDev would be written beside an updated sibling leg and make the whole cache unreadable.
+        const fetched = await fetchCatalog(fetcher, MODELS_DEV_CATALOG_URL, {}, timeoutMs, (r) => r.json());
+        if (!validModelsDevCatalog(fetched))
             throw new Error("models.dev catalog schema is invalid");
+        modelsDev = fetched;
         modelsDevUpdated = true;
         legAt.modelsDev = stamp;
         legs.push({ leg: "models.dev", status: "updated", detail: "fetched", retry: "next retry after this leg is stale" });

package/dist/adapters/codex.d.ts

@@ -3,6 +3,7 @@ export declare function readCodexModelsCache(path?: string): {
     models: string[];
     fetchedAt?: string;
     retirements?: Record<string, ModelRetirement | null>;
+    hidden?: string[];
 };
 export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ \"$tkr_gitdir\" != \"$tkr_common\" ]; then printf '\"%s\",' \"$tkr_gitdir\"; fi; printf '\"%s/objects\",\"%s/refs\",\"%s/logs\"' \"$tkr_common\" \"$tkr_common\" \"$tkr_common\")]\"";
 export declare const CODEX_TRUST_DIALOG: TrustDialog;

package/dist/adapters/codex.js

@@ -61,23 +61,29 @@ function codexSessionDayDirs(sessions, sinceMs) {
 // Fails OPEN to { models: [] } on missing/corrupt cache. Version drift observed (installed CLI
 // 0.143.0 vs cache client_version 0.144.0, 2026-07-10) — hence the defensive try/catch and no shape
 // assumptions. CODEX_HOME is codex's own relocation env. fetchedAt is the honest codex knowledge age.
-// v2.6.4 T2 (B1a): each listed entry's `upgrade` is the CLI's own retirement notice (0.159.0 cache,
-// 2026-09-29: gpt-5.5 → {model: gpt-5.6-sol, retirement_at: 2026-10-14T19:00:00Z}; every other listed
-// id carries upgrade: null). null records known clean; a malformed or absent `upgrade` records nothing,
-// so that id stays unknown. An unreadable cache returns no retirements at all (unknown, never clean).
+// v2.6.4 T2 (B1a): each entry's `upgrade` is the CLI's own retirement notice; its successor is whatever
+// that notice names — never a fixed id in this file. A listed row with upgrade: null records known clean;
+// a malformed or absent `upgrade` records nothing, so that id stays unknown. v2.6.9 (queue row 64): the CLI
+// HIDES a model before it retires it (0.162.0, 2026-10-08: gpt-5.5 visibility "hide" with a dated
+// upgrade), so a valid dated notice is read from hidden rows too; a hidden row still never lists, and a
+// hidden row without a dated notice records nothing (delisted is not known clean). `hidden` names every
+// visibility "hide" row (D-1526: routing evidence). An unreadable cache returns neither (unknown, never clean).
 export function readCodexModelsCache(path) {
     const p = path ?? join(process.env.CODEX_HOME || join(homedir(), ".codex"), "models_cache.json");
     try {
         const d = JSON.parse(readFileSync(p, "utf8"));
-        const listed = (d.models ?? [])
-            .filter((m) => m?.visibility === "list" && typeof m.slug === "string" && m.slug.length > 0 && MODEL_ID_RE.test(m.slug));
+        const rows = (d.models ?? [])
+            .filter((m) => typeof m?.slug === "string" && m.slug.length > 0 && MODEL_ID_RE.test(m.slug));
+        const listed = rows.filter((m) => m.visibility === "list");
         const retirements = {};
-        for (const m of listed) {
+        for (const m of rows) {
             const notice = codexRetirement(m.upgrade);
-            if (notice !== undefined)
-                retirements[m.slug] = notice;
+            if (notice === undefined || (notice === null && m.visibility !== "list"))
+                continue;
+            retirements[m.slug] = notice;
         }
-        return { models: listed.map((m) => m.slug), fetchedAt: typeof d.fetched_at === "string" ? d.fetched_at : undefined, retirements };
+        const hidden = rows.filter((m) => m.visibility === "hide").map((m) => m.slug);
+        return { models: listed.map((m) => m.slug), fetchedAt: typeof d.fetched_at === "string" ? d.fetched_at : undefined, retirements, hidden };
     }
     catch {
         return { models: [] };
@@ -305,6 +311,8 @@ export const codex = {
     listModelsFetchedAt: () => readCodexModelsCache().fetchedAt,
     // v2.6.4 T2 (B1a): the cache's per-model retirement notices, persisted beside models in doctor.json.
     listModelsRetirements: () => readCodexModelsCache().retirements,
+    // v2.6.9 (D-1526): the ids the cache marks hidden, persisted beside models as routing evidence.
+    listModelsHidden: () => readCodexModelsCache().hidden,
     collectUsage(cwd, sinceMs) {
         try {
             const real = realpathSync(cwd);

package/dist/adapters/model-lints.js

@@ -497,13 +497,15 @@ function storedRetirement(record, model) {
         return { retiresAt: n.retiresAt };
     return typeof n.successor === "string" && MODEL_ID_RE.test(n.successor) ? { retiresAt: n.retiresAt, successor: n.successor } : undefined;
 }
-// Configured AND listed models only — a configured id the CLI stopped listing already carries the
-// tombstone advisory. The CLI's notice is quoted as-is: its successor is the CLI's upgrade target, never
-// a tier or benchmark claim, and no model name or visibility is read as one. Advisory: routing unchanged.
-function retirementLints(id, listedConfigured, record, nowMs) {
+// Configured models the CLI lists, plus configured models it stopped listing that still carry a dated
+// notice (the CLI hides a model before retiring it); any other unlisted id carries the bare tombstone
+// advisory instead. The CLI's notice is quoted as-is: its successor is the CLI's upgrade target, never
+// a tier or benchmark claim, and no model name or visibility is read as one. The notice never changes routing;
+// the CLI's hide does (D-1526), so a hidden id's lint says it is not routed instead of "routing unchanged".
+function retirementLints(id, configured, listed, hiddenIds, record, nowMs) {
     const lints = [];
     const unknown = [];
-    for (const model of listedConfigured) {
+    for (const model of configured) {
         const notice = storedRetirement(record, model);
         if (notice === undefined) {
             unknown.push(model);
@@ -511,12 +513,14 @@ function retirementLints(id, listedConfigured, record, nowMs) {
         }
         if (!notice)
             continue; // listed with no notice: known clean
+        const hidden = listed.includes(model) ? "" : " (the CLI no longer lists it)";
+        const routing = hiddenIds.includes(model) && !listed.includes(model) ? "not routed while the CLI hides it" : "routing unchanged";
         const successor = notice.successor
             ? `successor ${notice.successor} (named by the CLI — not a tier claim; classify it per benchmark policy)`
             : "no successor named";
         lints.push(nowMs >= Date.parse(notice.retiresAt)
-            ? `${id}: ${model} retired ${notice.retiresAt} per the CLI's notice; ${successor} — tombstone it (${model}: null overlay) or verify the id (advisory — routing unchanged)`
-            : `${id}: ${model} retires ${notice.retiresAt} per the CLI's notice; ${successor} — tombstone it (${model}: null overlay) before then (advisory — routing unchanged)`);
+            ? `${id}: ${model} retired ${notice.retiresAt} per the CLI's notice${hidden}; ${successor} — tombstone it (${model}: null overlay) or verify the id (advisory — ${routing})`
+            : `${id}: ${model} retires ${notice.retiresAt} per the CLI's notice${hidden}; ${successor} — tombstone it (${model}: null overlay) before then (advisory — ${routing})`);
     }
     if (unknown.length) {
         const why = record && typeof record === "object"
@@ -555,19 +559,25 @@ export function modelLints(cfg, health, adapters, opts) {
         }
         const h = health[id];
         const detected = h?.models ?? []; // MANDATORY default: pre-v1.5 files lack a populated models array
+        const configured = Object.keys(cfg.tiers[id]?.models ?? {});
+        // a configured id the CLI stopped listing but still carries a dated notice for gets the dated lint, not the bare one
+        const noticed = (model) => !!adapter.listModelsRetirements && !!storedRetirement(h?.modelRetirements, model);
         if (detected.length === 0) {
             if (h?.installed)
                 lints.push(`${id}: no detection data — run tickmarkr doctor`);
+            // D-1526: a cache holding only hidden rows lists nothing, yet its dated notices are still the CLI's word
+            if (adapter.listModelsRetirements)
+                lints.push(...retirementLints(id, configured.filter(noticed), detected, h?.modelsHidden ?? [], h?.modelRetirements, nowMs));
             continue; // no data to diff or age
         }
-        const configured = Object.keys(cfg.tiers[id]?.models ?? {});
         for (const model of configured) {
-            if (!detected.includes(model)) {
+            if (!detected.includes(model) && !noticed(model)) {
                 lints.push(`${id}: tiers lists ${model} — CLI no longer reports it; tombstone it (${model}: null overlay) or verify the id`);
             }
         }
-        if (adapter.listModelsRetirements)
-            lints.push(...retirementLints(id, configured.filter((m) => detected.includes(m)), h?.modelRetirements, nowMs));
+        if (adapter.listModelsRetirements) {
+            lints.push(...retirementLints(id, configured.filter((m) => detected.includes(m) || noticed(m)), detected, h?.modelsHidden ?? [], h?.modelRetirements, nowMs));
+        }
         const extra = collapseUnclassified(detected, new Set(configured));
         if (extra.length) {
             const shown = extra.slice(0, cap).map((row) => row.model).join(", ");

package/dist/adapters/model-windows.js

@@ -49,7 +49,6 @@ const VENDORED_MODEL_WINDOW_CLAIMS = [
     { modelId: "gpt-6-sol", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-6-luna", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-5.6-sol", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
-    { modelId: "gpt-5.5", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-5.6-terra", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "gpt-5.6-luna", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "composer-2.5", window: 200_000, source: CURSOR_SOURCE, readDate: READ_DATE },

package/dist/adapters/registry.js

@@ -107,14 +107,18 @@ function modelListValidated(h) {
     return !!h?.modelsDetectedAt && Array.isArray(h.models);
 }
 export function invalidConfiguredModels(cfg, adapterId, h) {
+    const configured = Object.keys(cfg.tiers[adapterId]?.models ?? {});
+    // v2.6.9 (queue row 64, D-1526): an id the CLI's own list marks hidden is positive evidence it stopped offering
+    // it — out whatever the overlap below. The fail-open that follows covers only ids with no such evidence.
+    const hidden = new Set(h?.modelsHidden ?? []);
+    const hiddenConfigured = configured.filter((m) => hidden.has(m) && !(h?.models ?? []).includes(m));
     if (!modelListValidated(h))
-        return [];
+        return hiddenConfigured;
     const listed = new Set(h.models);
-    const configured = Object.keys(cfg.tiers[adapterId]?.models ?? {});
     // Fail open until the CLI list intersects at least one configured model — proves the list is authoritative
     // for this adapter's tier namespace (MODEL-04: unrelated detected ids must not invalidate routing).
     if (!configured.some((m) => listed.has(m)))
-        return [];
+        return hiddenConfigured;
     return configured.filter((m) => !listed.has(m));
 }
 export function modelAliasExclusions(cfg, adapters, health) {

package/dist/adapters/types.d.ts

@@ -51,6 +51,7 @@ export interface AuthHealth {
     modelAuth?: Record<string, ModelAuth>;
     modelIdentities?: Record<string, string>;
     modelRetirements?: Record<string, ModelRetirement | null>;
+    modelsHidden?: string[];
     codexCommit?: CodexCommitStatus;
     launchServices?: LaunchServicesRecord;
 }
@@ -206,6 +207,7 @@ export interface WorkerAdapter {
     listModels?(): Promise<string[]>;
     listModelsFetchedAt?(): string | undefined;
     listModelsRetirements?(): Record<string, ModelRetirement | null> | undefined;
+    listModelsHidden?(): string[] | undefined;
     collectUsage?(cwd: string, sinceMs: number): TokenUsage | undefined;
     contextUsage?(session: SessionRef): ContextUsage | null;
     readSessionTranscript?(session: SessionRef): {

package/dist/cli/commands/doctor.js

@@ -600,6 +600,9 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             const retirements = a.listModelsRetirements?.();
             if (retirements)
                 health[a.id].modelRetirements = retirements;
+            const hidden = a.listModelsHidden?.(); // v2.6.9 (D-1526): the CLI's hidden flag, read by routing
+            if (hidden)
+                health[a.id].modelsHidden = hidden;
         }
         catch { /* fail open: leave models as-is, doctor stays healthy */ }
     }

package/dist/config/config.js

@@ -551,20 +551,21 @@ export const DEFAULT_CONFIG = {
         // astra=frontier and luna=cheap follow the provider's own descriptions in the local cache (read
         // 2026-09-29: "Frontier intelligence for the most demanding work" / "Fast and affordable model for
         // easier tasks"); sol=frontier keeps the shipped workhorse-family mapping (gpt-5.6-sol above) by
-        // continuity. Learned routing or an overlay may retier on evidence. gpt-5.5 stays seeded until its
-        // CLI-announced retirement (2026-10-14T19:00:00Z → gpt-5.6-sol); gpt-5.6-sol is not retiring.
-        // Windows: the same snapshot lists context_window=272000 for all seven — the budget the CLI launches
+        // continuity. Learned routing or an overlay may retier on evidence. v2.6.9 (queue row 64): gpt-5.5 left
+        // the seed — the CLI hides it and announces its retirement (2026-10-14T19:00:00Z); its successor is
+        // whatever the CLI's notice names (doctor quotes it), never a fixed id here.
+        // Windows: the same snapshot lists context_window=272000 for the six still seeded — the budget the CLI launches
         // with, and the authority for these seeds. The API's published 1,050,000 is a different surface and is
         // not contradicted. A later cache listing more ids (gpt-6.1-sol) does not widen this sealed set.
         codex: {
             vendor: "openai", channel: "sub",
             models: {
                 "gpt-6-astra": "frontier", "gpt-6-sol": "frontier", "gpt-6-luna": "cheap",
-                "gpt-5.6-sol": "frontier", "gpt-5.5": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap",
+                "gpt-5.6-sol": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap",
             },
             windows: {
                 "gpt-6-astra": 272_000, "gpt-6-sol": 272_000, "gpt-6-luna": 272_000,
-                "gpt-5.6-sol": 272_000, "gpt-5.5": 272_000, "gpt-5.6-terra": 272_000, "gpt-5.6-luna": 272_000,
+                "gpt-5.6-sol": 272_000, "gpt-5.6-terra": 272_000, "gpt-5.6-luna": 272_000,
             },
         },
         // grok-4.5 (xAI, released 2026-07-08) → mid: AA Intelligence 54 (#4), Terminal-Bench 2.1 83.3%

package/dist/run/daemon.d.ts

@@ -253,8 +253,8 @@ export declare function verifyIntegrationTipCached(intWt: string, commands: Reco
 type SuitePidProbe = (pid: number) => number | undefined;
 /** Count full-suite roots in one process-table snapshot. The probes are arguments so the ownership
  * rules remain testable on hosts that forbid process inspection; production supplies cwd and the
- * inherited TICKMARKR_SUITE_PARENT marker from the process itself. */
-export declare function countLiveSuites(snapshot: string, repoRoot: string, daemonPid?: number, cwdForPid?: (pid: number) => string | undefined, suiteParentForPid?: SuitePidProbe): number;
+ * inherited TICKMARKR_SUITE_PARENT marker from one batched async probe (suite-census.ts, queue row 103). */
+export declare function countLiveSuites(snapshot: string, repoRoot: string, daemonPid: number, cwdForPid: (pid: number) => string | undefined, suiteParentForPid: SuitePidProbe): number;
 export declare const setLiveSuiteCountForTests: (probe: (repoRoot: string) => Promise<number>) => void;
 export declare const resetLiveSuiteCountForTests: () => void;
 /** Live full-suite roots attributable to this repository or this daemon. Ancestors are excluded so

package/dist/run/daemon.js

@@ -9,6 +9,7 @@ import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
+import { batchedProcessProbes, runnerPids } from "./suite-census.js";
 import { stringify } from "yaml";
 import { BOOTSTRAP_FAILURE_RE, classifyDeadChannel, classifyTransientCapacity, trailerPattern, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, getAdapter, probeAll, readDoctor, rolePools } from "../adapters/registry.js";
@@ -1243,48 +1244,14 @@ async function observeWorkerProcessTree(marker, cwd) {
     }
     return tree.size === 0 ? "empty" : "running";
 }
-function processCwd(pid) {
-    try {
-        return realpathSync(readlinkSync(`/proc/${pid}/cwd`));
-    }
-    catch { /* Darwin has no /proc */ }
-    try {
-        const out = execFileSync("lsof", ["-a", "-p", String(pid), "-d", "cwd", "-Fn"], {
-            encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000,
-        });
-        const path = out.split("\n").find((line) => line.startsWith("n"))?.slice(1);
-        return path ? realpathSync(path) : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function processSuiteParent(pid) {
-    try {
-        const env = readFileSync(`/proc/${pid}/environ`, "utf8").split("\0");
-        const value = env.find((entry) => entry.startsWith(`${SUITE_PARENT_ENV}=`))?.slice(SUITE_PARENT_ENV.length + 1);
-        return value && /^\d+$/.test(value) ? Number(value) : undefined;
-    }
-    catch { /* Darwin has no /proc process environments */ }
-    try {
-        const out = execFileSync("ps", ["eww", "-p", String(pid), "-o", "command="], {
-            encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000,
-        });
-        const value = new RegExp(`(?:^|\\s)${SUITE_PARENT_ENV}=(\\d+)(?:\\s|$)`).exec(out)?.[1];
-        return value ? Number(value) : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 const pathAtOrBelow = (root, candidate) => {
     const rel = relative(root, candidate);
     return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
 };
 /** Count full-suite roots in one process-table snapshot. The probes are arguments so the ownership
  * rules remain testable on hosts that forbid process inspection; production supplies cwd and the
- * inherited TICKMARKR_SUITE_PARENT marker from the process itself. */
-export function countLiveSuites(snapshot, repoRoot, daemonPid = process.pid, cwdForPid = processCwd, suiteParentForPid = processSuiteParent) {
+ * inherited TICKMARKR_SUITE_PARENT marker from one batched async probe (suite-census.ts, queue row 103). */
+export function countLiveSuites(snapshot, repoRoot, daemonPid, cwdForPid, suiteParentForPid) {
     const rows = [];
     for (const line of snapshot.split("\n")) {
         const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
@@ -1344,7 +1311,11 @@ export async function liveSuiteCount(repoRoot) {
     if (liveSuiteCountForTests)
         return liveSuiteCountForTests(repoRoot);
     const snapshot = await shGit("ps -Aww -o pid=,ppid=,state=,command=", repoRoot, 15_000);
-    return snapshot.code === 0 ? countLiveSuites(snapshot.stdout, repoRoot) : 0;
+    if (snapshot.code !== 0)
+        return 0;
+    // row 103: one batched async probe per snapshot — a synchronous lsof/ps per pid held this loop 44–46 s
+    const probes = await batchedProcessProbes(runnerPids(snapshot.stdout));
+    return countLiveSuites(snapshot.stdout, repoRoot, process.pid, probes.cwd, probes.suiteParent);
 }
 const OBSERVE_CHUNK_BYTES = 64 * 1024;
 const OBSERVE_BUDGET_BYTES = 256 * 1024 * 1024;

package/dist/run/suite-census.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Queue row 103 (D-1553): the live-suite census asks each runner-looking process for its cwd and its inherited
+ * TICKMARKR_SUITE_PARENT marker. It used to ask one pid at a time with a synchronous `lsof` and `ps`, which held the
+ * daemon's event loop 44–46 s under a full suite (the stall traces recorded for queue row 8). Here every pid is answered by /proc where it
+ * exists (Linux, child-free), else by ONE async `lsof` and ONE async `ps eww`, plus one more `lsof` for suite parents
+ * not already probed — the census asks for a parent's cwd too. The answers feed countLiveSuites' existing lookups.
+ */
+export type ProbeExec = (file: string, args: readonly string[]) => Promise<string>;
+/** The pids of every live (non-zombie) row of a `ps -o pid=,ppid=,state=,command=` snapshot whose command is a runner. */
+export declare function runnerPids(snapshot: string): number[];
+/** The /proc reads, injectable so the Linux branch is testable anywhere; each throws where /proc has no entry. */
+export interface ProcReader {
+    cwd(pid: number): string;
+    environ(pid: number): string;
+}
+export interface CensusProbes {
+    cwd: (pid: number) => string | undefined;
+    suiteParent: (pid: number) => number | undefined;
+}
+export declare function batchedProcessProbes(pids: readonly number[], exec?: ProbeExec, proc?: ProcReader): Promise<CensusProbes>;

package/dist/run/suite-census.js

@@ -0,0 +1,100 @@
+import { execFile } from "node:child_process";
+import { readFileSync, readlinkSync, realpathSync } from "node:fs";
+import { isRunnerCommand } from "./lease.js";
+import { SUITE_PARENT_ENV } from "./git.js";
+// A pid that exits between the snapshot and the probe makes lsof/ps exit non-zero while still printing every other
+// row, so an ordinary non-zero exit (a numeric code, no signal) keeps whatever was printed. D-1564: a timeout, a kill, a
+// spawn failure or an output-cap overflow is no answer — the base's execFileSync threw there and discarded any partial
+// output, so these answer nothing even when they buffered rows first.
+// D-1561: execFile can also throw SYNCHRONOUSLY (EPERM, EAGAIN under fork pressure); the base's per-pid try/catch answered
+// that as "unknown", so this probe never throws or rejects either — it answers nothing.
+const probeExec = (file, args) => new Promise((resolve) => {
+    try {
+        execFile(file, [...args], { encoding: "utf8", timeout: 15_000, maxBuffer: 16 * 1024 * 1024 }, (error, stdout) => resolve(error && (error.killed || error.signal || typeof error.code !== "number") ? "" : String(stdout ?? "")));
+    }
+    catch {
+        resolve("");
+    }
+});
+/** The pids of every live (non-zombie) row of a `ps -o pid=,ppid=,state=,command=` snapshot whose command is a runner. */
+export function runnerPids(snapshot) {
+    const pids = [];
+    for (const line of snapshot.split("\n")) {
+        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        if (match && !match[3].startsWith("Z") && isRunnerCommand(match[4]))
+            pids.push(Number(match[1]));
+    }
+    return pids;
+}
+const procReader = {
+    cwd: (pid) => realpathSync(readlinkSync(`/proc/${pid}/cwd`)),
+    environ: (pid) => readFileSync(`/proc/${pid}/environ`, "utf8"),
+};
+export async function batchedProcessProbes(pids, exec = probeExec, proc = procReader) {
+    // the census never rejects, whatever exec does (queue row 103's closed case table, D-1561)
+    const ask = async (file, args) => { try {
+        return await exec(file, args);
+    }
+    catch {
+        return "";
+    } };
+    const cwds = new Map();
+    const parents = new Map();
+    const parentIn = (text) => new RegExp(`(?:^|\\s)${SUITE_PARENT_ENV}=(\\d+)(?:\\s|$)`).exec(text)?.[1];
+    // D-1567 batch poisoning: lsof and ps fail the WHOLE command for one -p member they cannot take (a marker of 22 digits
+    // prints as 1e+21, 310 nines as Infinity; ps refuses one above int32), erasing every other pid's answer. The base probed
+    // per pid, so such a pid lost only its own answer: it stays unanswered here and never joins a batch.
+    const probeable = (pid) => Number.isSafeInteger(pid) && pid > 0 && pid <= 2_147_483_647;
+    const probeCwds = async (wanted) => {
+        const rest = [];
+        for (const pid of wanted.filter(probeable)) {
+            try {
+                cwds.set(pid, proc.cwd(pid));
+            }
+            catch {
+                rest.push(pid);
+            } // Darwin has no /proc
+        }
+        if (rest.length === 0)
+            return;
+        let pid;
+        for (const line of (await ask("lsof", ["-a", "-p", rest.join(","), "-d", "cwd", "-Fn"])).split("\n")) {
+            if (line.startsWith("p"))
+                pid = Number(line.slice(1));
+            else if (line.startsWith("n") && pid !== undefined) {
+                try {
+                    cwds.set(pid, realpathSync(line.slice(1)));
+                }
+                catch { /* the directory is gone */ }
+            }
+        }
+    };
+    const probeParents = async (wanted) => {
+        const rest = [];
+        for (const pid of wanted.filter(probeable)) {
+            try {
+                // the base's exact rule (7c8009772 daemon.ts:1418-1423, D-1558): ONE NUL-delimited entry, its WHOLE value digits —
+                // a joined string would let another variable's text, or a value with trailing junk, pass for the marker
+                const value = proc.environ(pid).split("\0").find((entry) => entry.startsWith(`${SUITE_PARENT_ENV}=`))?.slice(SUITE_PARENT_ENV.length + 1);
+                if (value && /^\d+$/.test(value))
+                    parents.set(pid, Number(value));
+            }
+            catch {
+                rest.push(pid);
+            } // Darwin has no /proc process environments
+        }
+        if (rest.length === 0)
+            return;
+        for (const line of (await ask("ps", ["eww", "-p", rest.join(","), "-o", "pid=,command="])).split("\n")) {
+            const row = /^\s*(\d+)\s+(.*)$/.exec(line);
+            const value = row ? parentIn(row[2]) : undefined;
+            if (row && value)
+                parents.set(Number(row[1]), Number(value));
+        }
+    };
+    const unique = [...new Set(pids)];
+    await probeCwds(unique);
+    await probeParents(unique);
+    await probeCwds([...new Set(parents.values())].filter((pid) => !cwds.has(pid)));
+    return { cwd: (pid) => cwds.get(pid), suiteParent: (pid) => parents.get(pid) };
+}

package/dist/tui/ink/fleet-app.js

@@ -44,6 +44,18 @@ function ledgerChannelId(line) {
     const slash = head.indexOf("/");
     return slash === -1 ? undefined : `${head.slice(0, slash)}:${head.slice(slash + 1)}`;
 }
+/**
+ * Space picks exactly as Enter does in every single-select overlay (operator field report 2026-10-08,
+ * "can't choose here space key doesn't select" — the reach picker even OPENS on Space). Space keeps its
+ * own meaning only where it has one: the multi-select chains (candidates, prefer) toggle on it, the text
+ * stages (add-model, the classify note) type it, and the review diff confirms only on `y`. The lift
+ * listing is a confirm, not a pick: it clears a deny entry for every channel that entry covers, so only
+ * Enter lifts — a stray Space there does nothing.
+ */
+const spacePicks = (overlay) => overlay.kind === "classify"
+    ? overlay.stage !== "note"
+    : overlay.kind === "presets" || overlay.kind === "assign" || overlay.kind === "poolmode"
+        || overlay.kind === "judge" || overlay.kind === "reach";
 const REACH_CHOICES = [
     { id: "in", label: "in", gloss: "every seat may route here" },
     { id: "out-workers", label: "out · workers", gloss: "workers skip it; judge/review/consult unaffected" },
@@ -991,6 +1003,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
             return true;
         };
         if (overlay) {
+            const pick = key.return || (input === " " && spacePicks(overlay));
             if (overlay.kind === "presets") {
                 const rowCount = modeOptions.length + (overlay.home ? 1 : 0);
                 if (key.escape) {
@@ -1015,7 +1028,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return) {
+                if (pick) {
                     if (overlay.home && overlay.at === modeOptions.length) {
                         setOverlay(null); // custom → the browser IS the full editor
                         return;
@@ -1065,8 +1078,10 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     finish({ kind: "discard" });
                     return;
                 }
+                // the review screen holds every staged edit by definition — `q` takes the same two presses
+                // as every other screen, never one keystroke to lose the session (`n` is the explicit discard)
                 if (input === "q") {
-                    finish({ kind: "quit" });
+                    guardedQuit(armed);
                     return;
                 }
                 if (input === "y") {
@@ -1097,7 +1112,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                         bump();
                         return;
                     }
-                    if (key.return) {
+                    if (pick) {
                         const channel = CHANNELS[overlay.channelAt];
                         ui.channelByAdapter[overlay.adapter] = channel;
                         // OBS-508: a bulk stage waiting on the one first-touch channel answer resumes here.
@@ -1125,7 +1140,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                         bump();
                         return;
                     }
-                    if (key.return) {
+                    if (pick) {
                         // OBS-508: keep the suggested band → the evidence note arrives pre-typed; override the
                         // band → the note starts empty (the suggestion argues for a DIFFERENT tier).
                         const chosen = TIERS[overlay.tierAt];
@@ -1208,7 +1223,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return && rows[overlay.at]) {
+                if (pick && rows[overlay.at]) {
                     const shape = rows[overlay.at].id;
                     ui.map = { ...ui.map, [shape]: { pin: { via: overlay.adapter, model: overlay.model } } };
                     setOverlay(null);
@@ -1305,7 +1320,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return) {
+                if (pick) {
                     const { shape, chain } = overlay.picker;
                     // a pool is the shape's WHOLE declaration: pin and prefer leave with it (schema
                     // exclusivity — pin+pool and pool+prefer both fail config load)
@@ -1383,7 +1398,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return) {
+                if (pick) {
                     const choice = REACH_CHOICES[overlay.at].id;
                     setOverlay(null);
                     applyReach(overlay.target, choice);
@@ -1420,7 +1435,8 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                 bump();
                 return;
             }
-            if (key.return && rows[overlay.at]) {
+            // Space picks too (spacePicks): a judge picker that swallowed it read as "can't choose"
+            if (pick && rows[overlay.at]) {
                 // single-select: one seat or back to the config default — never a chain
                 const picked = rows[overlay.at];
                 ui.judgeSeat = picked === judgeKeepRow ? null : picked;
@@ -2045,7 +2061,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
         const rows = [judgeKeepRow, ...judgeSeats].filter((row) => matches(row, ui.filter));
         const { visible, start, above, below } = windowRows(rows, overlay.at, capacity);
         const selectedSeat = ui.judgeSeat ?? judgeKeepRow;
-        return (_jsxs(OverlayPanel, { title: "pick \u00B7 judge", width: bodyW, children: [_jsx(Text, { dimColor: true, children: "one seat judges acceptance criteria \u2014 failover stays runtime (GATE-09)" }), _jsx(SearchRow, { filter: ui.filter, active: true }), above > 0 && _jsx(ElisionMark, { count: above, side: "above" }), visible.map((label, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: start + index === overlay.at }), label === selectedSeat ? _jsx(Glyph, { kind: "on" }) : _jsx(Text, { children: " " }), _jsx(Text, { bold: start + index === overlay.at, children: ` ${clip(label, bodyW - 10)}` })] }, label))), below > 0 && _jsx(ElisionMark, { count: below, side: "below" })] }));
+        return (_jsxs(OverlayPanel, { title: "pick \u00B7 judge", width: bodyW, children: [_jsx(Text, { dimColor: true, wrap: "truncate", children: clip("Space or Enter picks · Esc keeps · one seat judges acceptance criteria — failover stays runtime (GATE-09)", bodyW - 4) }), _jsx(SearchRow, { filter: ui.filter, active: true }), above > 0 && _jsx(ElisionMark, { count: above, side: "above" }), visible.map((label, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: start + index === overlay.at }), label === selectedSeat ? _jsx(Glyph, { kind: "on" }) : _jsx(Text, { children: " " }), _jsx(Text, { bold: start + index === overlay.at, children: ` ${clip(label, bodyW - 10)}` })] }, label))), below > 0 && _jsx(ElisionMark, { count: below, side: "below" })] }));
     })();
     const modelVisibilityLine = () => {
         const hidden = hiddenModelCount();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.6.8",
+  "version": "2.7.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -114,6 +114,9 @@
       "scripts/export-public.sh",
       "scripts/verify-export.sh",
       "tests/scripts/verify-export.test.ts",
+      "scripts/check-analysis.mjs",
+      "scripts/atlas.mjs",
+      "tests/docs/analysis-library.test.ts",
       ".github/workflows/ci.yml",
       "**/*.local.*"
     ]