tickmarkr 2.7.4 → 2.7.6

package/dist/cli/commands/init.js

@@ -111,7 +111,7 @@ Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version\`, re
 
 ### Tip-verify-before-green
 
-A run is green only when ALL of these hold: the run-end event exists in the journal, tip verify is not "failed", the run-end summary's \`failed\`, \`human\`, \`blocked\` and \`pending\` buckets are every one of them empty, AND the owed checks in CURRENT \`tickmarkr status <runId>\` are outstanding empty AND known (\`outstanding 0\`; \`outstanding unknown\` is never empty). The shorter "run-end plus tip verify" form is NOT sufficient: a run ending \`done=[T1,T3,T4] human=[T2] tipVerify=passed\` is a closed PARTIAL run — three of four delivered, one parked — and calling it green is how a park becomes invisible. Empty execution buckets are not sufficient either (D-660): a run ending with every execution bucket empty and \`tipVerify=passed\` after an operator waived one review still owes that accepted-risk review check — status reads \`outstanding 1 (T7 review)\`, and \`tickmarkr run\` and \`resume\` exit 0 on execution alone — so it is execution complete, not green. Read the debt from CURRENT status, never from the run-end record: a \`tickmarkr verify --record <runId>\` discharge that lands after run-end moves current status to \`outstanding 0\` while the historical run-end row still carries 1, and only then is that run green; a legacy waiver without a recorded obligation reads \`outstanding unknown\` and is never green. Never report green to the operator, tab titles, or records until every clause holds; when one does not, name the bucket that is not empty, the outstanding checks, or the unknown debt.
+A run is green only when ALL of these hold: the run-end event exists in the journal and is not fatal, tip verify is not "failed", the run-end summary's \`failed\`, \`human\`, \`blocked\` and \`pending\` buckets are every one of them empty, AND the owed checks in CURRENT \`tickmarkr status <runId>\` are outstanding empty AND known (\`outstanding 0\`; \`outstanding unknown\` is never empty). The shorter "run-end plus tip verify" form is NOT sufficient: a run ending \`done=[T1,T3,T4] human=[T2] tipVerify=passed\` is a closed PARTIAL run — three of four delivered, one parked — and calling it green is how a park becomes invisible. Empty execution buckets are not sufficient either (D-660): a run ending with every execution bucket empty and \`tipVerify=passed\` after an operator waived one review still owes that accepted-risk review check — status reads \`outstanding 1 (T7 review)\`, and \`tickmarkr run\` and \`resume\` exit 0 on execution alone — so it is execution complete, not green. Read the debt from CURRENT status, never from the run-end record: a \`tickmarkr verify --record <runId>\` discharge that lands after run-end moves current status to \`outstanding 0\` while the historical run-end row still carries 1, and only then is that run green; a legacy waiver without a recorded obligation reads \`outstanding unknown\` and is never green. A fatal run-end is never green either: the crash record (\`fatal: true\`) names its phase and error, every task it left running or gated sits in \`pending\` or \`blocked\`, and even with every bucket empty status and report lead with the crash and read \`outstanding unknown\` until the run is resumed; from then on the resumed engagement owns the debt. Never report green to the operator, tab titles, or records until every clause holds; when one does not, name the bucket that is not empty, the outstanding checks, or the unknown debt.
 
 ### Verified handoffs
 

package/dist/cli/commands/report.js

@@ -11,7 +11,7 @@ import { compareRuns } from "../../report/compare.js";
 import { estimateCosts } from "../../report/cost.js";
 import { assignmentChannel, buildOperatorRecord, formatChannelMoney, formatChannelTokens, formatTokenUsage as fields, totalTokens as total, } from "../../report/operator-record.js";
 import { cellsOf, cellSummary } from "../../route/profile.js";
-import { effectiveEvents, foldOwedChecks, Journal, loadRoutingProfile, OWED_DISCHARGE_EVENT, } from "../../run/journal.js";
+import { effectiveEvents, fatalRunEndCause, foldOwedChecks, Journal, loadRoutingProfile, OWED_DISCHARGE_EVENT, } from "../../run/journal.js";
 import { baselineProvenanceOf, fingerprintsOf, forgivenFingerprints, forgivenGateRow, formatBaselineProvenance, formatFingerprints, formatForgiven, formatTipProof, runEndTipProof, } from "../../run/daemon.js";
 import { formatSpan, WALL_PRIORITY, WALL_PRIORITY_TEXT, wallBudget, wallBudgetFacts } from "../../run/wall-budget.js";
 import { deriveRunCockpitData } from "../../tui/cockpit/derive.js";
@@ -241,8 +241,10 @@ const timeLead = (events) => {
  * comparability or supersession note); the rest is folded here from the journal and the current fold.
  */
 export function leadLines(events, owed, finished) {
+    // A fatal run-end leads with its crash: no tally after it may read as a finished run.
+    const crash = fatalRunEndCause(events);
     return [
-        `finished ${[finished.tally, finished.tip, firstPassText(endToEndFirstPass(events)), ...(finished.notes ?? [])].join(" · ")}`,
+        `finished ${[...(crash ? [`run crashed — ${crash}`] : []), finished.tally, finished.tip, firstPassText(endToEndFirstPass(events)), ...(finished.notes ?? [])].join(" · ")}`,
         timeLead(events),
         needsYouText(events, owed),
     ];

package/dist/cli/commands/status.js

@@ -13,7 +13,7 @@ import { projectOperatorSummary } from "../../run/operator-summary.js";
 import { trackJournalRows } from "../../run/protocol.js";
 import { newestPark, permittedDecisionVerbs } from "./approve.js";
 import { currentOwed, endToEndFirstPass, firstPassText, leadLines, leadRows, needsYouText, wallText } from "./report.js";
-import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, } from "../../run/journal.js";
+import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, fatalRunEndCause, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, visibleControls, } from "../../run/journal.js";
 import { isPidLive, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
@@ -649,10 +649,11 @@ const terminalFailureCause = (events) => {
         const e = events[i];
         if (e.event !== "run-end" || typeof e.data.error !== "string")
             continue;
-        const phase = typeof e.data.phase === "string" && e.data.phase.trim()
-            ? `${e.data.phase.trim()} failed`
+        // the recorded error is data: its terminal controls print escaped, never executed (the journal keeps them)
+        const phase = typeof e.data.phase === "string" && visibleControls(e.data.phase)
+            ? `${visibleControls(e.data.phase)} failed`
             : "run failed";
-        return `${phase}: ${e.data.error.replace(/\s+/g, " ").trim()}`;
+        return `${phase}: ${visibleControls(e.data.error)}`;
     }
     return undefined;
 };
@@ -1429,8 +1430,10 @@ const oneLine = (cwd, namedRunId) => {
     // CG1: the lead's facts in one line — lineage first pass, the wall window, and what needs you from
     // the CURRENT fold, so a discharge after run-end moves this line too.
     const { events } = record;
+    // A fatal run-end leads right after the run id: no completion fraction or verify state reads first.
+    const crash = fatalRunEndCause(events);
     return sanitizeTaskText([
-        record.runId, ...claims, firstPassText(endToEndFirstPass(events)), wallText(events), needsYouText(events, currentOwed(events, cwd)),
+        record.runId, ...(crash ? [`run crashed — ${crash}`] : []), ...claims, firstPassText(endToEndFirstPass(events)), wallText(events), needsYouText(events, currentOwed(events, cwd)),
     ].join(" · "));
 };
 export async function status(argv, cwd = process.cwd(), opts = {}) {

package/dist/cli/commands/verify.js

@@ -15,7 +15,7 @@ import { GATE_NAMES } from "../../graph/schema.js";
 import { executionSignal } from "../../run/execution-budget.js";
 import { addDetachedWorktree, linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
 import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
-import { withRepositoryLease } from "../../run/lease.js";
+import { describeLeaseWait, withRepositoryLease } from "../../run/lease.js";
 import { isPidLive } from "../../run/lock.js";
 import { recordLaunchServices } from "../../run/launchservices-check.js";
 /**
@@ -529,9 +529,9 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
             return after ? rows.map((r) => ({ ...r, pass: false, details: `${refused(after)}\n${r.details}`, meta: { ...r.meta, subjectChanged: after } })) : rows;
         }, {
             signal: executionSignal(),
-            onWait: (holder) => {
-                console.error(`verify: waiting for the repository's runner lease held by pid ${holder.pid} in ${holder.cwd}`);
-                recordJournal?.append("suite-wait", values.task ?? "VERIFY", { holderPid: holder.pid, holderCwd: holder.cwd });
+            onWait: (holder, blockers) => {
+                console.error(`verify: waiting for the repository's runner lease ${describeLeaseWait(holder, blockers)}`);
+                recordJournal?.append("suite-wait", values.task ?? "VERIFY", { holderPid: holder.pid, holderCwd: holder.cwd, ...(blockers ? { blockers } : {}) });
             },
         });
         results = [...results, ...suite].sort((a, b) => GATE_NAMES.indexOf(a.gate) - GATE_NAMES.indexOf(b.gate));

package/dist/run/daemon.js

@@ -1858,14 +1858,18 @@ export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "s
     catch (readErr) {
         console.error(`tickmarkr ${runId}: journal read failed while recording the fatal run-end (${readErr instanceof Error ? readErr.message : String(readErr)}) — original error: ${original}`);
     }
+    // A crash can land mid-dispatch. Resume re-pends every dispatched-but-unfinished task, so a running or
+    // gated task is bucketed as the pending task resume will make it — pending, or blocked under a parked
+    // dependency — and no task falls outside the five buckets every reader knows.
+    const repended = graph && { ...graph, tasks: graph.tasks.map((t) => t.status === "running" || t.status === "gated" ? { ...t, status: "pending" } : t) };
     const record = {
         runId,
         branch,
         done: graph?.tasks.filter((t) => t.status === "done").map((t) => t.id) ?? [],
         failed: graph?.tasks.filter((t) => t.status === "failed").map((t) => t.id) ?? [],
         human: graph?.tasks.filter((t) => t.status === "human").map((t) => t.id) ?? [],
-        blocked: graph ? blockedTasks(graph).map((t) => t.id) : [],
-        pending: graph ? pendingTasks(graph).map((t) => t.id) : [],
+        blocked: repended ? blockedTasks(repended).map((t) => t.id) : [],
+        pending: repended ? pendingTasks(repended).map((t) => t.id) : [],
         phase,
         fatal: true,
         error: original,

package/dist/run/journal.d.ts

@@ -191,6 +191,13 @@ export declare const GATE_FINGERPRINT_CAP = 2;
 export declare const receiptOrigin: (data: Record<string, unknown>) => string | undefined;
 export declare function identicalGateFailures(events: JournalEvent[], taskId: string, gate: string, normalized: string): number;
 export declare const readableExcerpt: (text: string) => string;
+/**
+ * One-line display text for a recorded crash: every C0 control but tab and newline, DEL and every C1
+ * control prints as its visible escape (`\x1b`, `\u009b`), so no 7-bit or 8-bit OSC/CSI/ST sequence
+ * reaches a terminal and the reader still sees the text carried one; tabs and line breaks collapse to
+ * one space. The journal row keeps the raw bytes.
+ */
+export declare const visibleControls: (text: string) => string;
 /** What each funded repair's next battery actually reached. A repair spends its budget only
  * when that battery reaches one of the gates it was funded to fix; an earlier red is evidence that
  * this repair never got its funded turn, not a charge against the repair ladder. */
@@ -379,6 +386,11 @@ export interface InterruptedAttempt {
 }
 export declare function resumeHarvestAuthor(events: JournalEvent[], taskId: string): Assignment | undefined;
 export declare function interruptedAttempt(events: JournalEvent[], taskId: string): InterruptedAttempt | undefined;
+/**
+ * The crash a FATAL run-end records, when it closes the newest engagement: `<phase> failed: <error>`.
+ * A later run-start or run-resume supersedes it; a normal run-end is no crash.
+ */
+export declare function fatalRunEndCause(events: readonly JournalEvent[]): string | undefined;
 export declare function runHasEnded(events: JournalEvent[]): boolean;
 /** OBS-53: classify worker-result failures so retries and routing see the true signal, not one lumped bucket. */
 export declare function classifyWorkerResultCause(opts: {

package/dist/run/journal.js

@@ -763,6 +763,16 @@ export function identicalGateFailures(events, taskId, gate, normalized) {
 // the failure fingerprint keep the raw text.
 const TERMINAL_CONTROL_RE = /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?|\x1b\[[0-?]*[ -/]*[@-~]|\x1b[ -/]*[0-~]?|[\x00-\x08\x0b-\x1f\x7f]/g;
 export const readableExcerpt = (text) => text.replace(TERMINAL_CONTROL_RE, "");
+/**
+ * One-line display text for a recorded crash: every C0 control but tab and newline, DEL and every C1
+ * control prints as its visible escape (`\x1b`, `\u009b`), so no 7-bit or 8-bit OSC/CSI/ST sequence
+ * reaches a terminal and the reader still sees the text carried one; tabs and line breaks collapse to
+ * one space. The journal row keeps the raw bytes.
+ */
+export const visibleControls = (text) => text.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/gu, (c) => {
+    const code = c.charCodeAt(0).toString(16);
+    return c < "\x80" ? `\\x${code.padStart(2, "0")}` : `\\u${code.padStart(4, "0")}`;
+}).replace(/\s+/gu, " ").trim();
 export function repairReachSinceApproval(events, taskId) {
     const repairs = [];
     for (const e of effectiveEvents(events)) { // OBS-1178: a refused or unsound approval resets no repair history
@@ -1367,6 +1377,28 @@ export function interruptedAttempt(events, taskId) {
 }
 // Runs can end and later resume in the same journal. The newest lifecycle marker decides whether
 // an unresolved task is still recoverable by this live daemon or belongs to an ended run.
+/**
+ * The crash a FATAL run-end records, when it closes the newest engagement: `<phase> failed: <error>`.
+ * A later run-start or run-resume supersedes it; a normal run-end is no crash.
+ */
+export function fatalRunEndCause(events) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.event === "run-start" || e.event === "run-resume")
+            return undefined;
+        if (e.event !== "run-end")
+            continue;
+        if (e.data.fatal !== true)
+            return undefined;
+        // Display text only: terminal controls in a recorded error (OSC title, CSI clear) print escaped,
+        // never executed, and the journal row keeps the raw bytes.
+        const shown = (v) => typeof v === "string" ? visibleControls(v) : "";
+        const phase = shown(e.data.phase) || "run";
+        const error = shown(e.data.error);
+        return `${phase} failed: ${error || "unrecorded error"}`;
+    }
+    return undefined;
+}
 export function runHasEnded(events) {
     for (let i = events.length - 1; i >= 0; i--) {
         const event = events[i].event;
@@ -1943,7 +1975,9 @@ export class Journal {
                 // C1: the terminal record carries the owed-check fold as of this append, revalidated from
                 // each discharge's artifact — a reopened journal re-reduces, it never copies a prior total.
                 // Canonical (validated) rows are strict and keep their schema; the live producer is the tuple.
-                return decisionRow ? reduced : { ...reduced, owedChecks: foldOwedChecks(priorEvents, join(this.dir, "..", "..", "..")) };
+                // A fatal record folds over itself, so its own owedChecks already read unknown with the crash.
+                const folded = !decisionRow && data.fatal === true ? [...priorEvents, { ts: new Date().toISOString(), event, data }] : priorEvents;
+                return decisionRow ? reduced : { ...reduced, owedChecks: foldOwedChecks(folded, join(this.dir, "..", "..", "..")) };
             })()
             : event === "resume-restore" && rowTaskId && upheldFeedbackByTask(effectiveEvents(priorEvents)).has(rowTaskId)
                 ? {
@@ -2701,12 +2735,16 @@ function dischargeProblem(row, o, events, cwd, memo) {
  * across folds; every artifact, hash, criteria and reviewer condition is still re-read on every fold.
  */
 export function foldOwedChecks(events, cwd, memo) {
+    let fold;
     try {
-        return foldOwedChecksOrThrow(events, cwd, memo);
+        fold = foldOwedChecksOrThrow(events, cwd, memo);
     }
     catch (error) {
-        return { known: false, debt: "unknown", outstanding: [], acceptedRisk: [], discharged: [], unknown: [{ reason: `owed-check fold failed: ${String(error).split("\n")[0]}` }] };
+        fold = { known: false, debt: "unknown", outstanding: [], acceptedRisk: [], discharged: [], unknown: [{ reason: `owed-check fold failed: ${String(error).split("\n")[0]}` }] };
     }
+    // A fatal run-end never finished its checks: its debt is unknown and the crash leads the reasons, never 0.
+    const fatal = fatalRunEndCause(events);
+    return fatal ? { ...fold, known: false, debt: "unknown", unknown: [{ reason: `fatal run-end — ${fatal}` }, ...fold.unknown] } : fold;
 }
 function foldOwedChecksOrThrow(events, cwd, memo) {
     // v2.6.7 T4 (G2): checkout trust is re-derived at the fold boundary, before a memoised proof can answer —

package/dist/run/lease.d.ts

@@ -35,11 +35,19 @@ export interface RepositoryLeaseHolder {
     roots?: number[];
     rootBirths?: Record<string, string>;
 }
+/** Queue row 120: a live process keeping a dead or released holder's lease, as the wait names it: pid, executable and
+ * cwd. Its arguments and environment are never printed or read (`ps -o comm=`, the census's cwd-only probe). */
+export interface LeaseBlocker {
+    pid: number;
+    executable: string;
+    cwd?: string;
+}
 export interface RepositoryLeaseOptions {
     pollMs?: number;
     signal?: AbortSignal;
-    /** Called once per distinct holder the waiter is queued behind. */
-    onWait?: (holder: RepositoryLeaseHolder) => void;
+    /** Called once per distinct holder the waiter is queued behind, and again whenever the set of processes keeping a
+     * dead holder's lease changes; `blockers` names that set (queue row 120). */
+    onWait?: (holder: RepositoryLeaseHolder, blockers?: readonly LeaseBlocker[]) => void;
     /** The token a descendant inherited; defaults to REPOSITORY_LEASE_TOKEN_ENV. */
     inherited?: string;
     /** Manifest jobs bridge capabilities through explicit child environments, never process.env. */
@@ -82,6 +90,15 @@ export declare const readHolder: (path: string) => RepositoryLeaseHolder | undef
 export declare function tryReserve(path: string, mine: RepositoryLeaseHolder): boolean;
 /** Exposed for recovery regressions; the standalone verify uses the combined critical section. */
 export declare const reclaimDead: (path: string, identity: string, pollMs?: number) => Promise<boolean>;
+/** Each blocker's pid, executable and working directory, and NO argument: `ps -o comm=` (a command line joins argv with
+ * spaces, so no redaction could tell where a secret value ends, D-1710). The cwd comes from the census's cwd-only probe
+ * (async, batched, never rejecting, no environment read; queue row 103: no synchronous lsof on a waiting loop), imported
+ * lazily because suite-census imports this module. Diagnostics only: an unreadable process reads "(executable
+ * unreadable)", and this never throws into the wait. */
+export declare function describeLeaseBlockers(pids: readonly number[]): Promise<LeaseBlocker[]>;
+/** The wait's own words: the holder alone while it lives; once it has exited or released the lease, every process still
+ * keeping it. */
+export declare function describeLeaseWait(holder: RepositoryLeaseHolder, blockers?: readonly LeaseBlocker[]): string;
 export declare function protectedProcesses(holder: RepositoryLeaseHolder, tokenEnv?: string, ownedOnly?: boolean): Promise<number[]>;
 export declare const repositoryLeaseEnvironment: (env: NodeJS.ProcessEnv) => NodeJS.ProcessEnv;
 /** Called synchronously at spawn, before any user callback, and only on an owned generation. */

package/dist/run/lease.js

@@ -305,14 +305,47 @@ const reclaimDeadLocked = (path, identity) => {
 export const reclaimDead = async (path, identity, pollMs = 10) => withMutationLock(path, pollMs, undefined, () => reclaimDeadLocked(path, identity));
 const inspectAndReserve = async (path, mine) => {
     let occupant = readOccupant(path);
-    if (occupant && (!occupant.holder || (!holderAlive(occupant.holder) && !(occupant.holder.protectOrphans && (await protectedProcesses(occupant.holder)).length)))) {
+    const dead = occupant?.holder !== undefined && !holderAlive(occupant.holder);
+    // A dead holder's protected tree is what keeps the lease; the waiter is told which processes those are (queue row 120).
+    const blocking = dead && occupant.holder.protectOrphans ? await protectedProcesses(occupant.holder) : [];
+    if (occupant && (!occupant.holder || (dead && !blocking.length))) {
         reclaimDeadLocked(path, occupant.identity);
         occupant = readOccupant(path);
     }
     if (!occupant && tryReserve(path, mine))
         return { acquired: true };
-    return { acquired: false, holder: occupant?.holder };
+    return { acquired: false, holder: occupant?.holder, ...(blocking.length ? { blocking } : {}) };
 };
+/** Each blocker's pid, executable and working directory, and NO argument: `ps -o comm=` (a command line joins argv with
+ * spaces, so no redaction could tell where a secret value ends, D-1710). The cwd comes from the census's cwd-only probe
+ * (async, batched, never rejecting, no environment read; queue row 103: no synchronous lsof on a waiting loop), imported
+ * lazily because suite-census imports this module. Diagnostics only: an unreadable process reads "(executable
+ * unreadable)", and this never throws into the wait. */
+export async function describeLeaseBlockers(pids) {
+    const rows = await new Promise((done) => {
+        try {
+            execFile("ps", ["-o", "pid=,comm=", "-p", pids.join(",")], { encoding: "utf8", timeout: 5_000 }, (_error, stdout) => done(stdout ?? ""));
+        }
+        catch {
+            done("");
+        }
+    });
+    const executables = new Map(rows.split("\n").flatMap((line) => { const row = /^\s*(\d+)\s+(.*)$/.exec(line); return row ? [[Number(row[1]), row[2].trim()]] : []; }));
+    const cwds = await import("./suite-census.js").then(({ batchedProcessCwds }) => batchedProcessCwds(pids)).catch(() => undefined);
+    return pids.map((pid) => {
+        const cwd = cwds?.get(pid);
+        return { pid, executable: executables.get(pid) || "(executable unreadable)", ...(cwd ? { cwd } : {}) };
+    });
+}
+/** The wait's own words: the holder alone while it lives; once it has exited or released the lease, every process still
+ * keeping it. */
+export function describeLeaseWait(holder, blockers) {
+    const held = `held by pid ${holder.pid} in ${holder.cwd}`;
+    if (!blockers?.length)
+        return held;
+    const named = blockers.map((b) => `pid ${b.pid} ${b.executable}${b.cwd ? ` (cwd ${b.cwd})` : ""}`).join("; ");
+    return `${held}, which has exited or released it; ${blockers.length} process(es) it started still run and keep the lease until they exit: ${named}`;
+}
 // A durable capability is also a crash owner: census checks the exact generation's inherited
 // environment and recorded process groups, including live orphans reparented after owner death.
 // An unreadable census refuses reclamation/release. No dead-pid shortcut admits over a live tree.
@@ -386,6 +419,8 @@ export function registerRepositoryChild(pid) {
 }
 export const withFreshCommandLease = (command, run) => ownership.run({ token: "", active: false }, () => withCommandLease(command, run));
 const repositoryQueues = new Map();
+/** Queue row 120: the queue head's last view of what keeps a dead holder's lease, so in-process followers name it too. */
+const repositoryBlocking = new Map();
 /** The standalone wrapper uses the same command-then-repository order when a scheduler exists.
  * Without one (CLI/global setup), this remains exactly the outer file reservation API. */
 export function withRepositoryLease(cwd, run, opts = {}) {
@@ -426,10 +461,11 @@ async function repositoryLease(cwd, run, opts) {
     const ticket = Symbol("repository job");
     queue.add(ticket);
     let waitingOn;
-    const waitOn = (holder) => {
-        if (holder && holder.token !== waitingOn) {
-            waitingOn = holder.token;
-            opts.onWait?.(holder);
+    const waitOn = async (holder, blocking = []) => {
+        const key = holder && `${holder.token}\0${[...blocking].sort((a, b) => a - b).join(",")}`;
+        if (holder && key !== waitingOn) {
+            waitingOn = key;
+            opts.onWait?.(holder, blocking.length ? await describeLeaseBlockers(blocking) : undefined);
         }
     };
     try {
@@ -437,12 +473,19 @@ async function repositoryLease(cwd, run, opts) {
             opts.signal?.throwIfAborted();
             if (queue.values().next().value === ticket) {
                 const attempt = await withMutationLock(path, pollMs, opts.signal, () => inspectAndReserve(path, mine));
-                if (attempt.acquired)
+                if (attempt.acquired) {
+                    repositoryBlocking.delete(path);
                     break;
-                waitOn(attempt.holder);
+                }
+                if (attempt.holder)
+                    repositoryBlocking.set(path, { token: attempt.holder.token, blocking: attempt.blocking ?? [] });
+                await waitOn(attempt.holder, attempt.blocking);
+            }
+            else {
+                const holder = readHolder(path);
+                const seen = repositoryBlocking.get(path);
+                await waitOn(holder, holder && seen?.token === holder.token ? seen.blocking : []);
             }
-            else
-                waitOn(readHolder(path));
             await new Promise(wake => setTimeout(wake, pollMs));
         }
         const exported = process.env[REPOSITORY_LEASE_TOKEN_ENV];
@@ -495,8 +538,10 @@ async function repositoryLease(cwd, run, opts) {
     }
     finally {
         queue.delete(ticket);
-        if (!queue.size)
+        if (!queue.size) {
             repositoryQueues.delete(path);
+            repositoryBlocking.delete(path);
+        }
         // A waiter removes no repository generation, including cancellation before acquisition.
     }
 }

package/dist/run/suite-census.d.ts

@@ -6,6 +6,9 @@
  * not already probed — the census asks for a parent's cwd too. The answers feed countLiveSuites' existing lookups.
  */
 export type ProbeExec = (file: string, args: readonly string[]) => Promise<string>;
+/** Each pid's working directory: /proc first, then ONE batched lsof for the rest; never rejects, and reads no process
+ * environment (the runner-lease wait names blockers through it, queue row 120). Answers land in `cwds`. */
+export declare function batchedProcessCwds(pids: readonly number[], exec?: ProbeExec, proc?: ProcReader, cwds?: Map<number, string>): Promise<Map<number, string>>;
 /** The pids of every live (non-zombie) row of a `ps -o pid=,ppid=,state=,command=` snapshot whose command is a runner. */
 export declare function runnerPids(snapshot: string): number[];
 /** The /proc reads, injectable so the Linux branch is testable anywhere; each throws where /proc has no entry. */

package/dist/run/suite-census.js

@@ -16,6 +16,42 @@ const probeExec = (file, args) => new Promise((resolve) => {
         resolve("");
     }
 });
+// D-1567 batch poisoning: lsof and ps fail the WHOLE command for one -p member they cannot take (a marker of 22 digits
+// prints as 1e+21, 310 nines as Infinity; ps refuses one above int32), erasing every other pid's answer. The base probed
+// per pid, so such a pid lost only its own answer: it stays unanswered here and never joins a batch.
+const probeable = (pid) => Number.isSafeInteger(pid) && pid > 0 && pid <= 2_147_483_647;
+/** Each pid's working directory: /proc first, then ONE batched lsof for the rest; never rejects, and reads no process
+ * environment (the runner-lease wait names blockers through it, queue row 120). Answers land in `cwds`. */
+export async function batchedProcessCwds(pids, exec = probeExec, proc = procReader, cwds = new Map()) {
+    const rest = [];
+    for (const pid of pids.filter(probeable)) {
+        try {
+            cwds.set(pid, proc.cwd(pid));
+        }
+        catch {
+            rest.push(pid);
+        } // Darwin has no /proc
+    }
+    if (rest.length === 0)
+        return cwds;
+    let listing = "";
+    try {
+        listing = await exec("lsof", ["-a", "-p", rest.join(","), "-d", "cwd", "-Fn"]);
+    }
+    catch { /* the census never rejects */ }
+    let pid;
+    for (const line of listing.split("\n")) {
+        if (line.startsWith("p"))
+            pid = Number(line.slice(1));
+        else if (line.startsWith("n") && pid !== undefined) {
+            try {
+                cwds.set(pid, realpathSync(line.slice(1)));
+            }
+            catch { /* the directory is gone */ }
+        }
+    }
+    return cwds;
+}
 /** The pids of every live (non-zombie) row of a `ps -o pid=,ppid=,state=,command=` snapshot whose command is a runner. */
 export function runnerPids(snapshot) {
     const pids = [];
@@ -41,34 +77,7 @@ export async function batchedProcessProbes(pids, exec = probeExec, proc = procRe
     const cwds = new Map();
     const parents = new Map();
     const parentIn = (text) => new RegExp(`(?:^|\\s)${SUITE_PARENT_ENV}=(\\d+)(?:\\s|$)`).exec(text)?.[1];
-    // D-1567 batch poisoning: lsof and ps fail the WHOLE command for one -p member they cannot take (a marker of 22 digits
-    // prints as 1e+21, 310 nines as Infinity; ps refuses one above int32), erasing every other pid's answer. The base probed
-    // per pid, so such a pid lost only its own answer: it stays unanswered here and never joins a batch.
-    const probeable = (pid) => Number.isSafeInteger(pid) && pid > 0 && pid <= 2_147_483_647;
-    const probeCwds = async (wanted) => {
-        const rest = [];
-        for (const pid of wanted.filter(probeable)) {
-            try {
-                cwds.set(pid, proc.cwd(pid));
-            }
-            catch {
-                rest.push(pid);
-            } // Darwin has no /proc
-        }
-        if (rest.length === 0)
-            return;
-        let pid;
-        for (const line of (await ask("lsof", ["-a", "-p", rest.join(","), "-d", "cwd", "-Fn"])).split("\n")) {
-            if (line.startsWith("p"))
-                pid = Number(line.slice(1));
-            else if (line.startsWith("n") && pid !== undefined) {
-                try {
-                    cwds.set(pid, realpathSync(line.slice(1)));
-                }
-                catch { /* the directory is gone */ }
-            }
-        }
-    };
+    const probeCwds = (wanted) => batchedProcessCwds(wanted, ask, proc, cwds);
     const probeParents = async (wanted) => {
         const rest = [];
         for (const pid of wanted.filter(probeable)) {

package/dist/run/verification-job.d.ts

@@ -1,6 +1,6 @@
 import type { ShellReceipt } from "./protocol.js";
 import type { GateEvidenceOptions } from "../gates/baseline.js";
-import { type RepositoryLeaseHolder } from "./lease.js";
+import { type LeaseBlocker, type RepositoryLeaseHolder } from "./lease.js";
 export interface VerificationPhase {
     phase: "discovery" | "first-pass" | "continuation-discovery" | "continuation";
     nonce: string;
@@ -33,7 +33,9 @@ export interface VerificationJobReport {
     releasedAt?: number;
     reservationReused?: boolean;
     reservation?: RepositoryLeaseHolder;
-    waitingOn?: RepositoryLeaseHolder;
+    waitingOn?: RepositoryLeaseHolder & {
+        blockers?: readonly LeaseBlocker[];
+    };
     state: "queued" | "running" | "completed" | "failed" | "cancelled";
     phases: VerificationPhase[];
 }

package/dist/run/verification-job.js

@@ -132,7 +132,7 @@ export async function withVerificationJob(command, cwd, reportPath, evidence, ru
                 }
             }));
         }, { isolated: true, protectOrphans: true, independent: !!jobs.getStore(), signal, pollMs: 20,
-            onWait: holder => { report.waitingOn = { ...holder }; job.persist(); },
+            onWait: (holder, blockers) => { report.waitingOn = { ...holder, ...(blockers ? { blockers } : {}) }; job.persist(); },
             onAdmission: holder => { owner = holder; report.repositoryAdmittedAt = clock(); report.reservation = { ...holder }; job.persist(); },
             onRelease: () => { report.reapedAt ??= clock(); report.repositoryReleasedAt = clock(); job.persist(); } }));
         report.releasedAt = clock();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.4",
+  "version": "2.7.6",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/scripts/watch-journal.sh

@@ -70,6 +70,18 @@ since_arm() { tail -n +$((base + 1)) "$1" 2>/dev/null; }
 
 field() { printf '%s' "$2" | sed -n "s/.*\"$1\":\"\([^\"]*\)\".*/\1/p" | head -1; }
 bucket() { printf '%s' "$2" | sed -n "s/.*\"$1\":\[\([^]]*\)\].*/\1/p" | head -1; }
+# A row's data string value DECODED by JSON.parse (an escaped `\"` never cuts a quoted ref in a git error
+# short), printed on one line as the product's own crash reason is (visibleControls): every C0 control
+# but tab and newline, DEL and every C1 control prints as its visible escape (`\x1b`, `\u009b`), so a
+# recorded 7-bit or 8-bit OSC/CSI/ST never reaches the terminal; tabs and line breaks collapse to a space.
+jstr() {
+  printf '%s' "$2" | node -e '
+    let v; try { const row = JSON.parse(require("fs").readFileSync(0, "utf8")); v = (row.data ?? row)[process.argv[1]]; } catch {}
+    if (typeof v === "string") process.stdout.write(v.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, (c) => {
+      const h = c.charCodeAt(0).toString(16);
+      return c < "\x80" ? "\\x" + h.padStart(2, "0") : "\\u" + h.padStart(4, "0");
+    }).replace(/\s+/g, " ").trim());' "$1" 2>/dev/null
+}
 
 report() {
   # $3 is the row's physical journal line: with its ts it is the token a decision binds to (OBS-1178)
@@ -77,8 +89,13 @@ report() {
   ev=$(field event "$line")
   case "$ev" in
     run-end)
-      local tv done failed human blocked pending verdict
+      local tv done failed human blocked pending verdict fatal=""
       tv=$(field tipVerify "$line")
+      # A FATAL run-end is a crash, never green — even with every bucket empty (its tasks never finished).
+      case "$line" in *'"fatal":true'*)
+        local err; err=$(jstr error "$line")
+        fatal="$(jstr phase "$line") failed: ${err:0:160}" ;;
+      esac
       done=$(bucket done "$line");     failed=$(bucket failed "$line")
       human=$(bucket human "$line");   blocked=$(bucket blocked "$line")
       pending=$(bucket pending "$line")
@@ -87,16 +104,20 @@ report() {
       # clause open: a waived review is still owed (D-660), and a `verify --record` discharge that lands
       # AFTER run-end moves only CURRENT status. This row is history, so the best it can say is
       # EXECUTION COMPLETE; green is read from CURRENT `tickmarkr status <runId>` at `outstanding 0`.
-      if [ "$tv" != "failed" ] && [ -z "$failed$human$blocked$pending" ]; then
+      if [ -z "$fatal" ] && [ "$tv" != "failed" ] && [ -z "$failed$human$blocked$pending" ]; then
         verdict="EXECUTION COMPLETE"
       else
         verdict="NOT GREEN"
       fi
-      echo "RUN_END $run — $verdict (tipVerify=${tv:-unknown})"
+      echo "RUN_END $run — $verdict (${fatal:+fatal: $fatal; }tipVerify=${tv:-unknown})"
       echo "  done=[${done}] failed=[${failed}] human=[${human}] blocked=[${blocked}] pending=[${pending}]"
-      [ "$verdict" = "EXECUTION COMPLETE" ] \
-        && echo "  execution buckets empty and tip verify is not failed — not yet green: read CURRENT \`tickmarkr status $run\`; only \`outstanding 0\` is green, \`outstanding N (...)\` and \`outstanding unknown\` are not, and this run-end record's own count is historical" \
-        || echo "  a non-empty bucket or a failed tip above is the reason; name it, never report this run as green"
+      if [ -n "$fatal" ]; then
+        echo "  the run CRASHED ($fatal) — a fatal run-end is never green; its debt reads unknown until the run is resumed, and from then on the resumed engagement owns it"
+      elif [ "$verdict" = "EXECUTION COMPLETE" ]; then
+        echo "  execution buckets empty and tip verify is not failed — not yet green: read CURRENT \`tickmarkr status $run\`; only \`outstanding 0\` is green, \`outstanding N (...)\` and \`outstanding unknown\` are not, and this run-end record's own count is historical"
+      else
+        echo "  a non-empty bucket or a failed tip above is the reason; name it, never report this run as green"
+      fi
       ;;
     task-human)
       echo "TASK_HUMAN $(field taskId "$line") — $run"

package/skills/tickmarkr-overseer/scripts/watch-launch.sh

@@ -15,15 +15,23 @@
 #                    never hours; 900 is a generous default for a 7-task spec)
 #   <overseer-pane>  the pane that must hear about it (herdr pane id), e.g. wZ:p18S
 #   [poll-s]         poll interval, default 15
-# exit 0 LAUNCH_OK (lock seen; prints its contents) · exit 3 LAUNCH_OVERDUE (delivered) · exit 64 usage
+# exit 0 LAUNCH_OK (a lock held by a LIVE pid; prints its contents) · exit 3 LAUNCH_OVERDUE (delivered) · exit 64 usage
+#
+# A lock is a launch only while its holder lives: a lock left by a crashed daemon (dead pid, or no pid
+# at all) is stale, proves nothing about the new GO, and the watch keeps waiting for a live holder.
+# `ps -p` answers for another user's process too, so EPERM never reads as death (lock.ts isPidLive).
 set -u
 LOCK="${1:-}"; DEADLINE="${2:-}"; PANE="${3:-}"; POLL="${4:-15}"
 [ -n "$LOCK" ] && [ -n "$DEADLINE" ] && [ -n "$PANE" ] || { echo "usage: watch-launch.sh <lock-path> <deadline-s> <overseer-pane> [poll-s]" >&2; exit 64; }
 start=$(date +%s)
 while :; do
   if [ -f "$LOCK" ]; then
-    printf 'LAUNCH_OK %s %s\n' "$(date -u +%H:%M:%SZ)" "$(cat "$LOCK" 2>/dev/null | tr -d '\n')"
-    exit 0
+    body=$(tr -d '\n' < "$LOCK" 2>/dev/null)
+    pid=$(printf '%s' "$body" | sed -n 's/.*"pid":\([0-9][0-9]*\).*/\1/p')
+    if [ -n "$pid" ] && ps -p "$pid" >/dev/null 2>&1; then
+      printf 'LAUNCH_OK %s %s\n' "$(date -u +%H:%M:%SZ)" "$body"
+      exit 0
+    fi
   fi
   now=$(date +%s)
   if [ $((now - start)) -ge "$DEADLINE" ]; then