tickmarkr 2.7.5 → 2.7.6

package/dist/cli/commands/init.js

@@ -111,7 +111,7 @@ Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version\`, re
 
 ### Tip-verify-before-green
 
-A run is green only when ALL of these hold: the run-end event exists in the journal, tip verify is not "failed", the run-end summary's \`failed\`, \`human\`, \`blocked\` and \`pending\` buckets are every one of them empty, AND the owed checks in CURRENT \`tickmarkr status <runId>\` are outstanding empty AND known (\`outstanding 0\`; \`outstanding unknown\` is never empty). The shorter "run-end plus tip verify" form is NOT sufficient: a run ending \`done=[T1,T3,T4] human=[T2] tipVerify=passed\` is a closed PARTIAL run — three of four delivered, one parked — and calling it green is how a park becomes invisible. Empty execution buckets are not sufficient either (D-660): a run ending with every execution bucket empty and \`tipVerify=passed\` after an operator waived one review still owes that accepted-risk review check — status reads \`outstanding 1 (T7 review)\`, and \`tickmarkr run\` and \`resume\` exit 0 on execution alone — so it is execution complete, not green. Read the debt from CURRENT status, never from the run-end record: a \`tickmarkr verify --record <runId>\` discharge that lands after run-end moves current status to \`outstanding 0\` while the historical run-end row still carries 1, and only then is that run green; a legacy waiver without a recorded obligation reads \`outstanding unknown\` and is never green. Never report green to the operator, tab titles, or records until every clause holds; when one does not, name the bucket that is not empty, the outstanding checks, or the unknown debt.
+A run is green only when ALL of these hold: the run-end event exists in the journal and is not fatal, tip verify is not "failed", the run-end summary's \`failed\`, \`human\`, \`blocked\` and \`pending\` buckets are every one of them empty, AND the owed checks in CURRENT \`tickmarkr status <runId>\` are outstanding empty AND known (\`outstanding 0\`; \`outstanding unknown\` is never empty). The shorter "run-end plus tip verify" form is NOT sufficient: a run ending \`done=[T1,T3,T4] human=[T2] tipVerify=passed\` is a closed PARTIAL run — three of four delivered, one parked — and calling it green is how a park becomes invisible. Empty execution buckets are not sufficient either (D-660): a run ending with every execution bucket empty and \`tipVerify=passed\` after an operator waived one review still owes that accepted-risk review check — status reads \`outstanding 1 (T7 review)\`, and \`tickmarkr run\` and \`resume\` exit 0 on execution alone — so it is execution complete, not green. Read the debt from CURRENT status, never from the run-end record: a \`tickmarkr verify --record <runId>\` discharge that lands after run-end moves current status to \`outstanding 0\` while the historical run-end row still carries 1, and only then is that run green; a legacy waiver without a recorded obligation reads \`outstanding unknown\` and is never green. A fatal run-end is never green either: the crash record (\`fatal: true\`) names its phase and error, every task it left running or gated sits in \`pending\` or \`blocked\`, and even with every bucket empty status and report lead with the crash and read \`outstanding unknown\` until the run is resumed; from then on the resumed engagement owns the debt. Never report green to the operator, tab titles, or records until every clause holds; when one does not, name the bucket that is not empty, the outstanding checks, or the unknown debt.
 
 ### Verified handoffs
 

package/dist/cli/commands/report.js

@@ -11,7 +11,7 @@ import { compareRuns } from "../../report/compare.js";
 import { estimateCosts } from "../../report/cost.js";
 import { assignmentChannel, buildOperatorRecord, formatChannelMoney, formatChannelTokens, formatTokenUsage as fields, totalTokens as total, } from "../../report/operator-record.js";
 import { cellsOf, cellSummary } from "../../route/profile.js";
-import { effectiveEvents, foldOwedChecks, Journal, loadRoutingProfile, OWED_DISCHARGE_EVENT, } from "../../run/journal.js";
+import { effectiveEvents, fatalRunEndCause, foldOwedChecks, Journal, loadRoutingProfile, OWED_DISCHARGE_EVENT, } from "../../run/journal.js";
 import { baselineProvenanceOf, fingerprintsOf, forgivenFingerprints, forgivenGateRow, formatBaselineProvenance, formatFingerprints, formatForgiven, formatTipProof, runEndTipProof, } from "../../run/daemon.js";
 import { formatSpan, WALL_PRIORITY, WALL_PRIORITY_TEXT, wallBudget, wallBudgetFacts } from "../../run/wall-budget.js";
 import { deriveRunCockpitData } from "../../tui/cockpit/derive.js";
@@ -241,8 +241,10 @@ const timeLead = (events) => {
  * comparability or supersession note); the rest is folded here from the journal and the current fold.
  */
 export function leadLines(events, owed, finished) {
+    // A fatal run-end leads with its crash: no tally after it may read as a finished run.
+    const crash = fatalRunEndCause(events);
     return [
-        `finished ${[finished.tally, finished.tip, firstPassText(endToEndFirstPass(events)), ...(finished.notes ?? [])].join(" · ")}`,
+        `finished ${[...(crash ? [`run crashed — ${crash}`] : []), finished.tally, finished.tip, firstPassText(endToEndFirstPass(events)), ...(finished.notes ?? [])].join(" · ")}`,
         timeLead(events),
         needsYouText(events, owed),
     ];

package/dist/cli/commands/status.js

@@ -13,7 +13,7 @@ import { projectOperatorSummary } from "../../run/operator-summary.js";
 import { trackJournalRows } from "../../run/protocol.js";
 import { newestPark, permittedDecisionVerbs } from "./approve.js";
 import { currentOwed, endToEndFirstPass, firstPassText, leadLines, leadRows, needsYouText, wallText } from "./report.js";
-import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, } from "../../run/journal.js";
+import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, fatalRunEndCause, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, visibleControls, } from "../../run/journal.js";
 import { isPidLive, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
@@ -649,10 +649,11 @@ const terminalFailureCause = (events) => {
         const e = events[i];
         if (e.event !== "run-end" || typeof e.data.error !== "string")
             continue;
-        const phase = typeof e.data.phase === "string" && e.data.phase.trim()
-            ? `${e.data.phase.trim()} failed`
+        // the recorded error is data: its terminal controls print escaped, never executed (the journal keeps them)
+        const phase = typeof e.data.phase === "string" && visibleControls(e.data.phase)
+            ? `${visibleControls(e.data.phase)} failed`
             : "run failed";
-        return `${phase}: ${e.data.error.replace(/\s+/g, " ").trim()}`;
+        return `${phase}: ${visibleControls(e.data.error)}`;
     }
     return undefined;
 };
@@ -1429,8 +1430,10 @@ const oneLine = (cwd, namedRunId) => {
     // CG1: the lead's facts in one line — lineage first pass, the wall window, and what needs you from
     // the CURRENT fold, so a discharge after run-end moves this line too.
     const { events } = record;
+    // A fatal run-end leads right after the run id: no completion fraction or verify state reads first.
+    const crash = fatalRunEndCause(events);
     return sanitizeTaskText([
-        record.runId, ...claims, firstPassText(endToEndFirstPass(events)), wallText(events), needsYouText(events, currentOwed(events, cwd)),
+        record.runId, ...(crash ? [`run crashed — ${crash}`] : []), ...claims, firstPassText(endToEndFirstPass(events)), wallText(events), needsYouText(events, currentOwed(events, cwd)),
     ].join(" · "));
 };
 export async function status(argv, cwd = process.cwd(), opts = {}) {

package/dist/run/daemon.js

@@ -1858,14 +1858,18 @@ export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "s
     catch (readErr) {
         console.error(`tickmarkr ${runId}: journal read failed while recording the fatal run-end (${readErr instanceof Error ? readErr.message : String(readErr)}) — original error: ${original}`);
     }
+    // A crash can land mid-dispatch. Resume re-pends every dispatched-but-unfinished task, so a running or
+    // gated task is bucketed as the pending task resume will make it — pending, or blocked under a parked
+    // dependency — and no task falls outside the five buckets every reader knows.
+    const repended = graph && { ...graph, tasks: graph.tasks.map((t) => t.status === "running" || t.status === "gated" ? { ...t, status: "pending" } : t) };
     const record = {
         runId,
         branch,
         done: graph?.tasks.filter((t) => t.status === "done").map((t) => t.id) ?? [],
         failed: graph?.tasks.filter((t) => t.status === "failed").map((t) => t.id) ?? [],
         human: graph?.tasks.filter((t) => t.status === "human").map((t) => t.id) ?? [],
-        blocked: graph ? blockedTasks(graph).map((t) => t.id) : [],
-        pending: graph ? pendingTasks(graph).map((t) => t.id) : [],
+        blocked: repended ? blockedTasks(repended).map((t) => t.id) : [],
+        pending: repended ? pendingTasks(repended).map((t) => t.id) : [],
         phase,
         fatal: true,
         error: original,

package/dist/run/journal.d.ts

@@ -191,6 +191,13 @@ export declare const GATE_FINGERPRINT_CAP = 2;
 export declare const receiptOrigin: (data: Record<string, unknown>) => string | undefined;
 export declare function identicalGateFailures(events: JournalEvent[], taskId: string, gate: string, normalized: string): number;
 export declare const readableExcerpt: (text: string) => string;
+/**
+ * One-line display text for a recorded crash: every C0 control but tab and newline, DEL and every C1
+ * control prints as its visible escape (`\x1b`, `\u009b`), so no 7-bit or 8-bit OSC/CSI/ST sequence
+ * reaches a terminal and the reader still sees the text carried one; tabs and line breaks collapse to
+ * one space. The journal row keeps the raw bytes.
+ */
+export declare const visibleControls: (text: string) => string;
 /** What each funded repair's next battery actually reached. A repair spends its budget only
  * when that battery reaches one of the gates it was funded to fix; an earlier red is evidence that
  * this repair never got its funded turn, not a charge against the repair ladder. */
@@ -379,6 +386,11 @@ export interface InterruptedAttempt {
 }
 export declare function resumeHarvestAuthor(events: JournalEvent[], taskId: string): Assignment | undefined;
 export declare function interruptedAttempt(events: JournalEvent[], taskId: string): InterruptedAttempt | undefined;
+/**
+ * The crash a FATAL run-end records, when it closes the newest engagement: `<phase> failed: <error>`.
+ * A later run-start or run-resume supersedes it; a normal run-end is no crash.
+ */
+export declare function fatalRunEndCause(events: readonly JournalEvent[]): string | undefined;
 export declare function runHasEnded(events: JournalEvent[]): boolean;
 /** OBS-53: classify worker-result failures so retries and routing see the true signal, not one lumped bucket. */
 export declare function classifyWorkerResultCause(opts: {

package/dist/run/journal.js

@@ -763,6 +763,16 @@ export function identicalGateFailures(events, taskId, gate, normalized) {
 // the failure fingerprint keep the raw text.
 const TERMINAL_CONTROL_RE = /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?|\x1b\[[0-?]*[ -/]*[@-~]|\x1b[ -/]*[0-~]?|[\x00-\x08\x0b-\x1f\x7f]/g;
 export const readableExcerpt = (text) => text.replace(TERMINAL_CONTROL_RE, "");
+/**
+ * One-line display text for a recorded crash: every C0 control but tab and newline, DEL and every C1
+ * control prints as its visible escape (`\x1b`, `\u009b`), so no 7-bit or 8-bit OSC/CSI/ST sequence
+ * reaches a terminal and the reader still sees the text carried one; tabs and line breaks collapse to
+ * one space. The journal row keeps the raw bytes.
+ */
+export const visibleControls = (text) => text.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/gu, (c) => {
+    const code = c.charCodeAt(0).toString(16);
+    return c < "\x80" ? `\\x${code.padStart(2, "0")}` : `\\u${code.padStart(4, "0")}`;
+}).replace(/\s+/gu, " ").trim();
 export function repairReachSinceApproval(events, taskId) {
     const repairs = [];
     for (const e of effectiveEvents(events)) { // OBS-1178: a refused or unsound approval resets no repair history
@@ -1367,6 +1377,28 @@ export function interruptedAttempt(events, taskId) {
 }
 // Runs can end and later resume in the same journal. The newest lifecycle marker decides whether
 // an unresolved task is still recoverable by this live daemon or belongs to an ended run.
+/**
+ * The crash a FATAL run-end records, when it closes the newest engagement: `<phase> failed: <error>`.
+ * A later run-start or run-resume supersedes it; a normal run-end is no crash.
+ */
+export function fatalRunEndCause(events) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.event === "run-start" || e.event === "run-resume")
+            return undefined;
+        if (e.event !== "run-end")
+            continue;
+        if (e.data.fatal !== true)
+            return undefined;
+        // Display text only: terminal controls in a recorded error (OSC title, CSI clear) print escaped,
+        // never executed, and the journal row keeps the raw bytes.
+        const shown = (v) => typeof v === "string" ? visibleControls(v) : "";
+        const phase = shown(e.data.phase) || "run";
+        const error = shown(e.data.error);
+        return `${phase} failed: ${error || "unrecorded error"}`;
+    }
+    return undefined;
+}
 export function runHasEnded(events) {
     for (let i = events.length - 1; i >= 0; i--) {
         const event = events[i].event;
@@ -1943,7 +1975,9 @@ export class Journal {
                 // C1: the terminal record carries the owed-check fold as of this append, revalidated from
                 // each discharge's artifact — a reopened journal re-reduces, it never copies a prior total.
                 // Canonical (validated) rows are strict and keep their schema; the live producer is the tuple.
-                return decisionRow ? reduced : { ...reduced, owedChecks: foldOwedChecks(priorEvents, join(this.dir, "..", "..", "..")) };
+                // A fatal record folds over itself, so its own owedChecks already read unknown with the crash.
+                const folded = !decisionRow && data.fatal === true ? [...priorEvents, { ts: new Date().toISOString(), event, data }] : priorEvents;
+                return decisionRow ? reduced : { ...reduced, owedChecks: foldOwedChecks(folded, join(this.dir, "..", "..", "..")) };
             })()
             : event === "resume-restore" && rowTaskId && upheldFeedbackByTask(effectiveEvents(priorEvents)).has(rowTaskId)
                 ? {
@@ -2701,12 +2735,16 @@ function dischargeProblem(row, o, events, cwd, memo) {
  * across folds; every artifact, hash, criteria and reviewer condition is still re-read on every fold.
  */
 export function foldOwedChecks(events, cwd, memo) {
+    let fold;
     try {
-        return foldOwedChecksOrThrow(events, cwd, memo);
+        fold = foldOwedChecksOrThrow(events, cwd, memo);
     }
     catch (error) {
-        return { known: false, debt: "unknown", outstanding: [], acceptedRisk: [], discharged: [], unknown: [{ reason: `owed-check fold failed: ${String(error).split("\n")[0]}` }] };
+        fold = { known: false, debt: "unknown", outstanding: [], acceptedRisk: [], discharged: [], unknown: [{ reason: `owed-check fold failed: ${String(error).split("\n")[0]}` }] };
     }
+    // A fatal run-end never finished its checks: its debt is unknown and the crash leads the reasons, never 0.
+    const fatal = fatalRunEndCause(events);
+    return fatal ? { ...fold, known: false, debt: "unknown", unknown: [{ reason: `fatal run-end — ${fatal}` }, ...fold.unknown] } : fold;
 }
 function foldOwedChecksOrThrow(events, cwd, memo) {
     // v2.6.7 T4 (G2): checkout trust is re-derived at the fold boundary, before a memoised proof can answer —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.5",
+  "version": "2.7.6",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/scripts/watch-journal.sh

@@ -70,6 +70,18 @@ since_arm() { tail -n +$((base + 1)) "$1" 2>/dev/null; }
 
 field() { printf '%s' "$2" | sed -n "s/.*\"$1\":\"\([^\"]*\)\".*/\1/p" | head -1; }
 bucket() { printf '%s' "$2" | sed -n "s/.*\"$1\":\[\([^]]*\)\].*/\1/p" | head -1; }
+# A row's data string value DECODED by JSON.parse (an escaped `\"` never cuts a quoted ref in a git error
+# short), printed on one line as the product's own crash reason is (visibleControls): every C0 control
+# but tab and newline, DEL and every C1 control prints as its visible escape (`\x1b`, `\u009b`), so a
+# recorded 7-bit or 8-bit OSC/CSI/ST never reaches the terminal; tabs and line breaks collapse to a space.
+jstr() {
+  printf '%s' "$2" | node -e '
+    let v; try { const row = JSON.parse(require("fs").readFileSync(0, "utf8")); v = (row.data ?? row)[process.argv[1]]; } catch {}
+    if (typeof v === "string") process.stdout.write(v.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, (c) => {
+      const h = c.charCodeAt(0).toString(16);
+      return c < "\x80" ? "\\x" + h.padStart(2, "0") : "\\u" + h.padStart(4, "0");
+    }).replace(/\s+/g, " ").trim());' "$1" 2>/dev/null
+}
 
 report() {
   # $3 is the row's physical journal line: with its ts it is the token a decision binds to (OBS-1178)
@@ -77,8 +89,13 @@ report() {
   ev=$(field event "$line")
   case "$ev" in
     run-end)
-      local tv done failed human blocked pending verdict
+      local tv done failed human blocked pending verdict fatal=""
       tv=$(field tipVerify "$line")
+      # A FATAL run-end is a crash, never green — even with every bucket empty (its tasks never finished).
+      case "$line" in *'"fatal":true'*)
+        local err; err=$(jstr error "$line")
+        fatal="$(jstr phase "$line") failed: ${err:0:160}" ;;
+      esac
       done=$(bucket done "$line");     failed=$(bucket failed "$line")
       human=$(bucket human "$line");   blocked=$(bucket blocked "$line")
       pending=$(bucket pending "$line")
@@ -87,16 +104,20 @@ report() {
       # clause open: a waived review is still owed (D-660), and a `verify --record` discharge that lands
       # AFTER run-end moves only CURRENT status. This row is history, so the best it can say is
       # EXECUTION COMPLETE; green is read from CURRENT `tickmarkr status <runId>` at `outstanding 0`.
-      if [ "$tv" != "failed" ] && [ -z "$failed$human$blocked$pending" ]; then
+      if [ -z "$fatal" ] && [ "$tv" != "failed" ] && [ -z "$failed$human$blocked$pending" ]; then
         verdict="EXECUTION COMPLETE"
       else
         verdict="NOT GREEN"
       fi
-      echo "RUN_END $run — $verdict (tipVerify=${tv:-unknown})"
+      echo "RUN_END $run — $verdict (${fatal:+fatal: $fatal; }tipVerify=${tv:-unknown})"
       echo "  done=[${done}] failed=[${failed}] human=[${human}] blocked=[${blocked}] pending=[${pending}]"
-      [ "$verdict" = "EXECUTION COMPLETE" ] \
-        && echo "  execution buckets empty and tip verify is not failed — not yet green: read CURRENT \`tickmarkr status $run\`; only \`outstanding 0\` is green, \`outstanding N (...)\` and \`outstanding unknown\` are not, and this run-end record's own count is historical" \
-        || echo "  a non-empty bucket or a failed tip above is the reason; name it, never report this run as green"
+      if [ -n "$fatal" ]; then
+        echo "  the run CRASHED ($fatal) — a fatal run-end is never green; its debt reads unknown until the run is resumed, and from then on the resumed engagement owns it"
+      elif [ "$verdict" = "EXECUTION COMPLETE" ]; then
+        echo "  execution buckets empty and tip verify is not failed — not yet green: read CURRENT \`tickmarkr status $run\`; only \`outstanding 0\` is green, \`outstanding N (...)\` and \`outstanding unknown\` are not, and this run-end record's own count is historical"
+      else
+        echo "  a non-empty bucket or a failed tip above is the reason; name it, never report this run as green"
+      fi
       ;;
     task-human)
       echo "TASK_HUMAN $(field taskId "$line") — $run"

package/skills/tickmarkr-overseer/scripts/watch-launch.sh

@@ -15,15 +15,23 @@
 #                    never hours; 900 is a generous default for a 7-task spec)
 #   <overseer-pane>  the pane that must hear about it (herdr pane id), e.g. wZ:p18S
 #   [poll-s]         poll interval, default 15
-# exit 0 LAUNCH_OK (lock seen; prints its contents) · exit 3 LAUNCH_OVERDUE (delivered) · exit 64 usage
+# exit 0 LAUNCH_OK (a lock held by a LIVE pid; prints its contents) · exit 3 LAUNCH_OVERDUE (delivered) · exit 64 usage
+#
+# A lock is a launch only while its holder lives: a lock left by a crashed daemon (dead pid, or no pid
+# at all) is stale, proves nothing about the new GO, and the watch keeps waiting for a live holder.
+# `ps -p` answers for another user's process too, so EPERM never reads as death (lock.ts isPidLive).
 set -u
 LOCK="${1:-}"; DEADLINE="${2:-}"; PANE="${3:-}"; POLL="${4:-15}"
 [ -n "$LOCK" ] && [ -n "$DEADLINE" ] && [ -n "$PANE" ] || { echo "usage: watch-launch.sh <lock-path> <deadline-s> <overseer-pane> [poll-s]" >&2; exit 64; }
 start=$(date +%s)
 while :; do
   if [ -f "$LOCK" ]; then
-    printf 'LAUNCH_OK %s %s\n' "$(date -u +%H:%M:%SZ)" "$(cat "$LOCK" 2>/dev/null | tr -d '\n')"
-    exit 0
+    body=$(tr -d '\n' < "$LOCK" 2>/dev/null)
+    pid=$(printf '%s' "$body" | sed -n 's/.*"pid":\([0-9][0-9]*\).*/\1/p')
+    if [ -n "$pid" ] && ps -p "$pid" >/dev/null 2>&1; then
+      printf 'LAUNCH_OK %s %s\n' "$(date -u +%H:%M:%SZ)" "$body"
+      exit 0
+    fi
   fi
   now=$(date +%s)
   if [ $((now - start)) -ge "$DEADLINE" ]; then