tickmarkr 2.7.5 → 2.7.7

package/dist/cli/commands/init.js

@@ -111,7 +111,7 @@ Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version\`, re
 
 ### Tip-verify-before-green
 
-A run is green only when ALL of these hold: the run-end event exists in the journal, tip verify is not "failed", the run-end summary's \`failed\`, \`human\`, \`blocked\` and \`pending\` buckets are every one of them empty, AND the owed checks in CURRENT \`tickmarkr status <runId>\` are outstanding empty AND known (\`outstanding 0\`; \`outstanding unknown\` is never empty). The shorter "run-end plus tip verify" form is NOT sufficient: a run ending \`done=[T1,T3,T4] human=[T2] tipVerify=passed\` is a closed PARTIAL run — three of four delivered, one parked — and calling it green is how a park becomes invisible. Empty execution buckets are not sufficient either (D-660): a run ending with every execution bucket empty and \`tipVerify=passed\` after an operator waived one review still owes that accepted-risk review check — status reads \`outstanding 1 (T7 review)\`, and \`tickmarkr run\` and \`resume\` exit 0 on execution alone — so it is execution complete, not green. Read the debt from CURRENT status, never from the run-end record: a \`tickmarkr verify --record <runId>\` discharge that lands after run-end moves current status to \`outstanding 0\` while the historical run-end row still carries 1, and only then is that run green; a legacy waiver without a recorded obligation reads \`outstanding unknown\` and is never green. Never report green to the operator, tab titles, or records until every clause holds; when one does not, name the bucket that is not empty, the outstanding checks, or the unknown debt.
+A run is green only when ALL of these hold: the run-end event exists in the journal and is not fatal, tip verify is not "failed", the run-end summary's \`failed\`, \`human\`, \`blocked\` and \`pending\` buckets are every one of them empty, AND the owed checks in CURRENT \`tickmarkr status <runId>\` are outstanding empty AND known (\`outstanding 0\`; \`outstanding unknown\` is never empty). The shorter "run-end plus tip verify" form is NOT sufficient: a run ending \`done=[T1,T3,T4] human=[T2] tipVerify=passed\` is a closed PARTIAL run — three of four delivered, one parked — and calling it green is how a park becomes invisible. Empty execution buckets are not sufficient either (D-660): a run ending with every execution bucket empty and \`tipVerify=passed\` after an operator waived one review still owes that accepted-risk review check — status reads \`outstanding 1 (T7 review)\`, and \`tickmarkr run\` and \`resume\` exit 0 on execution alone — so it is execution complete, not green. Read the debt from CURRENT status, never from the run-end record: a \`tickmarkr verify --record <runId>\` discharge that lands after run-end moves current status to \`outstanding 0\` while the historical run-end row still carries 1, and only then is that run green; a legacy waiver without a recorded obligation reads \`outstanding unknown\` and is never green. A fatal run-end is never green either: the crash record (\`fatal: true\`) names its phase and error, every task it left running or gated sits in \`pending\` or \`blocked\`, and even with every bucket empty status and report lead with the crash and read \`outstanding unknown\` until the run is resumed; from then on the resumed engagement owns the debt. Never report green to the operator, tab titles, or records until every clause holds; when one does not, name the bucket that is not empty, the outstanding checks, or the unknown debt.
 
 ### Verified handoffs
 

package/dist/cli/commands/report.js

@@ -11,7 +11,7 @@ import { compareRuns } from "../../report/compare.js";
 import { estimateCosts } from "../../report/cost.js";
 import { assignmentChannel, buildOperatorRecord, formatChannelMoney, formatChannelTokens, formatTokenUsage as fields, totalTokens as total, } from "../../report/operator-record.js";
 import { cellsOf, cellSummary } from "../../route/profile.js";
-import { effectiveEvents, foldOwedChecks, Journal, loadRoutingProfile, OWED_DISCHARGE_EVENT, } from "../../run/journal.js";
+import { effectiveEvents, fatalRunEndCause, foldOwedChecks, Journal, loadRoutingProfile, OWED_DISCHARGE_EVENT, } from "../../run/journal.js";
 import { baselineProvenanceOf, fingerprintsOf, forgivenFingerprints, forgivenGateRow, formatBaselineProvenance, formatFingerprints, formatForgiven, formatTipProof, runEndTipProof, } from "../../run/daemon.js";
 import { formatSpan, WALL_PRIORITY, WALL_PRIORITY_TEXT, wallBudget, wallBudgetFacts } from "../../run/wall-budget.js";
 import { deriveRunCockpitData } from "../../tui/cockpit/derive.js";
@@ -241,8 +241,10 @@ const timeLead = (events) => {
  * comparability or supersession note); the rest is folded here from the journal and the current fold.
  */
 export function leadLines(events, owed, finished) {
+    // A fatal run-end leads with its crash: no tally after it may read as a finished run.
+    const crash = fatalRunEndCause(events);
     return [
-        `finished ${[finished.tally, finished.tip, firstPassText(endToEndFirstPass(events)), ...(finished.notes ?? [])].join(" · ")}`,
+        `finished ${[...(crash ? [`run crashed — ${crash}`] : []), finished.tally, finished.tip, firstPassText(endToEndFirstPass(events)), ...(finished.notes ?? [])].join(" · ")}`,
         timeLead(events),
         needsYouText(events, owed),
     ];

package/dist/cli/commands/status.js

@@ -13,7 +13,7 @@ import { projectOperatorSummary } from "../../run/operator-summary.js";
 import { trackJournalRows } from "../../run/protocol.js";
 import { newestPark, permittedDecisionVerbs } from "./approve.js";
 import { currentOwed, endToEndFirstPass, firstPassText, leadLines, leadRows, needsYouText, wallText } from "./report.js";
-import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, } from "../../run/journal.js";
+import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, fatalRunEndCause, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, visibleControls, } from "../../run/journal.js";
 import { isPidLive, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
@@ -649,10 +649,11 @@ const terminalFailureCause = (events) => {
         const e = events[i];
         if (e.event !== "run-end" || typeof e.data.error !== "string")
             continue;
-        const phase = typeof e.data.phase === "string" && e.data.phase.trim()
-            ? `${e.data.phase.trim()} failed`
+        // the recorded error is data: its terminal controls print escaped, never executed (the journal keeps them)
+        const phase = typeof e.data.phase === "string" && visibleControls(e.data.phase)
+            ? `${visibleControls(e.data.phase)} failed`
             : "run failed";
-        return `${phase}: ${e.data.error.replace(/\s+/g, " ").trim()}`;
+        return `${phase}: ${visibleControls(e.data.error)}`;
     }
     return undefined;
 };
@@ -1429,8 +1430,10 @@ const oneLine = (cwd, namedRunId) => {
     // CG1: the lead's facts in one line — lineage first pass, the wall window, and what needs you from
     // the CURRENT fold, so a discharge after run-end moves this line too.
     const { events } = record;
+    // A fatal run-end leads right after the run id: no completion fraction or verify state reads first.
+    const crash = fatalRunEndCause(events);
     return sanitizeTaskText([
-        record.runId, ...claims, firstPassText(endToEndFirstPass(events)), wallText(events), needsYouText(events, currentOwed(events, cwd)),
+        record.runId, ...(crash ? [`run crashed — ${crash}`] : []), ...claims, firstPassText(endToEndFirstPass(events)), wallText(events), needsYouText(events, currentOwed(events, cwd)),
     ].join(" · "));
 };
 export async function status(argv, cwd = process.cwd(), opts = {}) {

package/dist/compile/native.js

@@ -179,12 +179,14 @@ export const COLLECTABLE_TESTS = "tests/**/*.test.ts";
 export const LEGACY_PREFIX = ["dro", "vr"].join("");
 export const TICKMARKR_NATIVE_MARKER = /^<!--\s*tickmarkr:spec(?:\s+v1)?\s*-->\s*$/m;
 export const NATIVE_MARKER = new RegExp(`^<!--\\s*(?:tickmarkr|${LEGACY_PREFIX}):spec(?:\\s+v1)?\\s*-->\\s*$`, "m");
-const HEAD_RE = /^## (T\d+):\s*(.+)$/;
-const FIELD_RE = /^- (\w+):\s*(.*)$/;
-const NESTED_RE = /^\s+- (.+)$/;
+// Queue row 130: the rest of a spec line is [^\r\n], never `.` — `.` misses U+2028/U+2029, and an acceptance item holding
+// one was glued onto its neighbour as a plain judge string, losing its own test: oracle (PRD and Spec Kit dropped it).
+const HEAD_RE = /^## (T\d+):\s*([^\r\n]+)$/;
+const FIELD_RE = /^- (\w+):\s*([^\r\n]*)$/;
+const NESTED_RE = /^\s+- ([^\r\n]+)$/;
 // v1.19: a typed acceptance oracle line — "command: ...", "test: ...", or "judge: ...". Anything
 // without one of these prefixes is a plain-string judge criterion (compat path, emits a warning).
-const ORACLE_RE = new RegExp(`^(${ORACLES.join("|")}):\\s*(.*)$`);
+const ORACLE_RE = new RegExp(`^(${ORACLES.join("|")}):\\s*([^\\r\\n]*)$`);
 const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity", "humangate", "pin", "floor", "gates", "acceptance", "timeout", "pins", "outofscope"]);
 const listItems = (draft) => draft.list === "acceptance" ? draft.acceptanceRaw
     : draft.list === "pins" ? draft.pinsRaw
@@ -199,7 +201,7 @@ const PIN_GLOB_SEP = "| glob:";
 const LANDING_SEP = "| suite:";
 function parsePin(task, raw, index, pathSet) {
     const bad = (detail) => invalid(task, "pins", `item ${index + 1} (${JSON.stringify(raw)}) ${detail}`);
-    const typed = raw.match(/^(\w+):\s*(.*)$/);
+    const typed = raw.match(/^(\w+):\s*([^\r\n]*)$/);
     if (typed?.[1] === "fixture") {
         const paths = pathSet(typed[2]);
         if (!paths.length)
@@ -275,7 +277,7 @@ function testsAtHead(root) {
     }
     const bodies = new Map();
     for (const line of grep.stdout.split("\n")) {
-        const match = line.match(/^HEAD:(tests\/.*\.test\.ts):\d+:(.*)$/);
+        const match = line.match(/^HEAD:(tests\/[^\r\n]*\.test\.ts):\d+:([^\r\n]*)$/);
         if (!match)
             continue;
         const lines = bodies.get(match[1]) ?? [];
@@ -544,7 +546,7 @@ export function compileNative(file, options = {}) {
         }
         const draft = drafts.at(-1);
         if (!draft) {
-            const base = line.match(/^base:\s*(.*)$/);
+            const base = line.match(/^base:\s*([^\r\n]*)$/);
             if (base) {
                 const value = base[1].trim();
                 if (!value) {

package/dist/compile/prd.js

@@ -1,9 +1,10 @@
 import { existsSync, readFileSync } from "node:fs";
 import { validateGraph } from "../graph/schema.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
-const HEAD_RE = /^## (T\d+):\s*(.+)$/;
-const FIELD_RE = /^- (\w+):\s*(.*)$/;
-const NESTED_RE = /^\s+- (.+)$/;
+// Queue row 130: [^\r\n], never `.` (U+2028/U+2029 inside a line).
+const HEAD_RE = /^## (T\d+):\s*([^\r\n]+)$/;
+const FIELD_RE = /^- (\w+):\s*([^\r\n]*)$/;
+const NESTED_RE = /^\s+- ([^\r\n]+)$/;
 export function compilePrd(file) {
     if (!existsSync(file))
         throw new CompileError(`no such PRD file: ${file}`);

package/dist/compile/speckit.js

@@ -2,8 +2,9 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { validateGraph } from "../graph/schema.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
-const TASK_RE = /^- \[( |x)\] (T\d+)\s*(\[P\])?\s*(.+)$/;
-const SUB_RE = /^\s+- (\w+):\s*(.+)$/;
+// Queue row 130: [^\r\n], never `.` (U+2028/U+2029 inside a line).
+const TASK_RE = /^- \[( |x)\] (T\d+)\s*(\[P\])?\s*([^\r\n]+)$/;
+const SUB_RE = /^\s+- (\w+):\s*([^\r\n]+)$/;
 export function compileSpecKit(dir) {
     const path = join(dir, "tasks.md");
     if (!existsSync(path)) {

package/dist/gates/acceptance.js

@@ -307,13 +307,14 @@ function compressLines(lines) {
     }
     return parts.join(", ");
 }
-const DIFF_SECTIONS = /(?=^diff --git )/m;
+// Queue rows 128/129: "\n"-only line semantics — the m flag would also split a line at U+2028/U+2029.
+const DIFF_SECTIONS = /(?<=^|\n)(?=diff --git )/;
 // the a-side path of a whole-file deletion section, or null if this section is not one.
 function deletedPath(section) {
-    if (!/^deleted file mode /m.test(section))
+    if (!/(?<=^|\n)deleted file mode /.test(section))
         return null;
-    const oldPath = /^--- (.+)$/m.exec(section)?.[1]
-        ?? /^Binary files (.+) and \/dev\/null differ$/m.exec(section)?.[1];
+    const oldPath = /(?<=^|\n)--- ([^\r\n]+)/.exec(section)?.[1]
+        ?? /(?<=^|\n)Binary files ([^\r\n]+) and \/dev\/null differ(?=[\r\n]|$)/.exec(section)?.[1];
     if (!oldPath || oldPath === "/dev/null")
         return null;
     const unquoted = oldPath.startsWith('"') && oldPath.endsWith('"') ? oldPath.slice(1, -1) : oldPath;

package/dist/gates/artifact-manifest.js

@@ -3,7 +3,7 @@
  * path receives capture accounting only when its manifest row names a
  * registered producer and repeats that producer's current provenance exactly.
  */
-import { diffSidePath, gitHeaderPaths, unquoteGitPath } from "./git-paths.js";
+import { diffSidePath, gitHeaderPaths, quoteGitPath, unquoteGitPath } from "./git-paths.js";
 const GOLDEN_PROVENANCE = {
     source: "src/tui/cockpit/capture.ts",
     entrypoint: "regenerateGoldenFrames",
@@ -191,17 +191,21 @@ export function classifyArtifactPath(path, manifest = CAPTURE_ARTIFACT_MANIFEST)
         provenance: producer.provenance,
     };
 }
-const SET_ASIDE_RECEIPT = /^set aside: regenerable capture (.+?) — \d+ bytes withheld\b/m;
+// Queue rows 128/129: patch text is split into lines at "\n" only. Under the m flag JS `^` and `$` also break at
+// U+2028/U+2029 (and `.` never matches them), so an added line holding one could forge a header line; these patterns
+// anchor on "\n" instead, and a name written back into the text is quoted (quoteGitPath) so it cannot end a line.
+const SET_ASIDE_RECEIPT = /(?<=^|\n)set aside: regenerable capture ([^\r\n]+?) — \d+ bytes withheld\b/;
 /** The path named by a citable capture receipt, or null when there is none. */
 export function setAsideReceiptPath(section) {
-    return SET_ASIDE_RECEIPT.exec(section)?.[1] ?? null;
+    const path = SET_ASIDE_RECEIPT.exec(section)?.[1];
+    return path === undefined ? null : unquoteGitPath(path);
 }
-const DIFF_SECTIONS = /(?=^diff --git )/m;
+const DIFF_SECTIONS = /(?<=^|\n)(?=diff --git )/;
 function deletedPath(section) {
-    if (!/^deleted file mode /m.test(section))
+    if (!/(?<=^|\n)deleted file mode /.test(section))
         return null;
-    const oldPath = /^--- (.+)$/m.exec(section)?.[1]
-        ?? /^Binary files (.+) and \/dev\/null differ$/m.exec(section)?.[1];
+    const oldPath = /(?<=^|\n)--- ([^\r\n]+)/.exec(section)?.[1]
+        ?? /(?<=^|\n)Binary files ([^\r\n]+) and \/dev\/null differ(?=[\r\n]|$)/.exec(section)?.[1];
     return oldPath ? diffSidePath(oldPath) : null;
 }
 /**
@@ -216,7 +220,7 @@ export function reviewableLogicDiff(diff) {
         const path = deletedPath(section);
         if (!path || isProtectedEvidence(path))
             return section;
-        return `deleted file: ${path}\n`;
+        return `deleted file: ${quoteGitPath(path)}\n`;
     }).join("");
 }
 function parseContentSection(section) {
@@ -240,12 +244,12 @@ function parseContentSection(section) {
 function sectionPaths(section, parsed) {
     if (parsed)
         return [...new Set(parsed.sides.filter((path) => path !== null))];
-    const renamedFrom = /^rename from (.+)$/m.exec(section)?.[1];
-    const renamedTo = /^rename to (.+)$/m.exec(section)?.[1];
+    const renamedFrom = /(?<=^|\n)rename from ([^\r\n]+)/.exec(section)?.[1];
+    const renamedTo = /(?<=^|\n)rename to ([^\r\n]+)/.exec(section)?.[1];
     if (renamedFrom || renamedTo) {
         return [...new Set([renamedFrom, renamedTo].filter((path) => path !== undefined).map(unquoteGitPath))];
     }
-    const header = /^diff --git (.+)$/m.exec(section)?.[1];
+    const header = /(?<=^|\n)diff --git ([^\r\n]+)/.exec(section)?.[1];
     return header ? gitHeaderPaths(header) : [];
 }
 function hunkPayload(body, sign) {
@@ -293,7 +297,7 @@ export function measureArtifactDiff(diff, manifest = CAPTURE_ARTIFACT_MANIFEST)
             sections: [],
         };
     }
-    const rawSections = diff.split(/(?=^diff --git )/m);
+    const rawSections = diff.split(DIFF_SECTIONS);
     const kindOnly = kindOnlyPaths(rawSections);
     const rendered = [];
     const measurements = [];
@@ -321,7 +325,7 @@ export function measureArtifactDiff(diff, manifest = CAPTURE_ARTIFACT_MANIFEST)
         const withheld = parsed.lines.slice(parsed.minus).join("\n");
         const captureBytes = Buffer.byteLength(withheld, "utf8");
         const receiptPath = paths.at(-1);
-        const receipt = `set aside: regenerable capture ${receiptPath} — ${captureBytes} bytes withheld (producer ${producer.producer}; provenance ${producer.provenance.source}#${producer.provenance.entrypoint}@${producer.provenance.revision})`;
+        const receipt = `set aside: regenerable capture ${quoteGitPath(receiptPath)} — ${captureBytes} bytes withheld (producer ${producer.producer}; provenance ${producer.provenance.source}#${producer.provenance.entrypoint}@${producer.provenance.revision})`;
         const compact = `${parsed.lines.slice(0, parsed.minus).join("\n")}\n${receipt}\n`;
         rendered.push(compact);
         measurements.push({

package/dist/gates/git-paths.d.ts

@@ -1,5 +1,11 @@
 /** A path exactly as git printed it, quoted or not, decoded to the name on disk. Unquoted input is returned as is. */
 export declare function unquoteGitPath(raw: string): string;
+/**
+ * Queue rows 128/129: the inverse of unquoteGitPath, for a name tickmarkr writes back into patch text it parses again.
+ * A name holding a control character, U+2028/U+2029, a double quote or a backslash is C-quoted (those characters
+ * escaped, every other character kept), so no name can end a line; any other name is returned as is.
+ */
+export declare function quoteGitPath(path: string): string;
 /**
  * One side of a `--- ` / `+++ ` line, after its four-character marker: null for /dev/null, else the path without its
  * a/ or b/ prefix. git ends a side holding a space with ONE tab (quoted or not, measured on git 2.54) — exactly that tab

package/dist/gates/git-paths.js

@@ -34,6 +34,28 @@ export function unquoteGitPath(raw) {
     }
     return Buffer.from(bytes).toString("utf8");
 }
+const NAMED = Object.fromEntries(Object.entries(ESCAPES).map(([name, code]) => [code, name]));
+/**
+ * Queue rows 128/129: the inverse of unquoteGitPath, for a name tickmarkr writes back into patch text it parses again.
+ * A name holding a control character, U+2028/U+2029, a double quote or a backslash is C-quoted (those characters
+ * escaped, every other character kept), so no name can end a line; any other name is returned as is.
+ */
+export function quoteGitPath(path) {
+    if (!/[\x00-\x1f\x7f"\\\u2028\u2029]/.test(path))
+        return path;
+    let quoted = "";
+    for (const ch of path) {
+        const code = ch.codePointAt(0);
+        if (NAMED[code] !== undefined)
+            quoted += `\\${NAMED[code]}`;
+        else if (code < 0x20 || code === 0x7f || code === 0x2028 || code === 0x2029) {
+            quoted += [...Buffer.from(ch, "utf8")].map((byte) => `\\${byte.toString(8).padStart(3, "0")}`).join("");
+        }
+        else
+            quoted += ch;
+    }
+    return `"${quoted}"`;
+}
 /**
  * One side of a `--- ` / `+++ ` line, after its four-character marker: null for /dev/null, else the path without its
  * a/ or b/ prefix. git ends a side holding a space with ONE tab (quoted or not, measured on git 2.54) — exactly that tab

package/dist/run/beat-lifecycle.js

@@ -104,7 +104,7 @@ export function readProcessIdentity(pid, host = {}) {
     const ps = spawnSync("ps", ["-ww", "-o", "pgid=", "-o", "stat=", "-o", "lstart=", "-o", "command=", "-p", String(pid)], {
         encoding: "utf8", env: { ...process.env, LC_ALL: "C" },
     });
-    const row = /^\s*(\d+)\s+(\S+)\s+(\w{3} \w{3} [ \d]\d \d\d:\d\d:\d\d \d{4})\s+(.*\S)\s*$/.exec(ps.stdout ?? "");
+    const row = /^\s*(\d+)\s+(\S+)\s+(\w{3} \w{3} [ \d]\d \d\d:\d\d:\d\d \d{4})\s+(.*\S)\s*$/s.exec(ps.stdout ?? "");
     if (ps.status !== 0 || !row)
         return confirmedDead(pid) ? "DEAD" : "UNKNOWN";
     if (row[2].startsWith("Z"))

package/dist/run/daemon.js

@@ -1244,7 +1244,7 @@ export async function observeWorkerProcessTree(marker, cwd) {
         return "unmeasurable";
     const rows = [];
     for (const line of snapshot.stdout.split("\n")) {
-        const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+        const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/s.exec(line);
         if (match)
             rows.push({ pid: match[1], ppid: match[2], command: match[3] });
     }
@@ -1272,7 +1272,7 @@ const pathAtOrBelow = (root, candidate) => {
 export function countLiveSuites(snapshot, repoRoot, daemonPid, cwdForPid, suiteParentForPid) {
     const rows = [];
     for (const line of snapshot.split("\n")) {
-        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/s.exec(line);
         if (match && !match[3].startsWith("Z")) {
             rows.push({ pid: Number(match[1]), ppid: Number(match[2]), command: match[4] });
         }
@@ -1858,14 +1858,18 @@ export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "s
     catch (readErr) {
         console.error(`tickmarkr ${runId}: journal read failed while recording the fatal run-end (${readErr instanceof Error ? readErr.message : String(readErr)}) — original error: ${original}`);
     }
+    // A crash can land mid-dispatch. Resume re-pends every dispatched-but-unfinished task, so a running or
+    // gated task is bucketed as the pending task resume will make it — pending, or blocked under a parked
+    // dependency — and no task falls outside the five buckets every reader knows.
+    const repended = graph && { ...graph, tasks: graph.tasks.map((t) => t.status === "running" || t.status === "gated" ? { ...t, status: "pending" } : t) };
     const record = {
         runId,
         branch,
         done: graph?.tasks.filter((t) => t.status === "done").map((t) => t.id) ?? [],
         failed: graph?.tasks.filter((t) => t.status === "failed").map((t) => t.id) ?? [],
         human: graph?.tasks.filter((t) => t.status === "human").map((t) => t.id) ?? [],
-        blocked: graph ? blockedTasks(graph).map((t) => t.id) : [],
-        pending: graph ? pendingTasks(graph).map((t) => t.id) : [],
+        blocked: repended ? blockedTasks(repended).map((t) => t.id) : [],
+        pending: repended ? pendingTasks(repended).map((t) => t.id) : [],
         phase,
         fatal: true,
         error: original,

package/dist/run/journal.d.ts

@@ -191,6 +191,13 @@ export declare const GATE_FINGERPRINT_CAP = 2;
 export declare const receiptOrigin: (data: Record<string, unknown>) => string | undefined;
 export declare function identicalGateFailures(events: JournalEvent[], taskId: string, gate: string, normalized: string): number;
 export declare const readableExcerpt: (text: string) => string;
+/**
+ * One-line display text for a recorded crash: every C0 control but tab and newline, DEL and every C1
+ * control prints as its visible escape (`\x1b`, `\u009b`), so no 7-bit or 8-bit OSC/CSI/ST sequence
+ * reaches a terminal and the reader still sees the text carried one; tabs and line breaks collapse to
+ * one space. The journal row keeps the raw bytes.
+ */
+export declare const visibleControls: (text: string) => string;
 /** What each funded repair's next battery actually reached. A repair spends its budget only
  * when that battery reaches one of the gates it was funded to fix; an earlier red is evidence that
  * this repair never got its funded turn, not a charge against the repair ladder. */
@@ -379,6 +386,11 @@ export interface InterruptedAttempt {
 }
 export declare function resumeHarvestAuthor(events: JournalEvent[], taskId: string): Assignment | undefined;
 export declare function interruptedAttempt(events: JournalEvent[], taskId: string): InterruptedAttempt | undefined;
+/**
+ * The crash a FATAL run-end records, when it closes the newest engagement: `<phase> failed: <error>`.
+ * A later run-start or run-resume supersedes it; a normal run-end is no crash.
+ */
+export declare function fatalRunEndCause(events: readonly JournalEvent[]): string | undefined;
 export declare function runHasEnded(events: JournalEvent[]): boolean;
 /** OBS-53: classify worker-result failures so retries and routing see the true signal, not one lumped bucket. */
 export declare function classifyWorkerResultCause(opts: {

package/dist/run/journal.js

@@ -763,6 +763,16 @@ export function identicalGateFailures(events, taskId, gate, normalized) {
 // the failure fingerprint keep the raw text.
 const TERMINAL_CONTROL_RE = /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?|\x1b\[[0-?]*[ -/]*[@-~]|\x1b[ -/]*[0-~]?|[\x00-\x08\x0b-\x1f\x7f]/g;
 export const readableExcerpt = (text) => text.replace(TERMINAL_CONTROL_RE, "");
+/**
+ * One-line display text for a recorded crash: every C0 control but tab and newline, DEL and every C1
+ * control prints as its visible escape (`\x1b`, `\u009b`), so no 7-bit or 8-bit OSC/CSI/ST sequence
+ * reaches a terminal and the reader still sees the text carried one; tabs and line breaks collapse to
+ * one space. The journal row keeps the raw bytes.
+ */
+export const visibleControls = (text) => text.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/gu, (c) => {
+    const code = c.charCodeAt(0).toString(16);
+    return c < "\x80" ? `\\x${code.padStart(2, "0")}` : `\\u${code.padStart(4, "0")}`;
+}).replace(/\s+/gu, " ").trim();
 export function repairReachSinceApproval(events, taskId) {
     const repairs = [];
     for (const e of effectiveEvents(events)) { // OBS-1178: a refused or unsound approval resets no repair history
@@ -1367,6 +1377,28 @@ export function interruptedAttempt(events, taskId) {
 }
 // Runs can end and later resume in the same journal. The newest lifecycle marker decides whether
 // an unresolved task is still recoverable by this live daemon or belongs to an ended run.
+/**
+ * The crash a FATAL run-end records, when it closes the newest engagement: `<phase> failed: <error>`.
+ * A later run-start or run-resume supersedes it; a normal run-end is no crash.
+ */
+export function fatalRunEndCause(events) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.event === "run-start" || e.event === "run-resume")
+            return undefined;
+        if (e.event !== "run-end")
+            continue;
+        if (e.data.fatal !== true)
+            return undefined;
+        // Display text only: terminal controls in a recorded error (OSC title, CSI clear) print escaped,
+        // never executed, and the journal row keeps the raw bytes.
+        const shown = (v) => typeof v === "string" ? visibleControls(v) : "";
+        const phase = shown(e.data.phase) || "run";
+        const error = shown(e.data.error);
+        return `${phase} failed: ${error || "unrecorded error"}`;
+    }
+    return undefined;
+}
 export function runHasEnded(events) {
     for (let i = events.length - 1; i >= 0; i--) {
         const event = events[i].event;
@@ -1943,7 +1975,9 @@ export class Journal {
                 // C1: the terminal record carries the owed-check fold as of this append, revalidated from
                 // each discharge's artifact — a reopened journal re-reduces, it never copies a prior total.
                 // Canonical (validated) rows are strict and keep their schema; the live producer is the tuple.
-                return decisionRow ? reduced : { ...reduced, owedChecks: foldOwedChecks(priorEvents, join(this.dir, "..", "..", "..")) };
+                // A fatal record folds over itself, so its own owedChecks already read unknown with the crash.
+                const folded = !decisionRow && data.fatal === true ? [...priorEvents, { ts: new Date().toISOString(), event, data }] : priorEvents;
+                return decisionRow ? reduced : { ...reduced, owedChecks: foldOwedChecks(folded, join(this.dir, "..", "..", "..")) };
             })()
             : event === "resume-restore" && rowTaskId && upheldFeedbackByTask(effectiveEvents(priorEvents)).has(rowTaskId)
                 ? {
@@ -2701,12 +2735,16 @@ function dischargeProblem(row, o, events, cwd, memo) {
  * across folds; every artifact, hash, criteria and reviewer condition is still re-read on every fold.
  */
 export function foldOwedChecks(events, cwd, memo) {
+    let fold;
     try {
-        return foldOwedChecksOrThrow(events, cwd, memo);
+        fold = foldOwedChecksOrThrow(events, cwd, memo);
     }
     catch (error) {
-        return { known: false, debt: "unknown", outstanding: [], acceptedRisk: [], discharged: [], unknown: [{ reason: `owed-check fold failed: ${String(error).split("\n")[0]}` }] };
+        fold = { known: false, debt: "unknown", outstanding: [], acceptedRisk: [], discharged: [], unknown: [{ reason: `owed-check fold failed: ${String(error).split("\n")[0]}` }] };
     }
+    // A fatal run-end never finished its checks: its debt is unknown and the crash leads the reasons, never 0.
+    const fatal = fatalRunEndCause(events);
+    return fatal ? { ...fold, known: false, debt: "unknown", unknown: [{ reason: `fatal run-end — ${fatal}` }, ...fold.unknown] } : fold;
 }
 function foldOwedChecksOrThrow(events, cwd, memo) {
     // v2.6.7 T4 (G2): checkout trust is re-derived at the fold boundary, before a memoised proof can answer —

package/dist/run/launchservices-check.js

@@ -14,7 +14,7 @@ import { basename } from "node:path";
 export const LAUNCHSERVICES_PROBE_CEILING_MS = 5_000;
 // lstart in the C locale: "Wed Sep 30 21:54:33 2026"; comm is the executable path on Darwin.
 const PS_ARGS = ["-A", "-o", "pid=,lstart=,comm="];
-const PS_LINE = /^\s*(\d+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+?)\s*$/;
+const PS_LINE = /^\s*(\d+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+?)\s*$/s;
 const MAX_PS_BYTES = 4 * 1024 * 1024;
 /** Exactly one launchservicesd row, or null (absent, ambiguous or malformed output is unknown). */
 export function parsePsIdentity(stdout) {

package/dist/run/lease.js

@@ -330,7 +330,7 @@ export async function describeLeaseBlockers(pids) {
             done("");
         }
     });
-    const executables = new Map(rows.split("\n").flatMap((line) => { const row = /^\s*(\d+)\s+(.*)$/.exec(line); return row ? [[Number(row[1]), row[2].trim()]] : []; }));
+    const executables = new Map(rows.split("\n").flatMap((line) => { const row = /^\s*(\d+)\s+(.*)$/s.exec(line); return row ? [[Number(row[1]), row[2].trim()]] : []; }));
     const cwds = await import("./suite-census.js").then(({ batchedProcessCwds }) => batchedProcessCwds(pids)).catch(() => undefined);
     return pids.map((pid) => {
         const cwd = cwds?.get(pid);
@@ -363,7 +363,7 @@ export async function protectedProcesses(holder, tokenEnv = REPOSITORY_LEASE_TOK
         return !leader || sameProcessBirth(processBirth(pid), holder.rootBirths?.[pid]);
     }));
     const parsed = lines.flatMap(line => {
-        const match = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        const match = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/s.exec(line);
         return match ? [{ pid: Number(match[1]), parent: Number(match[2]), group: Number(match[3]), stat: match[4], command: match[5] }] : [];
     });
     const parents = new Map(parsed.map(row => [row.pid, row.parent]));

package/dist/run/stall.js

@@ -118,7 +118,8 @@ export const workerReapHost = {
             if (!lines.length || lines.length > 20_000)
                 return undefined;
             for (const line of lines) {
-                const m = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(\S+)\s+(\S+\s+\S+\s+\d+\s+\S+\s+\d+)\s+(.*)$/.exec(line);
+                // Queue row 127: the s flag — ps prints an argv's U+2028/U+2029 raw, and `.` alone never matches them.
+                const m = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(\S+)\s+(\S+\s+\S+\s+\d+\s+\S+\s+\d+)\s+(.*)$/s.exec(line);
                 if (!m)
                     return undefined;
                 if (m[5].startsWith("Z"))
@@ -418,7 +419,7 @@ async function workerTreeCpuSnapshot(marker, cwd, group, identities) {
             continue;
         if (group !== undefined && Number(ids[3]) === group)
             grouped.push(ids[1]);
-        const m = /^\s*(\d+)\s+(\d+)\s+\d+\s+(\S+)\s+(.*)$/.exec(line);
+        const m = /^\s*(\d+)\s+(\d+)\s+\d+\s+(\S+)\s+(.*)$/s.exec(line);
         if (!m)
             continue;
         const cpu = parsePsCpu(m[3]);

package/dist/run/suite-census.js

@@ -56,7 +56,7 @@ export async function batchedProcessCwds(pids, exec = probeExec, proc = procRead
 export function runnerPids(snapshot) {
     const pids = [];
     for (const line of snapshot.split("\n")) {
-        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/s.exec(line);
         if (match && !match[3].startsWith("Z") && isRunnerCommand(match[4]))
             pids.push(Number(match[1]));
     }
@@ -95,7 +95,7 @@ export async function batchedProcessProbes(pids, exec = probeExec, proc = procRe
         if (rest.length === 0)
             return;
         for (const line of (await ask("ps", ["eww", "-p", rest.join(","), "-o", "pid=,command="])).split("\n")) {
-            const row = /^\s*(\d+)\s+(.*)$/.exec(line);
+            const row = /^\s*(\d+)\s+(.*)$/s.exec(line);
             const value = row ? parentIn(row[2]) : undefined;
             if (row && value)
                 parents.set(Number(row[1]), Number(value));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.5",
+  "version": "2.7.7",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/scripts/watch-journal.sh

@@ -70,6 +70,18 @@ since_arm() { tail -n +$((base + 1)) "$1" 2>/dev/null; }
 
 field() { printf '%s' "$2" | sed -n "s/.*\"$1\":\"\([^\"]*\)\".*/\1/p" | head -1; }
 bucket() { printf '%s' "$2" | sed -n "s/.*\"$1\":\[\([^]]*\)\].*/\1/p" | head -1; }
+# A row's data string value DECODED by JSON.parse (an escaped `\"` never cuts a quoted ref in a git error
+# short), printed on one line as the product's own crash reason is (visibleControls): every C0 control
+# but tab and newline, DEL and every C1 control prints as its visible escape (`\x1b`, `\u009b`), so a
+# recorded 7-bit or 8-bit OSC/CSI/ST never reaches the terminal; tabs and line breaks collapse to a space.
+jstr() {
+  printf '%s' "$2" | node -e '
+    let v; try { const row = JSON.parse(require("fs").readFileSync(0, "utf8")); v = (row.data ?? row)[process.argv[1]]; } catch {}
+    if (typeof v === "string") process.stdout.write(v.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, (c) => {
+      const h = c.charCodeAt(0).toString(16);
+      return c < "\x80" ? "\\x" + h.padStart(2, "0") : "\\u" + h.padStart(4, "0");
+    }).replace(/\s+/g, " ").trim());' "$1" 2>/dev/null
+}
 
 report() {
   # $3 is the row's physical journal line: with its ts it is the token a decision binds to (OBS-1178)
@@ -77,8 +89,13 @@ report() {
   ev=$(field event "$line")
   case "$ev" in
     run-end)
-      local tv done failed human blocked pending verdict
+      local tv done failed human blocked pending verdict fatal=""
       tv=$(field tipVerify "$line")
+      # A FATAL run-end is a crash, never green — even with every bucket empty (its tasks never finished).
+      case "$line" in *'"fatal":true'*)
+        local err; err=$(jstr error "$line")
+        fatal="$(jstr phase "$line") failed: ${err:0:160}" ;;
+      esac
       done=$(bucket done "$line");     failed=$(bucket failed "$line")
       human=$(bucket human "$line");   blocked=$(bucket blocked "$line")
       pending=$(bucket pending "$line")
@@ -87,16 +104,20 @@ report() {
       # clause open: a waived review is still owed (D-660), and a `verify --record` discharge that lands
       # AFTER run-end moves only CURRENT status. This row is history, so the best it can say is
       # EXECUTION COMPLETE; green is read from CURRENT `tickmarkr status <runId>` at `outstanding 0`.
-      if [ "$tv" != "failed" ] && [ -z "$failed$human$blocked$pending" ]; then
+      if [ -z "$fatal" ] && [ "$tv" != "failed" ] && [ -z "$failed$human$blocked$pending" ]; then
         verdict="EXECUTION COMPLETE"
       else
         verdict="NOT GREEN"
       fi
-      echo "RUN_END $run — $verdict (tipVerify=${tv:-unknown})"
+      echo "RUN_END $run — $verdict (${fatal:+fatal: $fatal; }tipVerify=${tv:-unknown})"
       echo "  done=[${done}] failed=[${failed}] human=[${human}] blocked=[${blocked}] pending=[${pending}]"
-      [ "$verdict" = "EXECUTION COMPLETE" ] \
-        && echo "  execution buckets empty and tip verify is not failed — not yet green: read CURRENT \`tickmarkr status $run\`; only \`outstanding 0\` is green, \`outstanding N (...)\` and \`outstanding unknown\` are not, and this run-end record's own count is historical" \
-        || echo "  a non-empty bucket or a failed tip above is the reason; name it, never report this run as green"
+      if [ -n "$fatal" ]; then
+        echo "  the run CRASHED ($fatal) — a fatal run-end is never green; its debt reads unknown until the run is resumed, and from then on the resumed engagement owns it"
+      elif [ "$verdict" = "EXECUTION COMPLETE" ]; then
+        echo "  execution buckets empty and tip verify is not failed — not yet green: read CURRENT \`tickmarkr status $run\`; only \`outstanding 0\` is green, \`outstanding N (...)\` and \`outstanding unknown\` are not, and this run-end record's own count is historical"
+      else
+        echo "  a non-empty bucket or a failed tip above is the reason; name it, never report this run as green"
+      fi
       ;;
     task-human)
       echo "TASK_HUMAN $(field taskId "$line") — $run"

package/skills/tickmarkr-overseer/scripts/watch-launch.sh

@@ -15,15 +15,23 @@
 #                    never hours; 900 is a generous default for a 7-task spec)
 #   <overseer-pane>  the pane that must hear about it (herdr pane id), e.g. wZ:p18S
 #   [poll-s]         poll interval, default 15
-# exit 0 LAUNCH_OK (lock seen; prints its contents) · exit 3 LAUNCH_OVERDUE (delivered) · exit 64 usage
+# exit 0 LAUNCH_OK (a lock held by a LIVE pid; prints its contents) · exit 3 LAUNCH_OVERDUE (delivered) · exit 64 usage
+#
+# A lock is a launch only while its holder lives: a lock left by a crashed daemon (dead pid, or no pid
+# at all) is stale, proves nothing about the new GO, and the watch keeps waiting for a live holder.
+# `ps -p` answers for another user's process too, so EPERM never reads as death (lock.ts isPidLive).
 set -u
 LOCK="${1:-}"; DEADLINE="${2:-}"; PANE="${3:-}"; POLL="${4:-15}"
 [ -n "$LOCK" ] && [ -n "$DEADLINE" ] && [ -n "$PANE" ] || { echo "usage: watch-launch.sh <lock-path> <deadline-s> <overseer-pane> [poll-s]" >&2; exit 64; }
 start=$(date +%s)
 while :; do
   if [ -f "$LOCK" ]; then
-    printf 'LAUNCH_OK %s %s\n' "$(date -u +%H:%M:%SZ)" "$(cat "$LOCK" 2>/dev/null | tr -d '\n')"
-    exit 0
+    body=$(tr -d '\n' < "$LOCK" 2>/dev/null)
+    pid=$(printf '%s' "$body" | sed -n 's/.*"pid":\([0-9][0-9]*\).*/\1/p')
+    if [ -n "$pid" ] && ps -p "$pid" >/dev/null 2>&1; then
+      printf 'LAUNCH_OK %s %s\n' "$(date -u +%H:%M:%SZ)" "$body"
+      exit 0
+    fi
   fi
   now=$(date +%s)
   if [ $((now - start)) -ge "$DEADLINE" ]; then