tickmarkr 2.8.1 → 2.8.3

package/dist/adapters/codex.js

@@ -121,8 +121,9 @@ function codexRetirement(upgrade) {
 // literal-string fallback. Every emitted root is therefore a TOML basic string that parses back to the exact
 // path (git's own trailing newline is stripped through a sentinel, never a path's). No common-root fallback;
 // packed-refs is not granted (packed-ref ops fail closed); stash, tags, notes and branches outside the leaf
-// are denied. Declared: sibling refs in the same leaf (other task branches, the run's integration branch
-// under the default prefix) stay writable until 2.8.1's integration identity.
+// are denied. Declared (queue row 151): sibling refs in the same leaf (other task branches, the run's integration
+// branch under the default prefix) stay writable; since 2.8.1 a write to the integration ref parks the merge and is
+// never published.
 // doctor's probe (codex-commit-check.ts) executes these exact bytes; it never rebuilds the grant.
 export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=\${tkr_common%?/} && tkr_gitdir=\${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=\${tkr_head%/*};; (*) tkr_leaf=;; esac && [ "$(printf %s "$tkr_common$tkr_gitdir$tkr_leaf" | LC_ALL=C tr -d '\\0-\\37\\177"\\\\')" = "$tkr_common$tkr_gitdir$tkr_leaf" ] && { [ "$tkr_gitdir" = "$tkr_common" ] || printf '"%s",' "$tkr_gitdir"; } && printf '"%s/objects"' "$tkr_common" && { [ -z "$tkr_leaf" ] || printf ',"%s/%s","%s/logs/%s"' "$tkr_common" "$tkr_leaf" "$tkr_common" "$tkr_leaf"; })]"`;
 // OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct

package/dist/adapters/qwen.d.ts

@@ -1,6 +1,6 @@
 import { type ClassifiedWorkerResult } from "./prompt.js";
 import { type WorkerAdapter } from "./types.js";
 export declare const QWEN_VERSION_IDENTITY: RegExp;
-export declare const QWEN_HARNESS_BANNER_ROWS: readonly ["⚠ SAFE MODE — all customizations disabled (hooks, extensions, skills, MCP servers, QWEN.md). Restart without --safe-mode to resume normal operation.", "Warning: running headless with --yolo / approval-mode=yolo and no sandbox. All tool calls (shell, write, edit) auto-execute at this process's privilege level. Enable a sandbox via --sandbox / QWEN_SANDBOX, or set QWEN_CODE_SUPPRESS_YOLO_WARNING=1 to silence this notice."];
+export declare const QWEN_HARNESS_BANNER_ROWS: readonly ["⚠ SAFE MODE — all customizations disabled (hooks, extensions, skills, MCP servers, QWEN.md). Restart without --safe-mode to resume normal operation.", "Warning: running headless with --yolo / approval-mode=yolo and no sandbox. All tool calls (shell, write, edit) auto-execute at this process's privilege level. Enable a sandbox via --sandbox / QWEN_SANDBOX, or set QWEN_CODE_SUPPRESS_YOLO_WARNING=1 to silence this notice.", "Warning: running headless with --yolo / approval-mode=yolo and no sandbox. All tool calls (shell, write, edit) auto-execute at this process's privilege level. Configure tools.executionSandbox on Linux or a supported legacy sandbox via --sandbox / QWEN_SANDBOX, or set QWEN_CODE_SUPPRESS_YOLO_WARNING=1 to silence this notice."];
 export declare function parseQwenResult(raw: string, nonce: string): ClassifiedWorkerResult;
 export declare const qwen: WorkerAdapter;

package/dist/adapters/qwen.js

@@ -3,12 +3,14 @@ import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, shq, } from "./types.js";
 export const QWEN_VERSION_IDENTITY = /^\d+\.\d+\.\d+/;
 const QWEN_SKIP_UPDATE = "QWEN_CODE_SKIP_UPDATE_CHECK_ONCE=true";
-// Verbatim stderr from tests/fixtures/qwen/safe-mode.stderr (qwen 0.21.15). These bytes are launch
-// harness, not evidence that a reviewer took a turn. Keep the declaration closed and row-shaped so
-// llm.ts can sweep partial terminal paints without a broad SAFE MODE/warning regex.
+// Verbatim stderr rows, in render order: the SAFE MODE row both recorded versions print, then the yolo
+// row of tests/fixtures/qwen/safe-mode.stderr (qwen 0.21.15) and of safe-mode-0.25.1.stderr (qwen 0.25.1).
+// These bytes are launch harness, not evidence that a reviewer took a turn. Keep the declaration closed
+// and row-shaped so llm.ts can sweep partial terminal paints without a broad SAFE MODE/warning regex.
 export const QWEN_HARNESS_BANNER_ROWS = [
     "⚠ SAFE MODE — all customizations disabled (hooks, extensions, skills, MCP servers, QWEN.md). Restart without --safe-mode to resume normal operation.",
     "Warning: running headless with --yolo / approval-mode=yolo and no sandbox. All tool calls (shell, write, edit) auto-execute at this process's privilege level. Enable a sandbox via --sandbox / QWEN_SANDBOX, or set QWEN_CODE_SUPPRESS_YOLO_WARNING=1 to silence this notice.",
+    "Warning: running headless with --yolo / approval-mode=yolo and no sandbox. All tool calls (shell, write, edit) auto-execute at this process's privilege level. Configure tools.executionSandbox on Linux or a supported legacy sandbox via --sandbox / QWEN_SANDBOX, or set QWEN_CODE_SUPPRESS_YOLO_WARNING=1 to silence this notice.",
 ];
 function decodeQwenEvents(events) {
     const text = [];

package/dist/cli/commands/approve.js

@@ -1,4 +1,5 @@
 import { graphDefinitionHash, loadGraph, saveGraph, taskDefinitionFingerprint } from "../../graph/graph.js";
+import { filesGlob } from "../../graph/files-glob.js";
 import { execFileSync } from "node:child_process";
 import { userInfo } from "node:os";
 import { allAdapters } from "../../adapters/registry.js";
@@ -242,7 +243,7 @@ export async function approve(argv, cwd = process.cwd()) {
             if (amendedFiles.length === task.files.length)
                 throw new Error("--files must extend the parked files[] revision");
             const amended = { ...graph, tasks: graph.tasks.map((t) => t.id === taskId ? { ...t, files: amendedFiles } : t) };
-            const conflicts = separabilityErrors(amended.tasks);
+            const conflicts = scopeGrantConflicts(cwd, journal, runId, taskId, amended.tasks, events);
             if (conflicts.length)
                 throw new Error(`refusing scope-request approval for ${taskId}: ${conflicts.join("\n")}`);
             // C4: a live grant may not take a task past the bounds that fail every compile. The exception
@@ -394,6 +395,110 @@ function integrationBase(events, byName) {
     const branch = String(events.find((e) => e.event === "run-start").data.branch);
     return "anchor" in anchor ? { branch, base: anchor.anchor } : { branch, base: "unknown", unreadable: anchor.unreadable };
 }
+/**
+ * Queue 169 (D-1982/D-1983/D-1986): the in-run OBS-212 check a scope-request grant runs. Only the
+ * pairs this amendment changes are judged — the requester against each unordered sibling; a pair
+ * another amendment created was judged by that grant and is never re-judged here. A sibling is
+ * exempt only when this run already merged it into the requester's branch: its replayed status is
+ * done, its NEWEST journaled merge row names a full lowercase object id, and that commit is an
+ * ancestor of the requester's task branch (the run's integration branch plus --taskId, read exactly
+ * as the failed-task recheck reads it — a marked run's branch comes from its run-start record, never
+ * the current config). Every other overlapping pair keeps the compile-time refusal, an unreadable
+ * git answer included. The surviving errors are separabilityErrors' own rows, so the refusal text
+ * and its pair order are unchanged.
+ */
+function scopeGrantConflicts(cwd, journal, runId, requesterId, tasks, events) {
+    const errors = separabilityErrors(tasks);
+    if (!errors.length)
+        return errors;
+    const pairs = separabilityPairs(tasks);
+    if (pairs.length !== errors.length)
+        return errors; // a misaligned local fold refuses everything
+    const statuses = journal.replayStatuses();
+    let taskRef;
+    const requesterRef = () => (taskRef ??= `${integrationBase(events, () => integrationBranch(loadConfig(cwd), runId)).branch}--${requesterId}`);
+    const kept = [];
+    for (let i = 0; i < errors.length; i++) {
+        const { a, b } = pairs[i];
+        const sibling = a === requesterId ? b : b === requesterId ? a : undefined;
+        if (sibling === undefined)
+            continue;
+        if (mergedSiblingExempt(cwd, events, statuses.get(sibling), sibling, requesterRef))
+            continue;
+        kept.push(errors[i]);
+    }
+    return kept;
+}
+/** A full lowercase git object id: 40 (SHA-1) or 64 (SHA-256) hex, nothing else. */
+const FULL_OBJECT_ID = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+/**
+ * The one exemption: the sibling is done in THIS run's replay and its newest merge row's commit is a
+ * full object id that is an ancestor of the requester's task branch. Any unreadable git answer — a
+ * missing requester branch, a commit the repository lacks, a failed ancestry read — is no exemption.
+ */
+function mergedSiblingExempt(cwd, events, status, siblingId, requesterRef) {
+    if (status !== "done")
+        return false;
+    const merge = [...events].reverse().find((e) => e.event === "merge" && e.taskId === siblingId);
+    const commit = typeof merge?.data.commit === "string" ? merge.data.commit : undefined;
+    if (commit === undefined || !FULL_OBJECT_ID.test(commit))
+        return false;
+    const ref = requesterRef();
+    try {
+        execFileSync("git", ["rev-parse", "--verify", ref], { cwd, stdio: "ignore" });
+        execFileSync("git", ["merge-base", "--is-ancestor", commit, ref], { cwd, stdio: "ignore" });
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+/** The conflicting unordered pairs of separabilityErrors, in its exact emission order. */
+function separabilityPairs(tasks) {
+    const byId = new Map(tasks.map((t) => [t.id, t.deps ?? []]));
+    const pairs = [];
+    for (let i = 0; i < tasks.length; i++) {
+        for (let j = i + 1; j < tasks.length; j++) {
+            const a = tasks[i], b = tasks[j];
+            if (pairReachable(a.id, byId).has(b.id) || pairReachable(b.id, byId).has(a.id))
+                continue; // ordered
+            if (pairOverlap(a.files ?? [], b.files ?? []).length > 0)
+                pairs.push({ a: a.id, b: b.id });
+        }
+    }
+    return pairs;
+}
+/** Tasks reachable from `id` through deps (transitive) — separabilityErrors' own fold. */
+function pairReachable(id, byId) {
+    const seen = new Set();
+    const stack = [...(byId.get(id) ?? [])];
+    while (stack.length) {
+        const next = stack.pop();
+        if (seen.has(next))
+            continue;
+        seen.add(next);
+        stack.push(...(byId.get(next) ?? []));
+    }
+    return seen;
+}
+/** separabilityErrors' conservative overlap: identical patterns, or a glob matching the other's literal path. */
+function pairOverlap(a, b) {
+    const hits = new Set();
+    const isGlob = (p) => /[*?[\]{}]/.test(p);
+    for (const pa of a) {
+        for (const pb of b) {
+            if (pa === pb) {
+                hits.add(pa);
+                continue;
+            }
+            if (isGlob(pa) && !isGlob(pb) && filesGlob(pa)(pb))
+                hits.add(`${pb} ⊂ ${pa}`);
+            else if (isGlob(pb) && !isGlob(pa) && filesGlob(pb)(pa))
+                hits.add(`${pa} ⊂ ${pb}`);
+        }
+    }
+    return [...hits].sort();
+}
 /** The row a decision on this task answers right now: its newest failure when failed, else its newest park. */
 function openDecision(journal, taskId) {
     const { events, sourceIndexes } = readJournalEvents(journal);

package/dist/gates/baseline.js

@@ -363,9 +363,9 @@ const VOCAB_RE = /\b(?:error|fail(?:ed|ure|ing)?)\b/i;
 // OBS-791: `[vitest-worker]: Timeout calling "<method>"` is the SAME birpc mechanism one layer up.
 // Vitest's bundled birpc has a fixed 60s DEFAULT_TIMEOUT with no override (fixed upstream only in
 // vitest 4.x), so a suite whose tests all pass can still die at teardown when the worker->host RPC
-// window closes. `.github/workflows/release.yml` has forgiven this exact fingerprint since 2026-08-11
-// while this classifier called it a regression — the product charged a worker for the failure the
-// release gate was written to forgive. The METHOD NAME IS DELIBERATELY NOT PINNED: the timeout is a
+// window closes. Public CI's proof forgives this exact fingerprint (the RPC-only rule; since v2.8.2 decided
+// from the run's own record, queue rows 148 and 149) and this classifier once called it a regression — the
+// product charged a worker for the failure its own release proof forgives. The METHOD NAME IS DELIBERATELY NOT PINNED: the timeout is a
 // property of the RPC window, not of `onTaskUpdate`, and pinning one method would forgive a run and
 // charge its sibling for the same infrastructure event. This stays a CLOSED signature — the
 // `[vitest-worker]: ` prefix is vitest's own RPC layer and never user assertion text — and the

package/dist/gates/llm.d.ts

@@ -1,7 +1,7 @@
 import { type WorkerAdapter } from "../adapters/types.js";
 import type { Effort } from "../graph/schema.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
-import type { SeatLaunchCause } from "../drivers/orca.js";
+import { type SeatLaunchCause } from "../drivers/orca.js";
 export declare const GATE_PANE_SEP = " \u00B7 ";
 export declare const COMPLETION_FAKING_CHECKLIST = "## Completion-faking checklist\nHunt for these concrete completion-faking shortcuts before ruling on any criterion:\n- hardcoded-result: output or fixture hardcoded to satisfy the stated criterion instead of real logic\n- test-weakening: tests skipped, deleted, or assertions loosened until failing behavior looks green\n- vacuous-assertion: a test that cannot fail (asserts a constant, asserts its own setup, no assertion)\n- fixture-overfit: implementation narrowed to the exact test inputs rather than the described behavior\n- echo-not-implement: criterion text echoed in names, comments, or strings without the behavior itself\n- stub-left-behind: TODO, throw, or no-op stub where the real implementation should be\n- error-swallowing: catch or fallback that hides failures instead of handling them\n- self-mocking: the code under test mocked or faked so the test exercises the mock\n- check-bypass: lint, type, or CI checks disabled, relaxed, or excluded to get green\n- rename-as-work: code moved or renamed and presented as the requested change\n- scope-padding: unrelated edits padding the diff while the criterion's behavior is untouched\nWhen a criterion fails, the verdict MUST name which shortcut above it matches, or state that none does.";
 /** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */

package/dist/gates/llm.js

@@ -1,11 +1,13 @@
 import { stripVTControlCharacters } from "node:util";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { constants } from "node:buffer";
 import { randomBytes } from "node:crypto";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { matchesTrustDialog } from "../adapters/types.js";
+import { matchesTrustDialog, shq } from "../adapters/types.js";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
+import { CHECKOUT_MARK, checkoutProofLine } from "../drivers/orca.js";
 import { bannerShell, paneDispatchCommand, PLAIN_BANNER } from "../brand.js";
 import { sh } from "../run/git.js";
 import { harvestCpuFlatWindowMs, normalizeStallSnapshot, WorkerTreeCpuAccountant, } from "../run/stall.js";
@@ -204,6 +206,64 @@ const START_MARKER = "TICKMARKR_START_";
 const START_ROW = /^TICKMARKR_START_[\w-]+$/;
 const IDENTITY_LINE = /^(?:review\s*·|tickmarkr(?::|$))/;
 const IDENTITY_OPENERS = ["review ·", "tickmarkr"];
+// Row 135(a): the orca driver's launch preamble. create returns only once it read the complete checkout
+// frame, so every gate read holds the frame row whole — exactly checkoutProofLine's form (declared length
+// equal to half its lowercase hex, terminated) — or, as the last row, a strict prefix of that form.
+// Above it, as the first non-blank row, the shell may echo the typed launch line, which names that
+// frame's own checkout as `cd <shq checkout>`. Anything else shaped like them is the seat's. Frame rows
+// are read untrimmed: a trailing space or tab can never complete a frame or extend its prefix.
+function frameCheckout(row) {
+    const hex = /^TICKMARKR_CHECKOUT \d+:(.*);$/.exec(row)?.[1];
+    if (hex === undefined)
+        return undefined;
+    const checkout = Buffer.from(hex, "hex").toString("utf8");
+    return checkoutProofLine(checkout) === row ? checkout : undefined;
+}
+function partialFrameRow(row) {
+    if (row.length > 0 && `${CHECKOUT_MARK} `.startsWith(row))
+        return true;
+    const m = /^TICKMARKR_CHECKOUT (0|[1-9]\d*)(?::([0-9a-f]*))?$/.exec(row);
+    if (m === null || !printableFrameLength(m[1]))
+        return false;
+    return m[2] === undefined || frameHexCompletable(m[2], Number(m[1]));
+}
+// checkoutProofLine prints `TICKMARKR_CHECKOUT <n>:`, 2n hex digits and `;` as one string, so the length it
+// declares is a safe integer whose row fits the runtime's longest string. Any other length, unsafe or
+// non-finite included, is never its output, nor a prefix of one.
+function printableFrameLength(digits) {
+    const n = Number(digits);
+    return Number.isSafeInteger(n) && CHECKOUT_MARK.length + digits.length + 2 * n + 3 <= constants.MAX_STRING_LENGTH;
+}
+// A hex prefix checkoutProofLine could still extend to `bytes` bytes: valid UTF-8 so far, with its open
+// sequence closable inside the declared length. A trailing half byte is tried at each of its 16 values.
+function frameHexCompletable(hex, bytes) {
+    if (hex.length > bytes * 2)
+        return false;
+    const whole = Buffer.from(hex.slice(0, hex.length - (hex.length % 2)), "hex");
+    const candidates = hex.length % 2 === 0 ? [whole]
+        : Array.from({ length: 16 }, (_, lo) => Buffer.concat([whole, Buffer.of(parseInt(hex.at(-1), 16) * 16 + lo)]));
+    return candidates.some((c) => {
+        const owed = utf8Owed(c);
+        return owed !== undefined && owed <= bytes - c.length;
+    });
+}
+// Continuation bytes the last sequence still owes, or undefined when no continuation makes it UTF-8.
+function utf8Owed(bytes) {
+    try {
+        new TextDecoder("utf-8", { fatal: true }).decode(bytes, { stream: true });
+    }
+    catch {
+        return undefined;
+    }
+    let lead = bytes.length;
+    while (lead > 0 && bytes.length - lead < 3 && (bytes[lead - 1] & 0xc0) === 0x80)
+        lead--;
+    if (lead === 0)
+        return 0;
+    const b = bytes[lead - 1];
+    const size = b >= 0xf0 ? 4 : b >= 0xe0 ? 3 : b >= 0xc0 ? 2 : 1;
+    return Math.max(0, size - (bytes.length - lead + 1));
+}
 // Stages of the preamble walk. Each complete harness row is accepted only at or after its stage.
 const ECHO = 0, START = 1, BANNER = 2, IDENTITY = 3, SEAT = 4;
 // The char offset where the seat's own text begins, or -1 when the capture ends inside the preamble.
@@ -215,6 +275,7 @@ function seatStart(output, adapterBannerRows) {
     let bannerAt; // next banner row expected once the banner has begun
     let adapterBannerAt;
     let identitySeen = false;
+    let frameSeen = false;
     let offset = 0;
     for (let i = 0; i < rows.length; i++) {
         const row = rows[i].replace(/[ \t]+$/, "");
@@ -222,8 +283,15 @@ function seatStart(output, adapterBannerRows) {
         const last = i === rows.length - 1;
         // Complete harness rows: equality against the shape the preamble allows at this stage.
         let accepted = false;
+        const below = last ? undefined : frameCheckout(rows[i + 1]);
         if (!identitySeen && stage < SEAT && t.length === 0)
             accepted = true; // blank rows between preamble rows
+        else if (stage === ECHO && !frameSeen && frameCheckout(rows[i]) !== undefined) {
+            frameSeen = true;
+            accepted = true;
+        }
+        else if (below !== undefined && row.includes(`cd ${shq(below)}`) && rows.slice(0, i).every((r) => r.trim() === ""))
+            accepted = true; // orca launch echo
         else if (stage <= ECHO && completeEchoRow(row))
             accepted = true;
         else if (stage <= START && START_ROW.test(row)) {
@@ -239,13 +307,10 @@ function seatStart(output, adapterBannerRows) {
             bannerAt++;
             accepted = true;
         }
-        else if (stage <= IDENTITY && adapterBannerAt === undefined && adapterBannerRows.includes(row)) {
+        else if (stage <= IDENTITY && adapterBannerRows.indexOf(row, adapterBannerAt ?? 0) >= 0) {
+            // A closed list in render order: each row at most once, in list order, skipping allowed.
             stage = BANNER;
-            adapterBannerAt = adapterBannerRows.indexOf(row) + 1;
-            accepted = true;
-        }
-        else if (stage <= IDENTITY && adapterBannerAt !== undefined && row === adapterBannerRows[adapterBannerAt]) {
-            adapterBannerAt++;
+            adapterBannerAt = adapterBannerRows.indexOf(row, adapterBannerAt ?? 0) + 1;
             accepted = true;
         }
         else if (!identitySeen && stage <= IDENTITY && IDENTITY_LINE.test(t)) {
@@ -262,21 +327,20 @@ function seatStart(output, adapterBannerRows) {
         // The last row may be a partial paint: a prefix of the next harness row the preamble allows.
         if (stage <= ECHO && partialEchoRow(row))
             return -1;
+        if (stage === ECHO && !frameSeen && partialFrameRow(rows[i]))
+            return -1;
         if (stage <= START && (START_MARKER.startsWith(row) || /^TICKMARKR_START_[\w-]*$/.test(row)))
             return -1;
         if (stage <= BANNER && (bannerAt === undefined
             ? BANNER_ROWS.some((b) => b.startsWith(row))
             : BANNER_ROWS[bannerAt]?.startsWith(row) === true))
             return -1;
-        if (stage <= IDENTITY && (adapterBannerAt === undefined
-            ? adapterBannerRows.some((b) => b.startsWith(row))
-            : adapterBannerRows[adapterBannerAt]?.startsWith(row) === true))
+        if (stage <= IDENTITY && adapterBannerRows.slice(adapterBannerAt ?? 0).some((b) => b.startsWith(row)))
             return -1;
         // The identity row is painted right after the banner, so its prefix is a partial paint only there;
         // with no banner in the capture, "review" or "tick" alone is the seat's own first row.
         if (!identitySeen && stage <= IDENTITY
-            && (bannerAt === BANNER_ROWS.length
-                || (adapterBannerRows.length > 0 && adapterBannerAt === adapterBannerRows.length))
+            && (bannerAt === BANNER_ROWS.length || adapterBannerAt !== undefined)
             && IDENTITY_OPENERS.some((o) => o.startsWith(t)))
             return -1;
         return offset;

package/dist/run/daemon.js

@@ -7306,7 +7306,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             throw error;
                     });
                     fatalPhase = "tip-verify";
-                    // OBS-34: post-merge integration-tip verify — strict exit codes, no baseline forgiveness.
+                    // OBS-34: post-merge integration-tip verify — the battery forgives only what its baseline entry recorded red
+                    // (src/run/merge.ts, the same predicate as the gate battery).
                     const lastMergedTask = [...journal.read()].reverse().find((e) => e.event === "merge" && e.taskId)?.taskId;
                     // 2.8.1 T1 (ANL-023 §7.1): every close opens on the integration identity and closes on it below.
                     const identity = { repo: repoRoot, branch, expected: published }; // 2.8.1 T2: E

package/dist/run/wall-budget.js

@@ -74,7 +74,12 @@ export function wallBudget(events) {
             return;
         span("queue", opened, ts);
         // One open wait per owner, closed in journal order: the list stays sorted and non-overlapping.
-        queued.set(key, [...(queued.get(key) ?? []), [opened, ts]]);
+        // Appended in place: a copy per close made a run with n waits cost O(n^2) (ANL-022 §3 T1 #5).
+        const list = queued.get(key);
+        if (list)
+            list.push([opened, ts]);
+        else
+            queued.set(key, [[opened, ts]]);
         waits.delete(key);
     };
     const service = (gate, task, a, b) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.8.1",
+  "version": "2.8.3",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -77,7 +77,6 @@
         "tsconfig.json",
         "vitest.config.ts",
         ".github/pull_request_template.md",
-        "scripts/assert-test-file-count.sh",
         "scripts/emit-schema.ts",
         "scripts/probe-rig.mjs",
         "scripts/run-ci-vitest.sh",

package/skills/tickmarkr-overseer/SKILL.md

@@ -691,12 +691,13 @@ subject of a release proof is never *"the run"* and never *"the fix leg"* — it
 the one commit that carries the run's work AND every leg merged into it. Name that commit's sha in the
 proof, in the same act as the grade, and the proof is bound to that sha alone. **When the subject moves — a
 later merge, a new integration tip, an amended or re-cut commit, a fresh export, a re-tag — the proof is
-VOID, and the new subject is graded from scratch**, count oracle included, since the oracle is derived from
-the merged tree and not from either parent. Two greens assembled into one verdict are two claims about two
-trees that never contained each other: the union's own conflict resolutions, its ordering and its
-collected-test total are exactly what neither green observed — which is why `RELEASING.md` step 4 matches
-the run's head SHA to the mirror's `HEAD` before a single job log is graded. This is the void-condition duty
-pointed at bytes: **a proof that names no commit cannot notice its subject leaving.**
+VOID, and the new subject is graded from scratch**, its tracked test set included, since that set is
+recomputed from the merged tree and not from either parent. Two greens assembled into one verdict are two
+claims about two trees that never contained each other: the union's own conflict resolutions, its ordering
+and its collected test set are exactly what neither green observed — which is why `RELEASING.md` step 4
+hands the grader the mirror's `HEAD` and the grader refuses a run of any other head before a single record
+is downloaded. This is the void-condition duty pointed at bytes: **a proof that names no commit cannot
+notice its subject leaving.**
 
 **THE RECIPROCAL DUTY, and it is yours because you write both documents:** when you issue a ruling that
 re-scopes, narrows, splits or re-owns anything, **the ruling must name every sealed document its subject
@@ -1059,7 +1060,8 @@ they are left implicit:
      test exists — the acceptance oracle runs the sentence as vitest `-t` and a paraphrase matches zero tests.
    - Every fix-leg verify carries `--author <the seat that wrote it>`; without it the author is HUMAN, every
      vendor stays eligible, and a same-vendor approval is not the cross-vendor review the criterion names.
-   - A grader change is proved on a captured REAL job log, never on a synthetic one.
+   - A grader change is proved on a recorded run — GitHub's structured run record and the proof groups its
+     jobs uploaded — never on a synthetic job log: the grader reads no log text at all.
    - A public-CI red is classified in a throttled Linux container first (`docker run --cpus=2 node:22`),
      by measurement: starvation on the base tree is not a defect on the branch.
 
@@ -1603,19 +1605,31 @@ Create specialist seats using `orca terminal create --worktree path:<repo> --com
    - **RUN BOTH RELEASE PROOFS BEFORE STANDING DOWN.** The first is the exported-tree suite, which
      maintainers run from the private repo with its `verify:export` script — that tooling is deliberately
      not part of this package, so the command does not exist in a public checkout; it must install,
-     build, lint, and only then run the suite in the exported tree; then
-     `TICKMARKR_E2E=1 npx vitest run tests/e2e/orca-smoke.e2e.test.ts` must exercise the installed-Orca
-     smoke. A skipped smoke is not proof. Record both results before declaring the release complete.
-
-   - **GRADE PUBLIC CI FROM JOB LOGS AT RUN-END ONLY (law 48).** A badge is not the grade, and
-     `gh run view --job --log` is empty while the run is in progress. At run-end execute
-     `scripts/grade-ci.sh <run-id> <expected-count> <tag>` and require GREEN from every job of the
-     declared inventory it prints first — serial `test` and `test-macos`, or sharded, per OS, the four
-     `suite <os> k/4` shards, `single-fork <os>` and `aggregate <os>`; a missing, duplicated or unknown
-     job reads UNREADABLE, never a skip. Its UNREADABLE state is a hard stop, not a green default.
-     Derive the expected glob pathspec count with `git ls-files ':(glob)tests/**/*.test.ts'`
-     (including the `.tsx` sibling where present), never a bare
-     `tests/**/*.test.ts`: bare `**` is not a git glob (law 49).
+     build, lint, and only then run the suite in the exported tree, and only its zero exit writes the export
+     proof that `export-public.sh --onto` reads before it writes the mirror commit. Then the installed-Orca
+     smoke must exercise its live leg, decided from its own record and never from Vitest's exit status:
+     `TICKMARKR_CI_RECORD=/tmp/tickmarkr-orca-smoke.record.json TICKMARKR_E2E=1 npx --no-install vitest run tests/e2e/orca-smoke.e2e.test.ts`,
+     then
+     `npx --no-install tsx scripts/ci/cli.ts verdict --require-test 'tests/e2e/orca-smoke.e2e.test.ts::e2e: orca driver smoke > live: the real-orca terminal leg — vitest-skipped without the gate or a reachable runtime' /tmp/tickmarkr-orca-smoke.record.json`
+     must exit 0. The forced-stall proof (RELEASING.md step 6) is decided the same way: its record from
+     `TICKMARKR_CI_RECORD=/tmp/tickmarkr-forced-stall.record.json TICKMARKR_TEST_FORCE_STALL=1 npx --no-install vitest run tests/e2e/forced-stall.e2e.test.ts -t 'the enabled forced-stall release proof makes the integration tip verifier recover a real RPC-stranded serial file as parallel exit1 then serial-only exit0 under distinct nonces, so a helper-only green or a full-suite retry fails'`,
+     then
+     `npx --no-install tsx scripts/ci/cli.ts verdict --require-test 'tests/e2e/forced-stall.e2e.test.ts::the enabled forced-stall release proof makes the integration tip verifier recover a real RPC-stranded serial file as parallel exit1 then serial-only exit0 under distinct nonces, so a helper-only green or a full-suite retry fails' /tmp/tickmarkr-forced-stall.record.json`
+     must exit 0. A skipped smoke or stall leaf is not proof: Vitest exits 0 when the named leaf skips (the gate
+     unset, Orca unreachable, a drifted `-t` title), and the verdict reads it RED. Record both results before
+     declaring the release complete.
+
+   - **GRADE PUBLIC CI FROM ITS RUN RECORD AND PROOF GROUPS AT RUN-END ONLY (law 48).** A badge is not
+     the grade, and an in-progress run is never graded. At run-end execute
+     `scripts/grade-ci.sh <run-id> <mirror HEAD sha> <mirror clone> <tag>` and require GREEN from every job
+     of the declared inventory it prints first — serial `test` and `test-macos`; a missing, duplicated or
+     unknown job reads UNREADABLE, never a skip, and a sharded run reads UNREADABLE until its proof-group
+     selection ships (ANL-022 §7.4). The grader is bound to the head: a run of any other commit reads
+     UNREADABLE before anything is downloaded. It reads GitHub's structured step outcomes and conclusions and
+     recomputes each job's uploaded proof group (`proof-<job>`: the Vitest records and the floors sidecar)
+     against the test files that commit tracks in the mirror clone — there is no count to derive, and no job
+     log text is read, so a log gh labels `UNKNOWN STEP` or a test that prints timeout text cannot move the
+     grade. Its UNREADABLE state is a hard stop, not a green default.
 
    - **RE-READ THE REGISTRY BEFORE RULING (law 51).** A successful Release run and the first
      `npm view` are separate observations: registry propagation can briefly return the prior version.

package/skills/tickmarkr-overseer/scripts/grade-ci.sh

@@ -1,45 +1,59 @@
 #!/bin/bash
-# grade-ci.sh <run-id> <expected-count> [tag] — grade EVERY job of a public CI run's closed inventory from
-# its JOB LOG. Grade only at run-end. A missing/in-progress/empty log is UNREADABLE, never evidence of green.
-# Exit 0 GREEN, 1 RED, 2 UNREADABLE, 3 INFRA_KILLED: a job the GitHub runner shut down or cancelled with
-# no failed or timed-out test (the classifier's class, D-897) — never green, never a pass, only unproven.
+# grade-ci.sh <run-id> <expected-sha> <repo-dir> [tag] — grade EVERY job of a public CI run of <expected-sha>
+# from GitHub's structured run record and each job's uploaded proof group (v2.8.2 T3, ANL-022 §7.2b; queue rows
+# 165 and 148). NO LOG TEXT IS READ: no job log, no step label, no `##[error]` annotation decides anything.
+# Grade only at run-end. Exit 0 GREEN, 1 RED, 2 UNREADABLE, 3 INFRA_KILLED: a cancelled run, job or declared
+# step with no failed declared step — never green, never a pass, only unproven.
 # UNREADABLE dominates a mixed result, then RED: a failure anywhere dominates a kill.
 #
+# INPUT: <expected-sha> is 40 lowercase hex naming a commit in <repo-dir> — the mirror clone (RELEASING.md step
+# 4) or the Release workflow's own checkout — else exit 2 before any gh call. No count argument: the manifest of
+# tracked test files is recomputed from that commit.
+# ONE READ: `gh run view <run-id> --json headSha,status,conclusion,jobs`. IDENTITY: UNREADABLE, before any
+# download, unless the run's headSha is <expected-sha> and its status is completed.
+#
 # Two CLOSED inventories (v2.7.8 T4; the workflow renders these names): serial {test, test-macos}; sharded,
 # for os in ubuntu-latest and macos-latest, `suite <os> k/4` for k 1..4, `single-fork <os>`, `aggregate <os>`.
 # A run holding any sharded name is graded against the sharded inventory, else the serial one. The first
 # line is `INVENTORY form=<serial|sharded> declared=<n> observed=<n>`; each missing, duplicated or unknown
 # name prints `INVENTORY_DEFECT kind=<missing|duplicate|unknown> job=<json-quoted name>` and makes the run
-# UNREADABLE: a job the inventory does not name is never skipped.
+# UNREADABLE: a job the inventory does not name is never skipped. The sharded proof-group selection is ANL-022
+# §7.4's, so until it ships a sharded run reads UNREADABLE after its INVENTORY line.
 #
-# A verdict line is read only from the log lines whose gh step column equals its declared step, exactly
-# once, else UNREADABLE — a line a test or any other step prints, before or after the real one, never decides:
-#   COUNT_ORACLE <GREEN|RED> expected=<n|UNREADABLE> actual=<n|UNREADABLE>   step `Assert collected test-file count`
-#   COVERAGE_FLOORS verdict=… floors=… failing=…  (T1's final floors line)   step `Recheck coverage floors`
-#   SET_ORACLE verdict=… expected=… actual=… defects=…  (T3's set oracle)     step `Assert collected test-file set`
-# ROLES — the shared classifier (classify-vitest-log.sh) stays the one log verdict:
-#   serial       the base rule (count oracle GREEN at the expected count, the classifier given that count
-#                reading CLEAN or RPC_ONLY, passed+skipped equal to it) AND exactly one COVERAGE_FLOORS
-#                verdict=GREEN, so a dropped floors step reads UNREADABLE.
-#   shard, single-fork
-#                GREEN only on conclusion success whose whole log the classifier, given no count, reads CLEAN
-#                or RPC_ONLY: their wrapper already applied the shard contract in-job.
-#   aggregate    GREEN only on conclusion success with exactly one COVERAGE_FLOORS verdict=GREEN, exactly one
-#                `SET_ORACLE verdict=GREEN expected=N actual=N defects=0`, and the lines of its step
-#                `Merge coverage (one threshold check per OS)` classified CLEAN or RPC_ONLY.
-# Exit annotations: SERIAL keeps the one exception run-ci-vitest.sh grants (a failure explained ONLY by steps
-# that exited exactly 1 on a log of their own the classifier reads RPC_ONLY); any other failing annotation is
-# never GREEN. Shard, single-fork and aggregate admit none — their wrapper applied the exception in-job.
-# INFRA_KILLED is the base rule for every role.
+# Per serial job, every part from the same read or the job's own artifact:
+#   steps        each DECLARED step below present exactly once in .jobs[].steps[] (missing or duplicated ->
+#                UNREADABLE); GREEN needs every one `success`. A cancelled job or declared step is INFRA_KILLED
+#                unless a declared step concluded `failure` (then RED); the steps a kill skipped do not count.
+#   conclusions  GREEN also needs the job's and the run's conclusion `success`, so a failing undeclared step (an
+#                action's post-step) reds the grade; a cancelled run is INFRA_KILLED, and any other run conclusion
+#                no job's grade accounts for is RED.
+#   proof        `gh run download <run-id> -n proof-<job>` into a fresh directory (missing -> UNREADABLE), then
+#                the grader's own checkout's `tsx scripts/ci/cli.ts proof --head <expected-sha> --repo <repo-dir>
+#                <dir>` (that checkout is the git toplevel holding this script; without its cli.ts, exit 2):
+#                the group's original records read CLEAN or RPC_ONLY at <expected-sha>, the tracked set recomputed
+#                from the commit holds every file once and finished, and the floors sidecar reads GREEN.
+# Output: the INVENTORY lines, `RUN head=… expected=… status=… conclusion=…`, per job `<job>: steps=[…]
+# proof=[<PROOF line>]` then `<job>: <GRADE>`, and a final `VERDICT rc=<n> …`.
 set -u
 
-run=${1:?run id required}
-expected=${2:?expected tracked test-file count required}
-tag=${3:-$run}
+[ "$#" -ge 3 ] && [ "$#" -le 4 ] \
+  || { echo "UNREADABLE: usage: grade-ci.sh <run-id> <expected-sha> <repo-dir> [tag]"; exit 2; }
+run=$1
+sha=$2
+repo_dir=$3
+tag=${4:-$run}
 here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
-repo=${TKR_GRADE_CI_REPO:-alzahrani-khalid/tickmarkr}
+# the grader's own checkout — the same for the canonical copy and the installed .claude/skills one
+checkout=$(git -C "$here" rev-parse --show-toplevel 2>/dev/null)
+gh_repo=${TKR_GRADE_CI_REPO:-alzahrani-khalid/tickmarkr}
 out_dir=${TKR_GRADE_CI_DIR:-${TKR_STATE_DIR:-.tickmarkr}/overseer/diag}
-mkdir -p "$out_dir" || { echo "UNREADABLE: cannot create log directory $out_dir"; exit 2; }
+
+[[ $sha =~ ^[0-9a-f]{40}$ ]] || { echo "UNREADABLE: the expected head is not 40 lowercase hex"; exit 2; }
+git -C "$repo_dir" cat-file -e "$sha^{commit}" 2>/dev/null \
+  || { echo "UNREADABLE: $sha is not a commit in $repo_dir"; exit 2; }
+[ -n "$checkout" ] && [ -f "$checkout/scripts/ci/cli.ts" ] \
+  || { echo "UNREADABLE: the grader's own checkout holds no scripts/ci/cli.ts to recompute the proof"; exit 2; }
+mkdir -p "$out_dir" || { echo "UNREADABLE: cannot create the proof directory $out_dir"; exit 2; }
 
 serial_inventory=$'test\ntest-macos'
 sharded_inventory=$(for os in ubuntu-latest macos-latest; do
@@ -47,21 +61,24 @@ sharded_inventory=$(for os in ubuntu-latest macos-latest; do
   echo "single-fork $os"
   echo "aggregate $os"
 done)
-COUNT_STEP="Assert collected test-file count"
-FLOORS_STEP="Recheck coverage floors"
-SET_STEP="Assert collected test-file set"
-MERGE_STEP="Merge coverage (one threshold check per OS)"
-COUNT_FORMAT='COUNT_ORACLE (GREEN|RED) expected=([0-9]+|UNREADABLE) actual=([0-9]+|UNREADABLE)'
-FLOORS_FORMAT='COVERAGE_FLOORS verdict=(GREEN|RED|UNREADABLE) floors=([0-9]+|UNREADABLE) failing=([0-9]+|UNREADABLE)'
-SET_FORMAT='SET_ORACLE verdict=(GREEN|RED|UNREADABLE) expected=([0-9]+|UNREADABLE) actual=([0-9]+|UNREADABLE) defects=[0-9]+'
+# the serial job's declared steps as GitHub names them (an unnamed `run:` step is `Run <command>`)
+serial_steps='Run npm ci
+Run npm run build
+Run npm run lint
+Run coverage proof (parallel suite project)
+Recheck coverage floors
+Run single-fork projects (independent of the step above)
+Assert collected test-file set
+Upload proof group'
+cli=("$checkout/node_modules/.bin/tsx" "$checkout/scripts/ci/cli.ts")
 
 verdict=0
 mark_unreadable() { verdict=2; }
 mark_red() { [ "$verdict" -eq 2 ] || verdict=1; }
 mark_killed() { [ "$verdict" -ne 0 ] || verdict=3; }
-field() { printf '%s\n' "$classified" | sed -n "s/^VITEST_LOG.* $1=\([^ ]*\).*/\1/p"; }
+finish() { echo "VERDICT rc=$verdict (0=all GREEN 1=RED 2=UNREADABLE 3=INFRA_KILLED)"; exit "$verdict"; }
 count() { printf '%s' "$1" | grep -c ''; }
-# json <name> — one JSON string; awk -v decodes gh's @tsv escapes (\t \n \r \\) first
+# json <name> — one JSON string; awk -v decodes the @tsv escapes (\t \n \r \\) first
 json() {
   LC_ALL=C awk -v s="$1" 'BEGIN {
     for (i = 1; i < 32; i++) esc[sprintf("%c", i)] = sprintf("\\u%04x", i)
@@ -71,28 +88,37 @@ json() {
   }'
 }
 defect() { echo "INVENTORY_DEFECT kind=$1 job=$(json "$2")"; mark_unreadable; }
-# step_log <log> <step> — the job-log lines gh's step column attributes to <step>, as gh printed them
-step_log() { awk -F'\t' -v s="$2" 'NF >= 3 && $2 == s' "$1"; }
-# verdict_line <log> <step> <family> <format> — the ONE <family> line <step> printed, in <format>;
-# else MISSING, MULTIPLE(n) or MALFORMED, each UNREADABLE
-verdict_line() {
-  local lines
-  lines=$(step_log "$1" "$2" | awk -v esc="$(printf '\033')" '{
-    gsub(/\^\[\[[0-9;]*m/, ""); gsub(esc "\\[[0-9;]*m", "")
-    sub(/^[^\t]*\t[^\t]*\t[0-9T:.-]+Z ?/, ""); sub(/[ \t\r]+$/, ""); print
-  }' | grep -E "^$3( |\$)")
-  case $(count "$lines") in
-    0) echo MISSING ;;
-    1) if printf '%s\n' "$lines" | grep -qxE "$4"; then printf '%s\n' "$lines"; else echo MALFORMED; fi ;;
-    *) echo "MULTIPLE($(count "$lines"))" ;;
-  esac
-}
-readable() { case $1 in MISSING|MULTIPLE*|MALFORMED) return 1 ;; esac; }
-floors_green() { printf '%s\n' "$1" | grep -qxE 'COVERAGE_FLOORS verdict=GREEN floors=[0-9]+ failing=0'; }
 
-jobs=$(gh run view "$run" --repo "$repo" --json jobs \
-  --jq '.jobs[] | [.databaseId, .name, .status, (.conclusion // "")] | @tsv') \
-  || { echo "UNREADABLE: job list"; exit 2; }
+run_json=$(gh run view "$run" --repo "$gh_repo" --json headSha,status,conclusion,jobs) \
+  || { echo "UNREADABLE: gh run view $run"; mark_unreadable; finish; }
+# the read as @tsv-escaped rows — RUN <head> <status> <conclusion>, JOB <index> <name> <status> <conclusion>,
+# STEP <job index> <name> <conclusion>; a null or empty value prints `null`; any other shape fails closed
+rows=$(printf '%s' "$run_json" | node -e '
+const field = (v) => v === null || v === undefined || v === "" ? "null"
+  : String(v).replace(/\\/g, "\\\\").replace(/\t/g, "\\t").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+const scalar = (v) => v === null || v === undefined || typeof v === "string" || typeof v === "number";
+let text = "";
+process.stdin.setEncoding("utf8").on("data", (d) => { text += d; }).on("end", () => {
+  try {
+    const run = JSON.parse(text);
+    const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+    if (!object(run) || !Array.isArray(run.jobs) || ![run.headSha, run.status, run.conclusion].every(scalar)) throw 0;
+    const out = [["RUN", run.headSha, run.status, run.conclusion]];
+    run.jobs.forEach((job, i) => {
+      if (!object(job) || ![job.name, job.status, job.conclusion].every(scalar)) throw 0;
+      if (job.steps !== undefined && job.steps !== null && !Array.isArray(job.steps)) throw 0;
+      out.push(["JOB", i, job.name, job.status, job.conclusion]);
+      for (const step of job.steps ?? []) {
+        if (!object(step) || ![step.name, step.conclusion].every(scalar)) throw 0;
+        out.push(["STEP", i, step.name, step.conclusion]);
+      }
+    });
+    process.stdout.write(out.map((row) => row.map(field).join("\t") + "\n").join(""));
+  } catch { process.exit(2); }
+});') || { echo "UNREADABLE: gh run view $run returned no readable run record"; mark_unreadable; finish; }
+IFS=$'\t' read -r _ head status conclusion <<< "$(printf '%s\n' "$rows" | sed -n $'s/^RUN\t/-\t/p')"
+jobs=$(printf '%s\n' "$rows" | sed -n $'s/^JOB\t//p')
+steps=$(printf '%s\n' "$rows" | sed -n $'s/^STEP\t//p')
 # an empty job list is an inventory like any other: serial, observed=0, every declared job missing
 
 names=$(printf '%s\n' "$jobs" | cut -f2)
@@ -113,126 +139,96 @@ while IFS= read -r name; do
   printf '%s\n' "$declared" | grep -qxF -- "$name" || defect unknown "$name"
 done < <([ -z "$jobs" ] || printf '%s\n' "$names" | awk '!seen[$0]++')
 
-[ -z "$jobs" ] || while IFS=$'\t' read -r id name status conclusion; do
-  # an unknown job has no role to grade: its INVENTORY_DEFECT already made the run UNREADABLE
-  printf '%s\n' "$declared" | grep -qxF -- "$name" || continue
-  case "$name" in
-    test|test-macos) role=serial ;;
-    suite\ *) role=shard ;;
-    single-fork\ *) role=single-fork ;;
-    *) role=aggregate ;;
-  esac
+if [ "$form" = sharded ]; then
+  echo "SHARDED: UNREADABLE (the sharded proof-group selection is ANL-022 §7.4's and has not shipped)"
+  mark_unreadable
+  finish
+fi
 
-  echo "$name: role=$role status=$status conclusion=${conclusion:-none} job=$id"
-  if [ "$status" != "completed" ]; then
-    echo "$name: UNREADABLE (job has not reached run-end)"
-    mark_unreadable
-    continue
-  fi
+echo "RUN head=$head expected=$sha status=$status conclusion=$conclusion"
+if [ "$head" != "$sha" ]; then
+  echo "RUN: UNREADABLE (the run's head is not the expected head; nothing downloaded)"
+  mark_unreadable
+  finish
+fi
+if [ "$status" != completed ]; then
+  echo "RUN: UNREADABLE (the run has not reached run-end; nothing downloaded)"
+  mark_unreadable
+  finish
+fi
 
-  log="$out_dir/CI-$tag-$(printf '%s' "$name" | tr -c 'A-Za-z0-9._-' '-').log"
-  gh run view --repo "$repo" --job "$id" --log > "$log" 2>/dev/null
-  if [ ! -s "$log" ]; then
-    echo "$name: UNREADABLE (empty log)"
+[ -z "$jobs" ] || while IFS=$'\t' read -r index name job_status job_conclusion; do
+  # an unknown or duplicated job has no role to grade: its INVENTORY_DEFECT already made the run UNREADABLE
+  [ "$(printf '%s\n' "$names" | grep -cxF -- "$name")" -eq 1 ] && printf '%s\n' "$declared" | grep -qxF -- "$name" || continue
+
+  echo "$name: status=$job_status conclusion=$job_conclusion"
+  if [ "$job_status" != completed ]; then
+    echo "$name: UNREADABLE (job has not reached run-end)"
     mark_unreadable
     continue
   fi
 
-  files=$(grep -oE 'Test Files .*' "$log" | sed 's/[[:space:]]*$//')
-  # OBS-1184: the log verdict comes from the ONE classifier the public CI wrapper also uses
-  # (scripts/run-ci-vitest.sh), so the badge and this grade cannot disagree. Its rules — complete
-  # summaries, failed/timed-out tests, coverage-threshold misses, and the RPC-timeout-only exception
-  # to "any unhandled error is RED" (OBS-1058) — live in classify-vitest-log.sh, stated once there.
-  # A serial job's expected count is its declared file contract: both steps' summaries must collect it all.
-  # A shard or single-fork job carries no count: its wrapper held it to its plan in-job.
-  if [ "$role" = serial ]; then
-    classified=$(bash "$here/classify-vitest-log.sh" "$log" "$expected" 2>&1)
-  else
-    classified=$(bash "$here/classify-vitest-log.sh" "$log" 2>&1)
-  fi
-  log_verdict=$(field verdict)
-  passed=$(field passed); skipped=$(field skipped); failed=$(field failed); timedout=$(field timedout)
-  unhandled=$(field unhandled); rpc=$(field runner_rpc_timeouts); coverage=$(field coverage_misses)
-  kills=$(field runner_kills)
-  errors=$(grep -oE '##\[error\].*' "$log" | sort | uniq -c | sed 's/^ *//' | tr '\n' ';')
-  # The commands' own outcomes stand, as in the wrapper: GREEN needs a success conclusion with no step
-  # exit annotation, or — SERIAL only — a failure explained ONLY by steps that exited exactly 1 on a log
-  # of their own (gh's step column) that the classifier calls RPC_ONLY. Any other code (2, a signal's
-  # 137), any annotation on another role, an unexplained failure, or a cancelled, timed-out or missing
-  # conclusion is RED.
-  exits=$(grep -E '##\[error\]Process completed with exit code [0-9]+' "$log")
-  case "$conclusion" in
-    success) outcome=ok ;;
-    failure) if [ -n "$exits" ]; then outcome=ok; else outcome=unexplained-failure; fi ;;
-    *) outcome="conclusion-${conclusion:-none}" ;;
-  esac
-  if [ -n "$exits" ]; then
-    while IFS= read -r exit_line; do
-      code=$(printf '%s\n' "$exit_line" | sed -E 's/.*Process completed with exit code ([0-9]+).*/\1/')
-      if [ "$code" != 1 ] || [ "$role" != serial ]; then outcome="exit-$code"; break; fi
-      step=$(printf '%s\n' "$exit_line" | awk -F'\t' 'NF >= 3 { print $2 }')
-      step_log "$log" "$step" > "$log.step"
-      case $(bash "$here/classify-vitest-log.sh" "$log.step" 2>&1) in
-        "VITEST_LOG verdict=RPC_ONLY "*) ;;
-        *) outcome="exit-1-not-rpc-only"; break ;;
-      esac
-    done <<< "$exits"
-  fi
-
-  oracles=
-  case $role in
-    serial)
-      oracle=$(verdict_line "$log" "$COUNT_STEP" COUNT_ORACLE "$COUNT_FORMAT")
-      floors=$(verdict_line "$log" "$FLOORS_STEP" COVERAGE_FLOORS "$FLOORS_FORMAT")
-      oracles="oracle=[$oracle] floors=[$floors] " ;;
-    aggregate)
-      floors=$(verdict_line "$log" "$FLOORS_STEP" COVERAGE_FLOORS "$FLOORS_FORMAT")
-      set_oracle=$(verdict_line "$log" "$SET_STEP" SET_ORACLE "$SET_FORMAT")
-      step_log "$log" "$MERGE_STEP" > "$log.merge"
-      merge=$(bash "$here/classify-vitest-log.sh" "$log.merge" 2>&1 | sed -n 's/^VITEST_LOG verdict=\([^ ]*\) reason=\([^ ]*\) .*/\1 \2/p')
-      oracles="floors=[$floors] set=[$set_oracle] merge=[$merge] " ;;
-  esac
+  own=$(printf '%s\n' "$steps" | awk -F'\t' -v i="$index" '$1 == i')
+  listed=; unread=; failed=; unproven=; killed=
+  [ "$job_conclusion" != cancelled ] || killed=1
+  while IFS= read -r step; do
+    matches=$(printf '%s\n' "$own" | awk -F'\t' -v s="$step" '$2 == s { print $3 }')
+    case $(count "$matches") in
+      0) outcome=MISSING; unread=1 ;;
+      1) outcome=$matches ;;
+      *) outcome="MULTIPLE($(count "$matches"))"; unread=1 ;;
+    esac
+    case $outcome in
+      success|MISSING|MULTIPLE*) ;;
+      cancelled) killed=1 ;;
+      failure) failed=1 ;;
+      *) unproven=1 ;; # skipped, or no conclusion: never success
+    esac
+    listed="$listed${listed:+ | }$step: $outcome"
+  done <<< "$serial_steps"
 
-  echo "$name: ${oracles}files=[$(printf '%s' "$files" | tr '\n' '|')] passed=$passed skipped=$skipped failed=$failed timedout=$timedout unhandled=$unhandled runner_rpc_timeouts=$rpc coverage_misses=$coverage runner_kills=${kills:-?} log=[$(field reason)] outcome=[$outcome] errors=[$errors]"
-  # A killed runner skips the oracle steps, so a missing verdict line is the kill's, not an unreadable log:
-  # INFRA_KILLED unless a step's own failing exit or a failed/timed-out test dominates it (then RED).
-  if [ "$log_verdict" = INFRA_KILLED ] && [ "${outcome#exit-}" = "$outcome" ]; then
-    echo "$name: INFRA_KILLED"
-    mark_killed
-    continue
-  elif [ "${kills:-0}" -gt 0 ] 2>/dev/null; then
-    grade=RED
-  elif [ -z "$log_verdict" ]; then
-    grade=UNREADABLE
+  proof=
+  grade=GREEN
+  if [ -n "$unread" ]; then
+    grade=UNREADABLE; proof="not downloaded: a declared step is missing or duplicated"
+  elif [ -n "$killed" ]; then
+    grade=INFRA_KILLED; [ -z "$failed" ] || grade=RED; proof="not downloaded: the job was cancelled"
   else
-    case $log_verdict in CLEAN|RPC_ONLY) log_ok=1 ;; *) log_ok= ;; esac
-    grade=RED
-    case $role in
-      serial)
-        if ! readable "$oracle" || ! readable "$floors" || [ -z "$files" ]; then
-          grade=UNREADABLE
-        elif [ "$oracle" = "COUNT_ORACLE GREEN expected=$expected actual=$expected" ] && floors_green "$floors" \
-             && [ -n "$log_ok" ] && [ "$outcome" = ok ] && [ $((passed + skipped)) -eq "$expected" ]; then
-          grade=GREEN
-        fi ;;
-      shard|single-fork)
-        if [ "$outcome" = ok ] && [ "$conclusion" = success ] && [ -n "$log_ok" ]; then grade=GREEN; fi ;;
-      aggregate)
-        if ! readable "$floors" || ! readable "$set_oracle"; then
-          grade=UNREADABLE
-        elif [ "$outcome" = ok ] && [ "$conclusion" = success ] && floors_green "$floors" \
-             && [ "$set_oracle" = "SET_ORACLE verdict=GREEN expected=$expected actual=$expected defects=0" ] \
-             && { [ "${merge%% *}" = CLEAN ] || [ "${merge%% *}" = RPC_ONLY ]; }; then
-          grade=GREEN
-        fi ;;
-    esac
+    dir=$(mktemp -d "$out_dir/CI-$(printf '%s' "$tag" | tr -c 'A-Za-z0-9._-' '-')-proof-$name.XXXXXX") \
+      && gh run download "$run" --repo "$gh_repo" -n "proof-$name" -D "$dir" > /dev/null 2>&1
+    if [ $? -ne 0 ]; then
+      grade=UNREADABLE; proof="MISSING: artifact proof-$name not downloaded"
+    else
+      proof_out=$("${cli[@]}" proof --head "$sha" --repo "$repo_dir" "$dir" 2> "$dir.stderr")
+      proof_status=$?
+      printf '%s\n' "$proof_out" | sed -n "s/^PROOF_DEFECT /$name: PROOF_DEFECT /p"
+      proof=$(printf '%s\n' "$proof_out" | grep '^PROOF ')
+      word=$(printf '%s\n' "$proof" | sed -n 's/^PROOF dir=.* verdict=\([A-Z]*\) head=.*/\1/p')
+      # fail closed: one PROOF line, and its word believed only beside its own exit status
+      if [ "$(count "$proof")" -ne 1 ]; then
+        grade=UNREADABLE; proof="UNREADABLE: cli.ts proof exited $proof_status with $(count "$proof") PROOF lines"
+      elif [ "$word:$proof_status" = GREEN:0 ] || [ "$word:$proof_status" = RED:1 ]; then
+        grade=$word
+      else
+        grade=UNREADABLE
+      fi
+    fi
+    if [ "$grade" != UNREADABLE ] && { [ -n "$failed$unproven" ] || [ "$job_conclusion" != success ]; }; then grade=RED; fi
   fi
+  echo "$name: steps=[$listed] proof=[$proof]"
   echo "$name: $grade"
   case $grade in
     RED) mark_red ;;
     UNREADABLE) mark_unreadable ;;
+    INFRA_KILLED) mark_killed ;;
   esac
 done <<< "$jobs"
 
-echo "VERDICT rc=$verdict (0=all GREEN 1=RED 2=UNREADABLE 3=INFRA_KILLED)"
-exit "$verdict"
+# the run's own conclusion: GREEN needs success; a cancelled run is INFRA_KILLED; any other conclusion is RED
+# unless a job's grade above already accounts for it (a killed job concludes its run `failure` too)
+case $conclusion in
+  success) ;;
+  cancelled) mark_killed ;;
+  *) if [ "$verdict" -eq 0 ]; then echo "RUN: RED (run conclusion $conclusion with every job GREEN)"; mark_red; fi ;;
+esac
+finish

package/skills/tickmarkr-overseer/scripts/classify-vitest-log.sh

@@ -1,133 +0,0 @@
-#!/bin/bash
-# classify-vitest-log.sh <log> [expected-files] — the ONE strict Vitest log classifier
-# (OBS-1184). The public CI wrapper (scripts/run-ci-vitest.sh) and grade-ci.sh both call it, so the badge
-# and the grade cannot disagree. Reads a raw Vitest log or a gh job log (gh's "job<TAB>step<TAB>timestamp "
-# prefix and ANSI styling — the raw ESC byte and gh's `^[` rendering of it — are stripped) and prints ONE line:
-#   VITEST_LOG verdict=<CLEAN|RPC_ONLY|RED|INFRA_KILLED> reason=<why> summaries=S passed=P skipped=K failed=F
-#     timedout=T unhandled=U runner_rpc_timeouts=R coverage_misses=C signals=G terminal_errors=E runner_kills=X
-# unhandled counts the unhandled errors that are NOT runner RPC timeouts. Exit 0 CLEAN or RPC_ONLY, 1 RED,
-# 3 INFRA_KILLED.
-#
-# INFRA_KILLED (D-897): the GitHub runner's own shutdown or cancellation annotation ("##[error]The runner
-# has received a shutdown signal…" / "##[error]The operation was canceled.") with no failed or timed-out
-# test and no coverage-threshold miss. It is never green and never passes a gate — the proof was not
-# finished — but it is not a test red either. Those failures dominate a kill (RED); a kill excuses only
-# the cut-off or short log it leaves behind (runner_kills counts the annotations either way). A failure
-# the reporter already printed before the kill cut its summary off counts too: a dot-reporter "x" (its
-# stream has no newline, so a test's "stdout | …"/"stderr | …" header may finish the same line), a
-# default-reporter "×" or failed module record "❯ file (N tests…)" (❯ marks a failed module even with
-# no failed test — a collect or hook error), a " FAIL " badge or the "Failed Tests/Suites N" banner (only
-# beside a kill — without one, the complete summaries' own counts decide). Only one printed after the last
-# complete summary counts: a complete summary's own counts settle every line before it. Test output never
-# counts: a console block runs from its header until the reporter speaks again — a dot run, a ⎯ banner or
-# a default-reporter module record (✓/❯/↓ file (N tests…)) right after a blank line, or the next summary —
-# so blank lines inside a test's output do not end it.
-# ponytail: a test that prints, after a blank line of its own, a line the reporter could have printed is
-# indistinguishable from the reporter; only that deliberate forgery escapes the block.
-#
-# The declared contract (D-893), when a caller supplies one: expected-files is the number of test files
-# the run must collect — the summaries' "(N)" totals must sum to it exactly. The caller derives it from
-# the declared projects' own candidate-tree discovery, so a never-started declared project is a short
-# count: project presence comes from that discovery, never from log text a test can print. A short count
-# is RED reason=partial: a complete summary of the projects that happened to start proves nothing about
-# the one that did not. With or without a contract, a summary whose finished files (failed + passed +
-# skipped + todo) fall short of its own "(N)" is RED reason=partial too: Vitest's total counts the queued
-# and running files an abort left unfinished.
-#
-# RED unless every Vitest summary is complete (Test Files, Tests and Duration lines, and every
-# "Unhandled Errors" block closed by the summary that follows it — a cut-off log is RED), with no
-# failed file or test, no timed-out test or hook, no coverage-threshold ERROR, no npm signal line,
-# no unhandled error other than a vitest-worker RPC timeout, and no terminal error: a structural
-# "Unhandled Error", "Startup Error" or "Collect Error" banner outside Vitest's counted block — how
-# Vitest reports an exception thrown after the summary, such as a coverage-reporting failure, before it
-# exits 1 (terminal_errors counts them; an RPC timeout never offsets one). RPC_ONLY means unhandled
-# errors were present and EVERY one is such a timeout (OBS-1058: the starved 2-core runner talking,
-# not a test).
-#
-# Which timeouts count: only one that is ITSELF an unhandled entry — the first payload line under a
-# per-error header, nothing later. The header is Vitest's own structural line — a run of ⎯ on each side
-# of "Unhandled Error", nothing else on the line — so prose that merely contains the words never opens
-# a window, and the payload must be Vitest's whole line (`Error: [vitest-worker]: Timeout calling
-# "<method>"`), so an assertion quoting it stays RED. Per-error headers are honoured only inside
-# Vitest's own block — after its structural "Unhandled Errors" line and "Vitest caught N" tally, until
-# the file summary — and each block's count never exceeds its N, so a test that prints a header and a
-# timeout to stdout forges nothing. The tallies must also sum to the summaries' own "Errors N" lines
-# (Vitest prints both from one list), so a forged or a missing block is RED as well.
-set -u
-
-log=${1:?log path required}
-fields='summaries=0 passed=0 skipped=0 failed=0 timedout=0 unhandled=0 runner_rpc_timeouts=0 coverage_misses=0 signals=0 terminal_errors=0 runner_kills=0'
-if [ ! -s "$log" ] || [ ! -r "$log" ]; then
-  echo "VITEST_LOG verdict=RED reason=unreadable $fields"
-  exit 1
-fi
-
-esc=$(printf '\033')
-awk -v esc="$esc" -v expected="${2:-}" '
-  function num(s, word) { return match(s, "[0-9]+ " word) ? substr(s, RSTART, RLENGTH) + 0 : 0 }
-  function close_block() { rpc += (found < cap ? found : cap); armed = 0; pending = 0 }
-  {
-    line = $0
-    gsub(/\^\[\[[0-9;]*m/, "", line); gsub(esc "\\[[0-9;]*m", "", line)
-    sub(/^[^\t]*\t[^\t]*\t[0-9T:.-]+Z[ ]?/, "", line)
-    if (line ~ /^[ \t]*(·|x|\*|-)*(stdout|stderr) \| /) {
-      if (line ~ /^[ \t]*(·|\*|-)*x/) reported++
-      console = 1
-    } else if (after_blank && line ~ /^[ \t]*((·|x|\*|-)*(·|x)(·|x|\*|-)*|(⎯)+( .* (⎯)+)?|(✓|❯|↓) .* [(][0-9]+ tests?( [|] [0-9]+ (failed|skipped))*[)].*)[ \t]*$/) console = 0
-    if (!console && line ~ /^[ \t]*((·|\*|-)*x(·|x|\*|-)*|× .*|❯ .* [(][0-9]+ tests?( [|] [0-9]+ (failed|skipped))*[)].*|FAIL[ \t].*|(⎯)+ Failed (Tests|Suites) [0-9]+ (⎯)+)[ \t]*$/) reported++
-    after_blank = line !~ /[^ \t]/
-  }
-  line ~ /^##\[error\](The runner has received a shutdown signal|The operation was cancell?ed)/ { kills++ }
-  # The Vitest timeout message carries its millisecond count; a test that PRINTS a fingerprint normalized
-  # to #ms (the daemon OBS-1106 notifications) is output, not a timed-out test. A real timeout also fails
-  # its test, so the summary failed count still reds it.
-  line ~ /(Test|Hook) timed out in [0-9]+ ?ms/ { timedout++ }
-  line ~ /ERROR: Coverage for .* does not meet .*threshold/ { coverage++ }
-  line ~ /^npm (error|ERR!) signal / { signals++ }
-  line ~ /^(⎯)+ Unhandled Errors (⎯)+[ \t]*$/ { if (armed) close_block(); opening = 1; next }
-  opening && line !~ /[^ \t]/ { next }
-  opening {
-    opening = 0
-    if (line ~ /^Vitest caught [0-9]+ unhandled error/) { armed = 1; found = 0; cap = num(line, "unhandled"); tally += cap }
-    else untallied++
-  }
-  line ~ /^[ \t]*Test Files[ \t]/ {
-    if (armed) close_block()
-    summaries++; in_summary = 1; saw_tests = 0; console = 0
-    failed += num(line, "failed"); passed += num(line, "passed"); skipped += num(line, "skipped")
-    finished = num(line, "failed") + num(line, "passed") + num(line, "skipped") + num(line, "todo")
-    total = match(line, /\([0-9]+\)[ \t]*$/) ? substr(line, RSTART + 1) + 0 : -1
-    if (total >= 0) collected += total
-    if (finished != total) unfinished++
-    next
-  }
-  in_summary && line ~ /^[ \t]*Tests[ \t]/ { saw_tests = 1; failed_tests += num(line, "failed"); next }
-  in_summary && line ~ /^[ \t]*Errors[ \t]+[0-9]+ error/ { summary_errors += num(line, "error"); next }
-  in_summary && line ~ /^[ \t]*Duration[ \t]/ { if (saw_tests) { complete++; reported = 0 }; in_summary = 0; next }
-  armed && line ~ /^(⎯)+ Unhandled Error (⎯)+[ \t]*$/ { pending = 1; next }
-  line ~ /^(⎯)+ (Unhandled|Startup|Collect) Error (⎯)+[ \t]*$/ { terminal++; next }
-  pending && line ~ /[^ \t]/ { pending = 0; if (line ~ /^Error: \[vitest-worker\]: Timeout calling "[A-Za-z]+"[ \t]*$/) found++ }
-  END {
-    unhandled = tally + untallied
-    if (summary_errors > unhandled) unhandled = summary_errors
-    other = unhandled - rpc
-    partial = unfinished || (expected != "" && collected != expected + 0)
-    # a kill always names a class: the failure that dominates it, or the kill itself
-    if (kills) reason = (failed || failed_tests || reported) ? "failed" : timedout ? "timed-out" : coverage ? "coverage-threshold" : "runner-shutdown"
-    else if (summaries == 0) reason = "no-summary"
-    else if (complete != summaries || opening || armed) reason = "truncated"
-    else if (failed || failed_tests) reason = "failed"
-    else if (timedout) reason = "timed-out"
-    else if (partial) reason = "partial"
-    else if (coverage) reason = "coverage-threshold"
-    else if (signals) reason = "signal"
-    else if (terminal) reason = "terminal-error"
-    else if (other > 0) reason = "unhandled-error"
-    else if (tally + untallied != summary_errors) reason = "unhandled-mismatch"
-    verdict = reason == "runner-shutdown" ? "INFRA_KILLED" : (reason != "" ? "RED" : (unhandled > 0 ? "RPC_ONLY" : "CLEAN"))
-    if (reason == "") reason = "none"
-    printf "VITEST_LOG verdict=%s reason=%s summaries=%d passed=%d skipped=%d failed=%d timedout=%d unhandled=%d runner_rpc_timeouts=%d coverage_misses=%d signals=%d terminal_errors=%d runner_kills=%d\n", \
-      verdict, reason, summaries, passed, skipped, failed, timedout, other, rpc, coverage, signals, terminal, kills
-    exit (verdict == "INFRA_KILLED" ? 3 : verdict == "RED")
-  }
-' "$log"