tickmarkr 2.8.3 → 2.8.5

package/dist/run/git.js

@@ -3,13 +3,14 @@ import { executionSignal, withoutExecutionBudget } from "./execution-budget.js";
 import { commandLeaseEnvironment, repositoryLeaseEnvironment, registerRepositoryChild, withCommandLease } from "./lease.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { execFile, execFileSync, spawn } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmdirSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { availableParallelism, homedir, tmpdir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
+import { HOST_SESSION_VARS } from "../drivers/host-env.js";
 import { titleEnvironment } from "./title-environment.js";
 import { assertGitTrust, GitTrustRefusal, ownGitPin, protectedGitEnv, trustedCommonDir } from "./git-trust.js";
 export { ROUTING_ENV_SEAMS };
@@ -330,6 +331,9 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit)
     const env = ownGit ? protectedGitEnv(payloadEnv) : payloadEnv;
     for (const k of ROUTING_ENV_SEAMS)
         delete env[k];
+    // Queue row 193 (D-2102 add.1): no gate or agent child inherits the launching agent session's host variables.
+    for (const k of HOST_SESSION_VARS)
+        delete env[k];
     // A run freezes the operator override and cores at startup; admission can lower the round cap.
     env[FORK_CAP_ENV] = verificationBudget.getStore()
         ? String(resolvedCapacity().forkCap)
@@ -1089,19 +1093,14 @@ export async function probeRefsWritable(cwd = process.cwd()) {
         const error = (delRes.stderr || delRes.stdout).trim() || `git update-ref -d failed (${delRes.code})`;
         return { ok: false, path: refsDir, refsDir, error };
     }
-    // Clean up empty directories left behind by git
-    try {
-        const preflightDir = join(refsDir, "tickmarkr", "preflight");
-        if (existsSync(preflightDir) && readdirSync(preflightDir).length === 0) {
-            rmSync(preflightDir, { recursive: true, force: true });
-        }
-        const tmDir = join(refsDir, "tickmarkr");
-        if (existsSync(tmDir) && readdirSync(tmDir).length === 0) {
-            rmSync(tmDir, { recursive: true, force: true });
+    // Queue row 194 (D-2102): remove only EMPTY directories git left behind, non-recursively — rmdir(2)
+    // refuses (ENOTEMPTY) a ref another process writes under refs/tickmarkr at this moment, where an
+    // emptiness check followed by a recursive remove deleted it. Best-effort: a refusal leaves the tree.
+    for (const dir of [join(refsDir, "tickmarkr", "preflight"), join(refsDir, "tickmarkr")]) {
+        try {
+            rmdirSync(dir);
         }
-    }
-    catch {
-        // best-effort cleanup of empty dirs
+        catch { /* absent, or no longer empty */ }
     }
     return { ok: true, path: refsDir, refsDir };
 }

package/dist/run/journal.js

@@ -1,7 +1,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmdirSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { channelKey, shq, TokenUsageSchema } from "../adapters/types.js";
@@ -11,7 +11,7 @@ import { channelRouteIdentity, modelProvider } from "../route/preference.js";
 import { buildProfile, classify } from "../route/profile.js";
 import { DecisionEventSchema, trackJournalRows, } from "./protocol.js";
 import { PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER } from "./git.js";
-import { assertGitTrust, protectedGitEnv } from "./git-trust.js";
+import { assertGitTrust, protectedGitEnv, trustedCommonDir } from "./git-trust.js";
 import { normalizeGateOutcome } from "./outcome.js";
 import { redactSecrets } from "./redact.js";
 export function phaseForGate(gate) {
@@ -1651,30 +1651,59 @@ export function engagementComparable(events, loadedHash) {
     return recorded === loadedHash ? { comparable: true, recorded } : { comparable: false, reason: "mismatch", recorded };
 }
 const RUN_SEQUENCE_WIDTH = 16;
+const TICKET = /^\d{16}$/;
+const ticketsIn = (dir) => {
+    try {
+        return readdirSync(dir).filter((name) => TICKET.test(name));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+};
+const highest = (tickets) => tickets.reduce((max, name) => (BigInt(name) > max ? BigInt(name) : max), 0n);
 // The daemon mints before acquiring graph.lock, and each CLI invocation has fresh module state. Claim
-// a repository-state ticket with mkdir's atomic EEXIST boundary instead: a losing process advances and
-// retries, while the winning directory remains as the durable high-water evidence for later invocations.
+// a ticket with mkdir's atomic EEXIST boundary: a losing process advances and retries. Queue row 194
+// (D-2102): the sequence lives at the trusted common git dir, shared by the main checkout and every
+// linked worktree (a trust refusal refuses — never a per-checkout fallback), and its first ticket sits
+// above this checkout's own pre-change sequence. Pruning keeps it bounded, and the durable high-water
+// mark is the highest ticket itself: a prune removes a ticket only after seeing a higher one, so the
+// highest ever claimed survives. A stale reader can recreate a pruned ticket, but then sees that higher
+// one and claims again above it — only a ticket that is the highest after its own mkdir is issued.
 function claimRunSequence(repoRoot = process.cwd()) {
-    const dir = join(tickmarkrDir(repoRoot), "run-id-sequence");
+    const dir = join(trustedCommonDir(repoRoot), "tickmarkr-run-id-sequence");
     mkdirSync(dir, { recursive: true });
-    const allocated = readdirSync(dir).filter((name) => /^\d{16}$/.test(name));
-    let candidate = allocated.reduce((max, name) => {
-        const value = BigInt(name);
-        return value > max ? value : max;
-    }, 0n) + 1n;
+    const own = highest(ticketsIn(join(repoRoot, stateDirName(repoRoot), "run-id-sequence")));
+    const shared = highest(ticketsIn(dir));
+    let candidate = (own > shared ? own : shared) + 1n;
     while (true) {
         const suffix = candidate.toString().padStart(RUN_SEQUENCE_WIDTH, "0");
         if (suffix.length > RUN_SEQUENCE_WIDTH)
             throw new Error("run id sequence exhausted");
         try {
             mkdirSync(join(dir, suffix));
-            return suffix;
         }
         catch (error) {
             if (error.code !== "EEXIST")
                 throw error;
             candidate += 1n;
+            continue;
+        }
+        const tickets = ticketsIn(dir);
+        const top = highest(tickets);
+        if (top > candidate) {
+            candidate = top + 1n;
+            continue;
+        }
+        for (const name of tickets) {
+            if (BigInt(name) < candidate)
+                try {
+                    rmdirSync(join(dir, name));
+                }
+                catch { /* a concurrent prune took it */ }
         }
+        return suffix;
     }
 }
 export function newRunId(now = new Date()) {

package/dist/run/lock.d.ts

@@ -3,6 +3,8 @@ export declare const STALE_MS = 60000;
 export interface Inspection {
     pid?: number;
     runId?: string;
+    startedAt?: number;
+    checkout?: string;
     garbage: boolean;
     dead: boolean;
     expired: boolean;
@@ -15,6 +17,9 @@ export type RunLineEvent = {
 };
 export declare function shouldRefuse(i: Pick<Inspection, "garbage" | "dead">): boolean;
 export declare function isPidLive(pid: number): boolean;
+/** The repository run claim for the checkout enclosing `repoRoot`; undefined when no checkout encloses it
+ * (graph.lock alone guards there, as before). Any other git trust refusal propagates: fail closed. */
+export declare function repositoryClaimPath(repoRoot: string): string | undefined;
 export declare function acquireRunLock(repoRoot: string, runId: string): {
     reclaimed?: {
         pid: number;

package/dist/run/lock.js

@@ -1,7 +1,8 @@
-import { closeSync, constants, fstatSync, linkSync, lstatSync, mkdtempSync, openSync, readFileSync, renameSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { closeSync, constants, fstatSync, linkSync, lstatSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
 import { z } from "zod";
 import { tickmarkrDir, stateDirName } from "../graph/graph.js";
+import { GitTrustRefusal, trustedCommonDir } from "./git-trust.js";
 import { parseRunId } from "./journal.js";
 // HARD-01/02: coarse per-run advisory lock over .tickmarkr/graph.json. LOCK-02: the lock is created by
 // the link(2) idiom — write the full payload to graph.lock.<pid>.tmp, then linkSync(tmp, lockPath),
@@ -17,16 +18,31 @@ export const STALE_MS = 60_000; // 6× heartbeat headroom; PITFALLS floor is ≥
 // T-10-01: the payload is a trust boundary — parse with zod, fail closed on garbage. Only
 // pid/runId/startedAt are ever read; anything else is ignored (info-disclosure surface).
 const PayloadSchema = z.object({ pid: z.number().int().positive(), runId: z.string(), startedAt: z.number() });
+// Queue row 194 (D-2102): graph.lock lives per CHECKOUT, so a run in a linked worktree (Claude Desktop
+// nests each session under <repo>/.claude/worktrees/) never saw a run in the main checkout. The daemon's
+// acquire therefore also takes this REPOSITORY RUN CLAIM at the trusted common git dir — the runner
+// lease's anchor — by the same link(2) idiom and the same decision table (shouldRefuse). compile's two
+// holders take graph.lock only: it guards that checkout's own graph, never the repository's run.
+const ClaimSchema = PayloadSchema.extend({ checkout: z.string() });
+const MarkerSchema = z.object({ pid: z.number().int().positive(), startedAt: z.number() });
+const CLAIM_FILE = "tickmarkr-run.claim";
+const COMPILE_HOLDERS = new Set(["compile", "compile-refusal"]);
+const NO_CHECKOUT = "no checkout encloses this directory"; // git-trust's refusal detail outside any checkout
 const lockPath = (repoRoot) => join(tickmarkrDir(repoRoot), "graph.lock");
 const approvalSerializationPath = (repoRoot) => join(tickmarkrDir(repoRoot), "approval.lock");
 let heartbeat;
 let heldPath;
+const heldClaims = new Map(); // graph.lock path → its repository claim
 let approvalSequence = 0;
 // Best-effort release if the daemon exits without hitting its finally (crash mid-body). NO
 // SIGINT/SIGTERM handlers — those change kill semantics and leak listeners across the test
 // suite's many runDaemon calls; signal-death is exactly what stale-reclaim exists for.
-process.once("exit", () => { if (heldPath)
-    unlinkIfOurs(heldPath); });
+process.once("exit", () => {
+    for (const claim of heldClaims.values())
+        unlinkClaimIfOurs(claim);
+    if (heldPath)
+        unlinkIfOurs(heldPath);
+});
 // LOCK-04: the ONE decision table. Both acquireRunLock and isRunLockLive consume this — the two
 // hand-maintained copies of the rule cannot drift. The table changes HERE, once. previewUnlock /
 // commitUnlock (below) read the SAME underlying snapshot shape with their own eligibility rules
@@ -65,16 +81,17 @@ export function isPidLive(pid) {
     }
 }
 // statSync throws ENOENT when no lock exists — callers treat that as "not held".
-function inspect(p) {
+function inspect(p, schema = PayloadSchema) {
     const st = statSync(p); // single stat: both the heartbeat mtime and the reclaim-guard inode
     const mtimeMs = st.mtimeMs;
     const expired = Date.now() - mtimeMs > STALE_MS;
-    const parsed = PayloadSchema.safeParse(readPayload(p));
+    const parsed = schema.safeParse(readPayload(p));
     const garbage = !parsed.success; // LOCK-01: its own state — shouldRefuse refuses it unconditionally; only `tickmarkr unlock` removes it
     const pid = parsed.success ? parsed.data.pid : undefined;
     // harmless fallback for the garbage row — garbage short-circuits shouldRefuse before this is read
     const dead = pid === undefined ? true : !isPidLive(pid);
-    return { pid, runId: parsed.success ? parsed.data.runId : undefined, garbage, dead, expired, mtimeMs, ino: st.ino };
+    const checkout = parsed.success ? parsed.data.checkout : undefined;
+    return { pid, runId: parsed.success ? parsed.data.runId : undefined, startedAt: parsed.success ? parsed.data.startedAt : undefined, checkout, garbage, dead, expired, mtimeMs, ino: st.ino };
 }
 function readPayload(p) {
     try {
@@ -92,7 +109,177 @@ function unlinkIfOurs(p) {
     }
     catch { /* ENOENT — nothing to release */ }
 }
+function unlinkClaimIfOurs(claim) {
+    try {
+        const parsed = ClaimSchema.safeParse(readPayload(claim.path));
+        if (parsed.success && parsed.data.pid === process.pid && parsed.data.checkout === claim.checkout)
+            unlinkSync(claim.path);
+    }
+    catch { /* ENOENT — nothing to release */ }
+}
+/** The repository run claim for the checkout enclosing `repoRoot`; undefined when no checkout encloses it
+ * (graph.lock alone guards there, as before). Any other git trust refusal propagates: fail closed. */
+export function repositoryClaimPath(repoRoot) {
+    try {
+        return join(trustedCommonDir(repoRoot), CLAIM_FILE);
+    }
+    catch (e) {
+        if (e instanceof GitTrustRefusal && e.detail === NO_CHECKOUT)
+            return undefined;
+        throw e;
+    }
+}
+// The case table: a live holder from ANY other checkout of this repository refuses naming its checkout,
+// run id and pid; a provably dead holder is reclaimed, then the taker re-serializes through link(2);
+// garbage refuses and is removed by hand only. A holder in another repository never meets this path: its
+// common dir — and so its claim — differs.
+function takeRepositoryClaim(repoRoot, runId) {
+    const p = repositoryClaimPath(repoRoot);
+    if (!p)
+        return;
+    const checkout = realpathSync(repoRoot);
+    while (!linkExclusive(p, { pid: process.pid, runId, startedAt: Date.now(), checkout })) {
+        const held = readClaim(p);
+        if (!held)
+            continue; // released between our link and our read
+        if (shouldRefuse(held.insp))
+            refuseClaim(p, held.insp);
+        reclaimDeadClaim(p, held.id);
+    }
+    heldClaims.set(lockPath(repoRoot), { path: p, checkout });
+    // While this live claim is the claim, every reclaim marker is keyed to a claim gone for good — moot,
+    // guarding nothing — so the taker sweeps them all; a reclaimer that died holding one strands nothing.
+    const prefix = `${basename(p)}.reclaim.`;
+    try {
+        for (const name of readdirSync(dirname(p)))
+            if (name.startsWith(prefix))
+                try {
+                    unlinkSync(join(dirname(p), name));
+                }
+                catch { /* another taker swept it */ }
+    }
+    catch { /* best-effort: a later taker sweeps what is left */ }
+}
+// link(2) exclusive create of a complete payload: true when created, false when `p` already exists.
+function linkExclusive(p, payload) {
+    const tmp = join(dirname(p), `${CLAIM_FILE}.${process.pid}.tmp`); // one per process: the claim and its markers share it
+    try {
+        unlinkSync(tmp);
+    }
+    catch { /* best-effort clean of our own stray tmp from a prior SIGKILL */ }
+    writeFileSync(tmp, JSON.stringify(payload));
+    try {
+        linkSync(tmp, p);
+        return true;
+    }
+    catch (e) {
+        if (e.code === "EEXIST")
+            return false;
+        throw e;
+    }
+    finally {
+        unlinkSync(tmp);
+    }
+}
+// A claim's identity is its inode, pid and start time: a claim is never rewritten in place, so an identity
+// once replaced never returns. undefined when no claim exists.
+function readClaim(p) {
+    try {
+        const insp = inspect(p, ClaimSchema);
+        return { insp, id: `${insp.ino}-${insp.pid}-${insp.startedAt}` };
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return undefined;
+        throw e;
+    }
+}
+// The reclaim runs under an exclusive RECLAIM MARKER beside the claim, keyed to the dead claim's identity:
+// two takers that both saw one dead claim could otherwise each pass a re-stat, and the later unlink would
+// delete the earlier taker's live replacement. Under the marker the claim is re-read, and only that same
+// dead claim is removed. A live marker owner refuses the other taker — a concurrent reclaimer is a run
+// starting in this repository. A marker whose owner died inside the reclaim is STRANDED: the next taker
+// passes to the next generation, which only one taker creates — a dead owner never removes its marker, so
+// two live owners never hold one identity at once — and recovers with no hand removal.
+// ponytail: a stranded marker whose dead pid is reused by an unrelated live process reads live and refuses
+// until the next successful taker sweeps it or it is removed by hand — the fail-closed direction, as graph.lock.
+function reclaimDeadClaim(p, id) {
+    let marker = `${p}.reclaim.${id}.0`;
+    for (let gen = 0; !linkExclusive(marker, { pid: process.pid, startedAt: Date.now() });) {
+        if (markerStranded(p, marker))
+            marker = `${p}.reclaim.${id}.${++gen}`;
+    }
+    try {
+        const now = readClaim(p);
+        if (now?.id !== id)
+            return; // replaced since our read: the caller re-serializes through link(2)
+        if (shouldRefuse(now.insp))
+            refuseClaim(p, now.insp);
+        try {
+            unlinkSync(p);
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e;
+        }
+    }
+    finally {
+        try {
+            unlinkSync(marker);
+        }
+        catch { /* swept as moot by the claim's next taker */ }
+    }
+}
+// true when `marker`'s owner provably died holding it: dead, and the same bytes on the same inode after the
+// death proof. false when it went or changed under the read (that generation is retried). A live owner
+// refuses; a garbage marker refuses for removal by hand.
+function markerStranded(p, marker) {
+    const read = () => {
+        try {
+            return { ino: statSync(marker).ino, bytes: readFileSync(marker, "utf8") };
+        }
+        catch (e) {
+            if (e.code === "ENOENT")
+                return undefined;
+            throw e;
+        }
+    };
+    const before = read();
+    if (!before)
+        return false;
+    let owner;
+    try {
+        owner = MarkerSchema.parse(JSON.parse(before.bytes));
+    }
+    catch {
+        throw new Error(`reclaim marker ${marker} holds an unreadable/garbage payload — refusing to reclaim repository run claim ${p}; once no tickmarkr run is starting in this repository, remove ${marker} by hand`);
+    }
+    if (isPidLive(owner.pid))
+        throw new Error(`repository run claim ${p} is being reclaimed from its dead holder by another tickmarkr process (pid ${owner.pid}) — retry; if none is starting in this repository, remove ${marker} by hand`);
+    const after = read();
+    return after !== undefined && after.ino === before.ino && after.bytes === before.bytes;
+}
+function refuseClaim(p, insp) {
+    if (insp.garbage)
+        throw new Error(`repository run claim ${p} holds an unreadable/garbage payload — refusing to reclaim it; once no tickmarkr run is live in this repository, remove ${p} by hand`);
+    throw new Error(`repository run claim ${p} held by pid ${insp.pid} (run ${insp.runId}) in checkout ${insp.checkout} — one live tickmarkr run per repository across its main checkout and linked worktrees; wait for that run to end`);
+}
+// Run and resume (runDaemon) take graph.lock, then the repository claim; a claim refusal releases the
+// graph.lock just taken, before any journal exists. compile's holders take graph.lock alone.
 export function acquireRunLock(repoRoot, runId) {
+    const acquired = acquireGraphLock(repoRoot, runId);
+    if (COMPILE_HOLDERS.has(runId))
+        return acquired;
+    try {
+        takeRepositoryClaim(repoRoot, runId);
+    }
+    catch (e) {
+        releaseRunLock(repoRoot);
+        throw e;
+    }
+    return acquired;
+}
+function acquireGraphLock(repoRoot, runId) {
     const p = lockPath(repoRoot);
     const tmp = join(tickmarkrDir(repoRoot), `graph.lock.${process.pid}.tmp`);
     try {
@@ -127,7 +314,7 @@ export function acquireRunLock(repoRoot, runId) {
             // Single-machine tool — this is the ceiling.
             const st = statSync(p); // re-stat immediately before removing — abort if replaced since inspect()
             if (st.ino !== insp.ino || st.mtimeMs !== insp.mtimeMs)
-                return acquireRunLock(repoRoot, runId); // loser path
+                return acquireGraphLock(repoRoot, runId); // loser path
             try {
                 unlinkSync(p);
             }
@@ -135,7 +322,7 @@ export function acquireRunLock(repoRoot, runId) {
                 if (e2.code !== "ENOENT")
                     throw e2;
             } // successor already took it
-            const again = acquireRunLock(repoRoot, runId); // re-serializes two stealers through linkSync
+            const again = acquireGraphLock(repoRoot, runId); // re-serializes two stealers through linkSync
             return { reclaimed: { pid: pid ?? -1, mtimeMs }, ...again };
         }
         const stateDir = stateDirName(repoRoot);
@@ -151,6 +338,12 @@ export function releaseRunLock(repoRoot) {
         clearInterval(heartbeat);
         heartbeat = undefined;
     }
+    // the claim goes first: released after graph.lock, a successor run in this checkout would meet our claim
+    const claim = heldClaims.get(lockPath(repoRoot));
+    if (claim) {
+        unlinkClaimIfOurs(claim);
+        heldClaims.delete(lockPath(repoRoot));
+    }
     unlinkIfOurs(lockPath(repoRoot)); // never delete a reclaiming successor's lock — only ours
     heldPath = undefined;
 }

package/dist/run/protocol.d.ts

@@ -75,8 +75,8 @@ export declare const GateEvidenceReceiptSchema: z.ZodObject<{
     termination: z.ZodObject<{
         kind: z.ZodEnum<{
             unknown: "unknown";
-            timeout: "timeout";
             signal: "signal";
+            timeout: "timeout";
             "not-started": "not-started";
             exit: "exit";
         }>;

package/dist/tui/cockpit/live-store.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { closeSync, fstatSync, openSync, readSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { graphPath, stateDirName } from "../../graph/graph.js";
+import { repoOverlayPath } from "../../config/config.js";
 import { validateGraph } from "../../graph/schema.js";
 import { foldOwedChecks, parseJournalText, parseRunId } from "../../run/journal.js";
 import { isPidLive, STALE_MS } from "../../run/lock.js";
@@ -329,7 +330,16 @@ export function createLiveStore(options) {
         reset: () => { fold = new OperatorStateFold(); }, record: record => fold.apply(record),
     });
     const graph = new JsonSource(graphPath(options.cwd), raw => validateGraph(JSON.parse(raw)), STORE_LIMITS.graphBytes);
-    const config = new JsonSource(options.configPath ?? join(state, "config.yaml"), raw => raw);
+    // Queue row 195 / D-2102: the cockpit's live config source follows the ONE repo-layer path rule, re-resolved
+    // on every observation so an own overlay created or removed, or a main file
+    // appearing, moves the source; an explicit configPath stays fixed.
+    let config;
+    const readConfig = (at) => {
+        const path = options.configPath ?? repoOverlayPath(options.cwd);
+        if (config?.path !== path)
+            config = new JsonSource(path, raw => raw);
+        return config.read(at);
+    };
     const cache = new JsonSource(options.cachePath ?? join(state, "doctor.json"), JSON.parse);
     const lock = new JsonSource(join(state, "graph.lock"), raw => {
         const v = JSON.parse(raw);
@@ -379,7 +389,7 @@ export function createLiveStore(options) {
             owed = owedOf(journal);
         }
         const graphReading = graph.read(observedAt);
-        const configReading = config.read(observedAt);
+        const configReading = readConfig(observedAt);
         const cacheReading = cache.read(observedAt);
         const owner = lock.read(observedAt);
         const alive = owner.status === "readable" && owner.value ? (options.isDaemonAlive ?? isPidLive)(owner.value.pid) : undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.8.3",
+  "version": "2.8.5",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",