tickmarkr 2.8.5 → 2.8.7

package/dist/cli/commands/init.js

@@ -1,4 +1,3 @@
-import { execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -11,7 +10,8 @@ import { LEGACY_PREFIX, specTemplate } from "../../compile/native.js";
 import { BANNER, kvRow, legend, rule, statusRow, title } from "../../brand.js";
 import { stateDirName, tickmarkrDir } from "../../graph/graph.js";
 import { orcaHostDetected } from "../../drivers/index.js";
-import { WORKTREES_DIR } from "../../run/git.js";
+import { gitSync, WORKTREES_DIR } from "../../run/git.js";
+import { GitTrustRefusal } from "../../run/git-trust.js";
 import { Journal } from "../../run/journal.js";
 import { runLockOwner, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { doctor } from "./doctor.js";
@@ -107,7 +107,11 @@ Outside multi-agent environments, run the loop directly.
 
 ### Version preflight
 
-Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version\`, read \`package.json\` version, and stop if the versions differ anywhere (major, minor, or patch); the binary and repository must agree on the entire version, so binary \`2.1.0\` versus repository \`2.1.1\` is a stop. Tell the operator to update or link the correct binary. Never proceed on hope — stale binaries silently skip daemon gates. Also verify no run is live in this repository before starting one: lead with this repository's \`.tickmarkr/graph.lock\`, read its holder pid, and treat it as live until \`kill -0 <pid>\` proves that holder dead. Never require a machine-wide process pattern to be empty: a lawful run in another repository — or the probing shell's own argv — can match. If you use a process probe as secondary evidence, exclude the probing process, resolve every candidate's own cwd (for example with \`lsof -a -p <pid> -d cwd\`), and count only candidates whose cwd is this repository root.
+Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version --check\` and stop on a non-zero exit. In the tickmarkr source repository (\`package.json\` named \`tickmarkr\`), stop if the versions differ anywhere (major, minor, or patch); the binary and repository must agree on the entire version, so binary \`2.1.0\` versus repository \`2.1.1\` is a stop. In a consumer repository, the check compares installed agent guidance with this binary's packaged block and skills, never the app's manifest version; refresh drifted guidance with \`tickmarkr init --agent --force\`. Tell the operator to update or link the correct binary when the source version differs. Never proceed on hope — stale binaries silently skip daemon gates. Also verify no run is live in this repository before starting one: lead with this repository's \`.tickmarkr/graph.lock\`, read its holder pid, and treat it as live until \`kill -0 <pid>\` proves that holder dead. Never require a machine-wide process pattern to be empty: a lawful run in another repository — or the probing shell's own argv — can match. If you use a process probe as secondary evidence, exclude the probing process, resolve every candidate's own cwd (for example with \`lsof -a -p <pid> -d cwd\`), and count only candidates whose cwd is this repository root.
+
+### Seat hygiene
+
+In a multi-tier session, the tiers clear each other at 50% context or more, after writing a handoff. A new spec or run is a mission boundary: write the handoff and clear before taking the next mission. Copy this duty into every brief and handoff. On a single-tier plain host, write your handoff and ask the operator to clear the session.
 
 ### Tip-verify-before-green
 
@@ -184,7 +188,7 @@ function skillFileList(root, prefix = "") {
 }
 // Drift is only computed for skills that ARE installed. A skill never installed is not drift — `--agent`
 // installs it and says so, and nagging about it would bury the case this exists for.
-function skillDrift(cwd) {
+export function skillDrift(cwd) {
     const drifted = [];
     for (const { skillsDir } of hostTargets(cwd)) {
         for (const skill of AGENT_SKILLS) {
@@ -215,7 +219,7 @@ function skillDrift(cwd) {
 // superseded preflight rules (patch-version drift tolerated, a machine-wide process match required)
 // through the very release that fixed the tracked copy, and a consultation was launched under the stale
 // text with nobody able to see it. Same rule as skillDrift: a doc that was never written is not drift.
-const docsDrift = (cwd) => hostTargets(cwd).map(({ docPath }) => docPath).filter((docPath) => {
+export const docsDrift = (cwd) => hostTargets(cwd).map(({ docPath }) => docPath).filter((docPath) => {
     if (!existsSync(docPath))
         return false;
     const current = readFileSync(docPath, "utf8");
@@ -227,6 +231,12 @@ const docsDrift = (cwd) => hostTargets(cwd).map(({ docPath }) => docPath).filter
         return true; // a truncated block is stale by definition
     return current.slice(begin, end + DOCS_END.length) !== AGENT_DOCS.trimEnd();
 });
+export function installedAgentGuidance(cwd) {
+    return hostTargets(cwd).flatMap(({ skillsDir, docPath }) => [
+        ...AGENT_SKILLS.map((skill) => join(skillsDir, skill, "SKILL.md")).filter((path) => existsSync(path)),
+        ...(existsSync(docPath) && readFileSync(docPath, "utf8").includes(DOCS_BEGIN) ? [docPath] : []),
+    ]);
+}
 const describeDrift = (d) => [
     d.missing.length ? `missing ${d.missing.join(", ")}` : "",
     d.modified.length ? `modified ${d.modified.join(", ")}` : "",
@@ -256,13 +266,8 @@ function gitTracked(cwd, path) {
     const rel = relative(cwd, path);
     if (rel.startsWith(".."))
         return false;
-    try {
-        execFileSync("git", ["ls-files", "--error-unmatch", "--", rel], { cwd, stdio: "ignore" });
-        return true;
-    }
-    catch {
-        return false;
-    }
+    // queue row 2 item b: protected git; a trust refusal throws, an ordinary failure still reads as untracked
+    return gitSync(cwd, ["ls-files", "--error-unmatch", "--", rel]).status === 0;
 }
 async function installAgentFiles(cwd, force, docs, notes) {
     const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
@@ -375,19 +380,29 @@ function isPathInside(parentDir, candidatePath) {
 }
 /**
  * The ONLY way the --remove path runs git: GIT_DIR, GIT_WORK_TREE and GIT_COMMON_DIR are stripped so the repository acted on
- * is always cwd's own, and LC_ALL=C keeps stderr parseable. Throws execFileSync's error (status, stderr) unchanged.
+ * is always cwd's own, and LC_ALL=C keeps stderr parseable. Queue row 2 item b: it runs through the protected path (gitSync),
+ * whose GitTrustRefusal propagates unchanged; a failed git throws an error carrying its status and stderr.
  */
 function removeGit(cwd, args) {
     const { GIT_DIR: _dir, GIT_WORK_TREE: _workTree, GIT_COMMON_DIR: _commonDir, ...env } = process.env;
-    return execFileSync("git", args, { cwd, env: { ...env, LC_ALL: "C" }, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    const r = gitSync(cwd, args, { env: { ...env, LC_ALL: "C" } });
+    if (r.error)
+        throw r.error;
+    if (r.status !== 0)
+        throw Object.assign(new Error(`git ${args.join(" ")} failed (${r.status ?? r.signal})`), { status: r.status, stderr: r.stderr });
+    return r.stdout;
 }
+/** A trust refusal is never one of the --remove path's fail-open answers. */
+const rethrowRefusal = (error) => { if (error instanceof GitTrustRefusal)
+    throw error; };
 function isLinkedWorktree(cwd) {
     try {
         const gitDir = removeGit(cwd, ["rev-parse", "--git-dir"]).trim();
         const gitCommonDir = removeGit(cwd, ["rev-parse", "--git-common-dir"]).trim();
         return resolve(cwd, gitDir) !== resolve(cwd, gitCommonDir);
     }
-    catch {
+    catch (error) {
+        rethrowRefusal(error);
         return false;
     }
 }
@@ -405,7 +420,8 @@ function checkLiveLock(cwd) {
                 return mainOwner;
         }
     }
-    catch {
+    catch (error) {
+        rethrowRefusal(error);
         // not a git repo
     }
     return undefined;
@@ -420,6 +436,7 @@ function isGitRepo(cwd) {
         return true;
     }
     catch (err) {
+        rethrowRefusal(err);
         const e = err;
         const stderr = String(e.stderr ?? "").trim();
         if (e.status === 128 && stderr.startsWith("fatal: not a git repository (or any of the parent directories)"))
@@ -433,6 +450,7 @@ function git(cwd, args, message) {
         return removeGit(cwd, args);
     }
     catch (err) {
+        rethrowRefusal(err);
         const stderr = String(err.stderr ?? "").trim();
         throw new Error(stderr ? `${message}: ${stderr}` : message);
     }
@@ -522,16 +540,16 @@ function handleRemove(cwd) {
         const out = removeGit(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads/tickmarkr/"]);
         branches = out.split("\n").map((b) => b.trim()).filter(Boolean);
     }
-    catch {
-        // ignore
+    catch (error) {
+        rethrowRefusal(error);
     }
     let preservedRefs = [];
     try {
         const out = removeGit(cwd, ["for-each-ref", "--format=%(refname)", "refs/tickmarkr/preserved/"]);
         preservedRefs = out.split("\n").map((r) => r.trim()).filter(Boolean);
     }
-    catch {
-        // ignore
+    catch (error) {
+        rethrowRefusal(error);
     }
     for (const b of branches) {
         notes.push(`left branch: ${b}`);

package/dist/cli/commands/status.js

@@ -13,7 +13,7 @@ import { projectOperatorSummary } from "../../run/operator-summary.js";
 import { trackJournalRows } from "../../run/protocol.js";
 import { newestPark, permittedDecisionVerbs } from "./approve.js";
 import { currentOwed, endToEndFirstPass, firstPassText, leadLines, leadRows, needsYouText, wallText } from "./report.js";
-import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, fatalRunEndCause, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, visibleControls, } from "../../run/journal.js";
+import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, fatalRunEndCause, recordedTaskFailureKind, runHasEnded, restoresUpheldFeedback, visibleControls, } from "../../run/journal.js";
 import { isPidLive, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
@@ -1070,15 +1070,18 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
         }).map(sanitizeTaskText)
         : [];
     // OBS-738: recovery facts stay on the journal's two established reducers. The prefix fold keeps an
-    // older journal equally readable by asking upheldFeedbackByTask what was active at that exact
+    // older journal equally readable by asking restoresUpheldFeedback what was funded at that exact
     // restore boundary; current resume-restore rows additionally carry the same task for narration.
     // OBS-1178: both folds read decisions through the one decision fold over the whole journal.
+    // Queue row 225 (D-2111): only each task's NEWEST restore speaks — never a historical set.
     const decided = effectiveEvents(events);
     const preservedRefs = preservedRefsByTask(events);
-    const restoredUpheldFeedback = new Set(decided.flatMap((event, index) => event.event === "resume-restore" && event.taskId
-        && upheldFeedbackByTask(decided.slice(0, index)).has(event.taskId)
-        ? [event.taskId]
-        : []));
+    const newestRestores = new Map();
+    decided.forEach((event, index) => { if (event.event === "resume-restore" && event.taskId)
+        newestRestores.set(event.taskId, index); });
+    const restoredUpheldFeedback = new Set([...newestRestores]
+        .filter(([taskId, index]) => restoresUpheldFeedback(decided.slice(0, index), taskId))
+        .map(([taskId]) => taskId));
     // OBS-1178: a failed task's newest task-failed row is the token its recheck binds to. Only an
     // effective decision consumes it — a refused or unsound recheck leaves the task failed and the token shown.
     const failureTokens = new Map();

package/dist/cli/commands/version.d.ts

@@ -1,2 +1,2 @@
 export declare function distFingerprint(dir?: string): string;
-export declare function version(argv?: string[], dir?: string): Promise<string>;
+export declare function version(argv?: string[], dir?: string, cwd?: string): Promise<string>;

package/dist/cli/commands/version.js

@@ -23,7 +23,41 @@ export function distFingerprint(dir = distDir) {
         hash.update(relative(dir, file)).update("\0").update(readFileSync(file)).update("\0");
     return hash.digest("hex");
 }
-export async function version(argv = [], dir = distDir) {
+export async function version(argv = [], dir = distDir, cwd = process.cwd()) {
     const { version: v } = JSON.parse(readFileSync(pkgPath, "utf8"));
-    return argv.includes("--dist") ? `${v} dist:${resolve(dir)} fingerprint:${distFingerprint(dir)}` : v;
+    const stamp = argv.includes("--dist") ? `${v} dist:${resolve(dir)} fingerprint:${distFingerprint(dir)}` : v;
+    if (!argv.includes("--check"))
+        return stamp;
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+    }
+    catch { /* no source manifest — consumer guidance check */ }
+    if (manifest?.name === "tickmarkr") {
+        const repoVersion = manifest.version ?? "missing";
+        const equal = v === repoVersion;
+        const out = `tickmarkr binary ${stamp}: compared tickmarkr source repository package.json version ${repoVersion} — ${equal ? "entire version matches" : "versions differ; update or link the correct binary"}`;
+        if (!equal)
+            throw new Error(out);
+        return out;
+    }
+    const { docsDrift, installedAgentGuidance, skillDrift } = await import("./init.js");
+    const installed = installedAgentGuidance(cwd);
+    if (!installed.length)
+        return `tickmarkr binary ${stamp}: no installed agent guidance to compare`;
+    const drift = [
+        ...skillDrift(cwd).flatMap(({ dir: skillDir, missing, modified }) => [
+            ...missing.map((file) => `missing ${relative(cwd, join(skillDir, file))}`),
+            ...modified.map((file) => `modified ${relative(cwd, join(skillDir, file))}`),
+        ]),
+        ...docsDrift(cwd).map((file) => `stale agent-docs block in ${relative(cwd, file)}`),
+    ];
+    const out = [
+        `tickmarkr binary ${stamp}: compared installed agent guidance with this binary's packaged block and skills:`,
+        ...installed.map((file) => `  ${relative(cwd, file)}`),
+        ...(drift.length ? [...drift, "refresh: tickmarkr init --agent --force"] : ["installed guidance matches"]),
+    ].join("\n");
+    if (drift.length)
+        throw new Error(out);
+    return out;
 }

package/dist/cli/help.d.ts

@@ -195,6 +195,7 @@ export declare const COMMAND_HELP: {
         description: string;
         options: {
             "--dist": string;
+            "--check": string;
         };
         examples: string[];
     };

package/dist/cli/help.js

@@ -169,9 +169,12 @@ export const COMMAND_HELP = {
         ],
     },
     version: {
-        usage: "version [--dist]", description: "Print the installed package version. Top-level aliases: --version and -v.",
-        options: { "--dist": "Also print the resolved build directory and distribution fingerprint." },
-        examples: ["version", "version --dist"],
+        usage: "version [--dist] [--check]", description: "Print the installed package version. Top-level aliases: --version and -v.",
+        options: {
+            "--dist": "Also print the resolved build directory and distribution fingerprint.",
+            "--check": "Compare the entire source version when package.json is named tickmarkr; otherwise check installed agent guidance against this binary. Exit non-zero on drift; no installed guidance exits zero.",
+        },
+        examples: ["version", "version --dist", "version --check"],
     },
     verify: {
         usage: "verify [--base <ref>] [--criteria <file> | --task <id>] [options]",

package/dist/compile/gsd.js

@@ -1,9 +1,9 @@
-import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative } from "node:path";
 import { parse as parseYaml } from "yaml";
 import { AcceptanceItemSchema, TIERS, validateGraph } from "../graph/schema.js";
 import { CompileError, assertWriteScope, inferShape, sha256 } from "./common.js";
+import { gitSync } from "../run/git.js";
 import { classifyContextPath } from "./native.js";
 // GSD artifact front-end (spec v1.3): one GSD *plan* is one tickmarkr *task* — a plan is
 // worktree-sized; its inner <task> steps stay in the worker prompt via context[0] = the plan file.
@@ -306,9 +306,10 @@ export function compileGsd(src, root) {
     // Match native context reachability against the committed tree. This block only obtains the HEAD
     // snapshot; classifyContextPath remains the single authority for missing, untracked, and glob refs.
     const gitDir = dirname(files[0]);
-    const top = spawnSync("git", ["-C", gitDir, "rev-parse", "--show-toplevel"], { encoding: "utf8", maxBuffer: 1 << 28 });
+    // queue row 2 item b: protected git; a trust refusal throws instead of reading as "no repository"
+    const top = gitSync(gitDir, ["rev-parse", "--show-toplevel"]);
     // -z (queue row 71): without it a non-ASCII path is C-quoted and a tracked ref reads as untracked
-    const tree = spawnSync("git", ["-C", gitDir, "ls-tree", "--full-tree", "-r", "--name-only", "-z", "HEAD"], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const tree = gitSync(gitDir, ["ls-tree", "--full-tree", "-r", "--name-only", "-z", "HEAD"]);
     const repoRoot = typeof top.stdout === "string" ? top.stdout.trim() : "";
     // `root` is the repository whose worktrees will consume these refs. A source nested inside some
     // unrelated repository (as with vendored fixtures) must not be judged against that outer tree.

package/dist/compile/native.js

@@ -1,9 +1,9 @@
-import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import picomatch from "picomatch";
 import { GATE_NAMES, GRAPH_ROUTING_MODES, ORACLES, renderAcceptanceItem, SHAPES, TIERS, validateGraph, } from "../graph/schema.js";
+import { gitSync } from "../run/git.js";
 import { criterionReadsOnly } from "./collateral.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
 // OBS-170/OBS-184: `context:` is a promise to the worker, and nothing ever checked it could be kept.
@@ -18,7 +18,8 @@ import { CompileError, inferShape, sha256 } from "./common.js";
 // `ls-tree -r HEAD` enumerates that tree once; per-path `cat-file -e HEAD:<path>` is the same oracle
 // one path at a time, and one spawn beats N.
 function trackedAtHead(dir) {
-    const git = (...args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    // queue row 2 item b: every compile git runs through the protected path; a trust refusal throws, never fails open
+    const git = (...args) => gitSync(dir, args);
     const top = git("rev-parse", "--show-toplevel");
     // --full-tree is load-bearing: without it `ls-tree` scopes to the CWD's subtree and prints paths
     // relative to it, so a spec in specs/ would see only specs/-relative names and misjudge every
@@ -146,7 +147,7 @@ function symlinkScopeWarnings(file, tasks, base) {
     if (!scoped.length || !repositoryRoot(file))
         return [];
     const tree = base ?? "HEAD";
-    const git = (...args) => spawnSync("git", ["-C", dirname(file), ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const git = (...args) => gitSync(dirname(file), args);
     const failed = (r) => r.error || r.signal || r.status !== 0 || typeof r.stdout !== "string";
     const why = (r) => r.signal ? `signal ${r.signal}` : r.status === null ? "git did not run" : `git exit ${r.status}`;
     const advisory = (what, r) => `tickmarkr: advisory: files[] symlink inspection could not read ${what} in the selected git tree ${JSON.stringify(tree)} (${why(r)}) — symlink scope is unverified for this compile.`;
@@ -270,7 +271,7 @@ function testsAtHead(root) {
     const cached = headTestCache.get(root);
     if (cached)
         return cached;
-    const grep = spawnSync("git", ["-C", root, "grep", "-I", "-n", "-e", "", "HEAD", "--", "tests/*.test.ts", "tests/**/*.test.ts"], { encoding: "utf8", maxBuffer: 1 << 25 });
+    const grep = gitSync(root, ["grep", "-I", "-n", "-e", "", "HEAD", "--", "tests/*.test.ts", "tests/**/*.test.ts"]);
     if (grep.status !== 0 || typeof grep.stdout !== "string") {
         headTestCache.set(root, []);
         return [];
@@ -389,7 +390,7 @@ function criterionScopeFinding(task, text, criterion, id, tests) {
 // 20-task spec compiled in seconds and the committed-spec corpus test timed out. Fail-open like
 // testsAtHead: no git answer means no corpus, and the lint stays quiet rather than wrong.
 function repoFileList(root) {
-    const ls = spawnSync("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 1 << 25 });
+    const ls = gitSync(root, ["ls-files", "-z", "--cached", "--others", "--exclude-standard"]);
     if (ls.status !== 0 || typeof ls.stdout !== "string")
         return [];
     return ls.stdout.split("\0").filter(Boolean).sort();
@@ -949,7 +950,8 @@ acceptance is required on every task (a nested list of observable outcomes).
     mode: partner-led | risk-based | staff-led — this engagement's routing mode
           (loses only to an explicit \`run --mode\` flag)
     base: commit-or-ref — optional declared source base; the declaration must begin at column zero
-                          (runtime enforcement happens before a run)
+                          (proven against the run's starting commit at run and resume start; a drifted
+                          or unresolvable base is refused before anything is written)
 
   Fields available per task:
     goal:        outcome the task must achieve (defaults to the title if omitted)

package/dist/drivers/subprocess.js

@@ -49,7 +49,7 @@ export class SubprocessDriver {
     n = 0;
     async slot(cwd, name) {
         const id = `sp-${++this.n}`;
-        this.slots.set(id, { buf: "", exited: false });
+        this.slots.set(id, { buf: "", receivedBytes: 0, exited: false });
         return { id, name, cwd };
     }
     state(slot) {
@@ -72,8 +72,13 @@ export class SubprocessDriver {
             detached: true,
         });
         s.proc = p;
-        p.stdout.on("data", (d) => (s.buf = (s.buf + d).slice(-MAX_BUF)));
-        p.stderr.on("data", (d) => (s.buf = (s.buf + d).slice(-MAX_BUF)));
+        // Queue row 233 (D-2130): count both received streams before retention truncates the tail.
+        const receive = (d) => {
+            s.receivedBytes += d.length;
+            s.buf = (s.buf + d).slice(-MAX_BUF);
+        };
+        p.stdout.on("data", receive);
+        p.stderr.on("data", receive);
         p.on("close", () => (s.exited = true));
         p.on("error", (e) => { s.buf = (s.buf + `\n[tickmarkr subprocess error] ${e}\n`).slice(-MAX_BUF); s.exited = true; });
         // Queue row 108 (D-1622): THIS run's transport state. The slot's `exited` outlives an invocation (a reused slot) and
@@ -117,7 +122,7 @@ export class SubprocessDriver {
     async transportState(slot) {
         const s = this.state(slot);
         const run = s.invocation;
-        return { closed: run?.closed ?? false, bytes: Buffer.byteLength(s.buf), exitCode: run?.exitCode ?? null, signal: run?.signal ?? null };
+        return { closed: run?.closed ?? false, bytes: s.receivedBytes, exitCode: run?.exitCode ?? null, signal: run?.signal ?? null };
     }
     async read(slot, lines) {
         return this.state(slot).buf.split("\n").slice(-lines).join("\n");

package/dist/gates/baseline.js

@@ -1,11 +1,10 @@
 import { createHash, randomUUID } from "node:crypto";
-import { execFileSync } from "node:child_process";
 import { EVICTION_TOMBSTONE_LIMIT, EVICTION_TOMBSTONES_FILE, parseEvictionTombstones } from "../run/receipt-resolver.js";
 import { existsSync, readFileSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, rmdirSync } from "node:fs";
 import { availableParallelism, loadavg, tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { DEFAULT_EVIDENCE_QUOTA_BYTES } from "../config/config.js";
-import { dependencyLinkRefusal, DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
+import { dependencyLinkRefusal, gitSync, DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { isVitestTestCommand, manifestChildEnv, manifestFileCount } from "./test-manifest.js";
 export const EVIDENCE_TAIL_BYTES = 16 * 1024;
@@ -121,7 +120,9 @@ export function beginGateEvidence(cwd, gate, command, opts = {}, nonce) {
     let subjectCommit = opts.subjectCommit ?? null;
     if (!subjectCommit) {
         try {
-            subjectCommit = execFileSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+            const result = gitSync(cwd, ["rev-parse", "HEAD"]);
+            if (result.status === 0 && result.stdout.trim())
+                subjectCommit = result.stdout.trim();
         }
         catch { /* unknown subject */ }
     }
@@ -427,11 +428,30 @@ export function classifyFailureOutput(output) {
 // and `stderr | <task id>` (digits and underscores) when the reporter no longer knows the task
 // (dist/chunks/index.*.js, `headerText`). The stripper knew only the first form.
 const VITEST_ECHO_BLOCK_RE = /^\s*std(?:out|err)\s+\|\s+(?:unknown test\s*$|\d+_[\d_]+\s*$|\S+\.(?:test|spec)\.[cm]?[jt]sx?(?:\s*$|\s+>\s+\S))/;
-/** Keep runner output while omitting Vitest's echoed test-owned stdout/stderr diagnostic blocks. */
+// Queue row 211 (D-2118): only Jest's complete, column-zero recovery warning is noise. A missing
+// neighbour, changed hint, indented copy or multi-line Watchman error remains failure evidence.
+const JEST_WATCHMAN_HEADER = "jest-haste-map: Watchman crawl failed. Retrying once with node crawler.";
+const JEST_WATCHMAN_HINT = "  Usually this happens when watchman isn't running. Create an empty `.watchmanconfig` file in your project's root folder or initialize a git or hg repository in your project.";
+const JEST_WATCHMAN_ERROR_RE = /^ {2}Error: Watchman error: [^\r\n]+\. Make sure watchman is running for this project\. See https:\/\/facebook\.github\.io\/watchman\/docs\/troubleshooting\.$/;
+/** Queue row 211 (D-2118): display readers retain raw Vitest echo lines while dropping this warning. */
+const withoutJestWatchmanBlocks = (output) => {
+    const kept = [];
+    const lines = output.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line === JEST_WATCHMAN_HEADER && lines[i + 1] === JEST_WATCHMAN_HINT && JEST_WATCHMAN_ERROR_RE.test(lines[i + 2] ?? "")) {
+            i += 2;
+            continue;
+        }
+        kept.push(line);
+    }
+    return kept;
+};
+/** Queue row 211 (D-2118): omit the recovered Jest warning alongside Vitest's test-owned echo blocks. */
 const withoutVitestEchoBlocks = (output) => {
     const outside = [];
     let inVitestEchoBlock = false;
-    for (const line of output.split("\n")) {
+    for (const line of withoutJestWatchmanBlocks(output)) {
         const clean = line.replace(ANSI_RE, "");
         const runnerLine = stripTurboPrefix(clean) ?? clean;
         if (inVitestEchoBlock) {
@@ -624,8 +644,7 @@ function fingerprintOccurrences(output) {
 }
 // The diagnostic channel for a runner we cannot read: raw output lines, never fingerprints, never a
 // verdict. They exist so the operator sees SOMETHING when a green command turns red unrecognizably.
-const unrecognizedEvidence = (raw) => raw
-    .split("\n")
+const unrecognizedEvidence = (raw) => withoutJestWatchmanBlocks(raw)
     .map((l) => l.replace(ANSI_RE, "").trimEnd())
     .filter((l) => VOCAB_RE.test(l))
     .slice(0, 10)
@@ -1027,11 +1046,33 @@ export async function detectVacuousOracles(cwd, tasks) {
 // drop a FAIL line that fingerprint-collides with baseline noise). No headline anchors → byte-identical
 // fallback to today's text (non-vitest runners lose nothing). RED-pinned by tests/gates/baseline.test.ts
 // "HYG-08: details headlines the failing test, not the noise".
+// Queue row 224(a) (D-2118): Jest identities and their first message are display-only; Console and
+// column-zero validation bullets are not identities. Keep the existing metadata extraction separate.
+const JEST_IDENTITY_RE = /^ {2}● (?!Console\s*$)\S.*$/;
 function headlineDetails(raw, fresh, freshLines) {
-    const headlines = raw
+    const namedHeadlines = raw
         .split("\n")
         .map((l) => l.replace(ANSI_RE, ""))
         .filter((l) => namesFailureEitherForm(l) || SUMMARY_FAIL_RE.test(l));
+    const outputLines = withoutJestWatchmanBlocks(raw).map((l) => l.replace(ANSI_RE, ""));
+    let inVitestEchoBlock = false;
+    const headlines = outputLines.flatMap((line, index) => {
+        const runnerLine = stripTurboPrefix(line) ?? line;
+        const echoed = inVitestEchoBlock || VITEST_ECHO_BLOCK_RE.test(runnerLine);
+        if (inVitestEchoBlock) {
+            if (runnerLine.trim() === "")
+                inVitestEchoBlock = false;
+        }
+        else if (echoed)
+            inVitestEchoBlock = true;
+        // Queue row 224(a) (D-2118): preserve raw FAIL/summary headlines; only Jest identities exclude echoes.
+        if (namesFailureEitherForm(line) || SUMMARY_FAIL_RE.test(line))
+            return [line];
+        if (echoed || !JEST_IDENTITY_RE.test(line))
+            return [];
+        const message = withoutVitestEchoBlocks(outputLines.slice(index + 1).join("\n")).find((l) => l.trim() !== "");
+        return message === undefined ? [line] : [line, message];
+    });
     // S22: the ORIGINAL runner lines behind v2 comparison keys are the diagnostic; the keys are secondary.
     // A legacy entry's lines ARE its keys, so its details stay byte-identical.
     const lines = [...new Set(freshLines)].join("\n");
@@ -1041,7 +1082,7 @@ function headlineDetails(raw, fresh, freshLines) {
         return { details: same ? `new failures vs baseline:\n${lines}` : `new failures vs baseline:\n${lines}\n\n${keys}` };
     return {
         details: `failing tests:\n${headlines.join("\n")}\n\n${same ? "" : `new failure lines vs baseline:\n${lines}\n\n`}${keys}`,
-        meta: { failingTests: headlines.filter(namesFailureEitherForm) },
+        ...(namedHeadlines.length ? { meta: { failingTests: namedHeadlines.filter(namesFailureEitherForm) } } : {}),
     };
 }
 export async function compareToBaseline(cwd, commands, baseline, enabled, opts = {}) {
@@ -1224,7 +1265,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         if (classification === "infra") {
             const evidence = failingLines.length
                 ? failingLines.slice(0, 10).join("\n")
-                : unrecognizedEvidence(raw) || raw.trim().split("\n").slice(0, 10).join("\n");
+                : unrecognizedEvidence(raw) || withoutJestWatchmanBlocks(raw).join("\n").trim().split("\n").slice(0, 10).join("\n");
             record({
                 gate: name,
                 pass: false,

package/dist/gates/cache.js

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
-import { execSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { checkoutIncarnation, describeCapacity, inventoryDependencyLinks, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
 import { shq } from "../adapters/types.js";
+import { trustedCommonDir } from "../run/git-trust.js";
 import { titleEnvironment } from "../run/title-environment.js";
 export const DEFAULT_VERDICT_CACHE_BOUND = 128;
 let testCacheBound;
@@ -269,9 +269,7 @@ export function resolveStateDir(worktree, artifactDir) {
         return join(worktree, ".tickmarkr");
     }
     try {
-        const commonDir = execSync("git rev-parse --git-common-dir", { cwd: worktree, encoding: "utf8" }).trim();
-        const resolved = resolve(worktree, commonDir);
-        const commonRoot = realpathSync(dirname(resolved));
+        const commonRoot = realpathSync(dirname(trustedCommonDir(worktree)));
         if (existsSync(join(commonRoot, ".tickmarkr"))) {
             return join(commonRoot, ".tickmarkr");
         }

package/dist/graph/schema.js

@@ -118,7 +118,9 @@ export const RunGraphSchema = z
         source: z.enum(SPEC_SOURCES),
         paths: z.array(z.string()),
         hash: z.string(),
-        // Q11 compile half: an author-declared ref only. Runtime Git resolution/enforcement is later.
+        // Q11 / queue row 220: an author-declared ref, proven at run and resume start against the run's
+        // starting commit (HEAD for a run, the recorded run-start base for a resume) by ancestry or patch-id;
+        // drifted or unresolvable, the run or resume is refused before it writes anything. Never rebased onto.
         base: z.string().min(1).optional(),
     }),
     tasks: z.array(TaskSchema).min(1),