claude-code-session-manager 0.116.0 → 0.117.0

package/src/main/lib/git/worktreeDeps.cjs

@@ -0,0 +1,77 @@
+/**
+ * worktreeDeps.cjs — symlink the main checkout's gitignored top-level
+ * dependency dirs (node_modules, .venv, venv) into a fresh worktree.
+ *
+ * `git worktree add` checks out tracked files only, so a job worktree has no
+ * dependencies and executors park needs_review. A gitignore pattern like
+ * `node_modules/` (trailing slash) matches directories only and a symlink is
+ * not a directory, so each linked name is also written to the repo's shared
+ * `info/exclude` as `/<name>` — otherwise the link shows as untracked and the
+ * job parks as `uncommitted_changes`.
+ *
+ * Never throws; failures land in `skipped`.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execGit } = require('./gitExec.cjs');
+
+const DEFAULT_DEP_DIRS = ['node_modules', '.venv', 'venv'];
+
+function isDir(p) {
+  try { return fs.statSync(p).isDirectory(); } catch { return false; }
+}
+
+function exists(p) {
+  try { fs.lstatSync(p); return true; } catch { return false; }
+}
+
+async function isIgnored(cwd, name) {
+  try {
+    await execGit(cwd, ['check-ignore', '-q', name], { timeout: 10_000 });
+    return true;
+  } catch { return false; }
+}
+
+async function addExcludes(mainCwd, names) {
+  const out = (await execGit(mainCwd, ['rev-parse', '--git-common-dir'], { timeout: 10_000 })).trim();
+  const commonDir = path.resolve(mainCwd, out);
+  const file = path.join(commonDir, 'info', 'exclude');
+  let existing = '';
+  try { existing = fs.readFileSync(file, 'utf8'); } catch { /* absent */ }
+  const have = new Set(existing.split('\n').map((l) => l.trim()));
+  const missing = names.map((n) => `/${n}`).filter((l) => !have.has(l));
+  if (!missing.length) return;
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const sep = existing && !existing.endsWith('\n') ? '\n' : '';
+  fs.appendFileSync(file, `${sep}${missing.join('\n')}\n`);
+}
+
+/**
+ * @param {{ mainCwd: string, worktreeCwd: string, names?: string[] }} opts
+ * @returns {Promise<{ linked: string[], skipped: string[] }>}
+ */
+async function linkDependencyDirs({ mainCwd, worktreeCwd, names = DEFAULT_DEP_DIRS }) {
+  const linked = [];
+  const skipped = [];
+  for (const name of names) {
+    try {
+      const src = path.join(mainCwd, name);
+      const dest = path.join(worktreeCwd, name);
+      if (!isDir(src) || exists(dest) || !(await isIgnored(mainCwd, name))) {
+        skipped.push(name);
+        continue;
+      }
+      // Exclude first: a link without its exclude line would dirty status.
+      await addExcludes(mainCwd, [name]);
+      fs.symlinkSync(src, dest, 'dir');
+      linked.push(name);
+    } catch {
+      skipped.push(name);
+    }
+  }
+  return { linked, skipped };
+}
+
+module.exports = { linkDependencyDirs, DEFAULT_DEP_DIRS };

package/src/main/lib/mcpToolCatalog.cjs

@@ -365,10 +365,14 @@ const MCP_TOOL_CATALOG = [
       label: 'Publish git + npm',
       agentName: 'builder',
       tag: 'feature',
-      prompt: 'Run the full publish flow: commit, bump version, gate, npm publish, push.',
+      prompt: 'Run the full publish flow for the {{stream}} stream: commit, bump version, gate, npm publish, push.',
+      inputs: [{ name: 'stream', label: 'Stream', default: 'education-veggies' }],
     },
     notes: "cwd is optional — defaults to the calling session's own project root (SM_PROJECT_ROOT or "
-      + 'process.cwd()) when omitted. label, agentName, tag and prompt are all required strings.',
+      + 'process.cwd()) when omitted. label, agentName, tag and prompt are all required strings. '
+      + '`inputs` is an optional array of { name, label, default, required, options } fields the human fills in '
+      + 'when pressing the macro; reference each in the prompt as {{name}}. Omitting `inputs` on update keeps '
+      + 'the existing inputs; `[]` clears them.',
   },
   {
     name: 'session_manager_help',

package/src/main/lib/memoryMdNetwork.cjs

@@ -0,0 +1,121 @@
+'use strict';
+
+/**
+ * Gathers the project's markdown network (root CLAUDE.md, the docs it links to,
+ * every tracked scoped CLAUDE.md) and reports which docs already mention the
+ * backticked terms a memory uses. Top-level in lib/ (sibling of memoryStale):
+ * no domain subfolder fits. Pure apart from the injected `readFile`.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const ROOT_MAX_BYTES = 16 * 1024;
+const MAX_DOCS = 60;
+const MAX_SEARCH_BYTES = 200 * 1024;
+const MAX_TERMS = 25;
+const HITS_PER_DOC = 3;
+const HITS_TOTAL = 8;
+const MAX_LINE_CHARS = 200;
+
+const MD_LINK_RE = /\]\(([^)\s]+\.md)(#[^)]*)?\)/g;
+const TERM_RE = /`([^`\n]{4,80})`/g;
+const ROOT_DOC = 'CLAUDE.md';
+
+function defaultReadFile(p) {
+  return fs.readFileSync(p, 'utf8');
+}
+
+function safeRead(readFile, abs) {
+  try {
+    const out = readFile(abs);
+    return typeof out === 'string' ? out : null;
+  } catch {
+    return null;
+  }
+}
+
+function extractLinkedDocs(rootText) {
+  const out = [];
+  let m;
+  MD_LINK_RE.lastIndex = 0;
+  while ((m = MD_LINK_RE.exec(rootText)) !== null) {
+    const target = m[1];
+    if (/^(?:https?|file):\/\//i.test(target)) continue;
+    const norm = path.posix.normalize(target);
+    if (norm.startsWith('..') || norm.startsWith('/')) continue;
+    out.push(norm);
+  }
+  return out;
+}
+
+function extractTerms(body) {
+  const seen = new Set();
+  const out = [];
+  let m;
+  TERM_RE.lastIndex = 0;
+  while ((m = TERM_RE.exec(body || '')) !== null) {
+    if (out.length >= MAX_TERMS) break;
+    const term = m[1].trim();
+    if (term.length < 4 || seen.has(term)) continue;
+    seen.add(term);
+    out.push(term);
+  }
+  return out;
+}
+
+function titleOf(text, fallback) {
+  const m = /^# (.+?)\s*$/m.exec(text);
+  return m ? m[1] : fallback;
+}
+
+/**
+ * @param {{ cwd: string, memoryBody: string, trackedFiles: string[], readFile?: (p: string) => string }} args
+ */
+function collectMdNetwork({ cwd, memoryBody, trackedFiles, readFile = defaultReadFile }) {
+  const tracked = new Set((trackedFiles || []).map((f) => path.posix.normalize(f)));
+  const abs = (rel) => path.join(cwd, rel);
+
+  const rootFull = safeRead(readFile, abs(ROOT_DOC)) ?? '';
+  const rootClaudeMd = Buffer.byteLength(rootFull) > ROOT_MAX_BYTES
+    ? Buffer.from(rootFull).subarray(0, ROOT_MAX_BYTES).toString('utf8')
+    : rootFull;
+
+  const paths = [];
+  const add = (p) => {
+    if (p !== ROOT_DOC && !paths.includes(p)) paths.push(p);
+  };
+  for (const p of extractLinkedDocs(rootFull)) if (tracked.has(p)) add(p);
+  for (const p of tracked) if (path.posix.basename(p) === ROOT_DOC) add(p);
+
+  const searchable = [{ path: ROOT_DOC, text: rootFull }];
+  const docs = [];
+  for (const rel of paths) {
+    if (docs.length >= MAX_DOCS) break;
+    const text = safeRead(readFile, abs(rel));
+    if (text === null) continue;
+    const bytes = Buffer.byteLength(text);
+    docs.push({ path: rel, title: titleOf(text, rel), bytes });
+    if (bytes <= MAX_SEARCH_BYTES) searchable.push({ path: rel, text });
+  }
+
+  const coverage = extractTerms(memoryBody).map((term) => {
+    const hits = [];
+    for (const doc of searchable) {
+      if (hits.length >= HITS_TOTAL) break;
+      let perDoc = 0;
+      const lines = doc.text.split(/\r?\n/);
+      for (let i = 0; i < lines.length; i++) {
+        if (perDoc >= HITS_PER_DOC || hits.length >= HITS_TOTAL) break;
+        if (!lines[i].includes(term)) continue;
+        hits.push({ path: doc.path, line: i + 1, text: lines[i].trim().slice(0, MAX_LINE_CHARS) });
+        perDoc++;
+      }
+    }
+    return { term, hits };
+  });
+
+  return { rootClaudeMd, docs, coverage };
+}
+
+module.exports = { collectMdNetwork };

package/src/main/lib/memoryRefResolve.cjs

@@ -0,0 +1,64 @@
+'use strict';
+
+/**
+ * The one predicate deciding whether a path a memory mentions still resolves.
+ * Top-level in lib/ beside memoryStale.cjs (its sibling consumer); no domain
+ * subfolder fits. IO is injected (`exists`, `trackedFiles`, `home`) so it is
+ * unit-testable with no real fs; only `listTrackedFiles` shells out to git.
+ */
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFile } = require('node:child_process');
+
+function isBadRel(rel) {
+  if (typeof rel !== 'string' || rel === '') return true;
+  if (rel.startsWith('/') || rel.startsWith('~')) return true;
+  return rel.split(/[\\/]/).includes('..');
+}
+
+function underHome(abs, home) {
+  const r = path.relative(home, abs);
+  return r === '' || (!r.startsWith('..') && !path.isAbsolute(r));
+}
+
+function makeRefResolver({ cwd, trackedFiles = [], exists = fs.existsSync, home = os.homedir() }) {
+  const exact = new Set(trackedFiles);
+  const byBase = new Map();
+  for (const p of trackedFiles) {
+    const base = path.posix.basename(p);
+    const list = byBase.get(base);
+    if (list) list.push(p); else byBase.set(base, [p]);
+  }
+
+  function expandRoot(root) {
+    if (typeof root !== 'string' || root === '') return null;
+    if (root === '~') return home;
+    if (root.startsWith('~/')) return path.join(home, root.slice(2));
+    return path.isAbsolute(root) ? path.normalize(root) : null;
+  }
+
+  return function resolve(rel, roots = []) {
+    if (isBadRel(rel)) return false;
+    if (exists(path.join(cwd, rel))) return true;
+    if (exact.has(rel)) return true;
+    const candidates = byBase.get(path.posix.basename(rel));
+    if (candidates && candidates.some((p) => p === rel || p.endsWith('/' + rel))) return true;
+    for (const root of roots) {
+      const abs = expandRoot(root);
+      if (abs && underHome(abs, home) && exists(path.join(abs, rel))) return true;
+    }
+    return false;
+  };
+}
+
+function listTrackedFiles(cwd) {
+  return new Promise((resolve) => {
+    execFile('git', ['-C', cwd, 'ls-files'], { timeout: 10_000, maxBuffer: 32 * 1024 * 1024 }, (err, stdout) => {
+      resolve(err ? [] : String(stdout).split('\n').filter(Boolean));
+    });
+  });
+}
+
+module.exports = { makeRefResolver, listTrackedFiles };

package/src/main/lib/memoryStale.cjs

@@ -14,11 +14,9 @@ const WIKILINK_RE = /\[\[([^\]]+)\]\]/g;
 // Backtick-quoted repo-path-shaped tokens, optionally suffixed with a :line.
 const PATH_TOKEN_RE = /`([A-Za-z0-9_./-]+\.[A-Za-z0-9]{1,5}(?::\d+)?)`/g;
 
-const KNOWN_SOURCE_EXTENSIONS = new Set([
-  'js', 'jsx', 'ts', 'tsx', 'cjs', 'mjs', 'json', 'md', 'py', 'rb', 'go', 'rs',
-  'java', 'c', 'h', 'cpp', 'hpp', 'css', 'scss', 'html', 'yml', 'yaml', 'sh',
-  'txt', 'toml', 'lock', 'sql', 'php', 'swift', 'kt', 'vue',
-]);
+// Project roots a memory names: `~/x/y` or `/home/<user>/x/y`, backticked or not.
+const ROOT_TOKEN_RE = /(?:~|\/home\/[^/\s`]+)\/[A-Za-z0-9_.\-/]+/g;
+const MAX_ROOTS = 5;
 
 function stripName(name) {
   return name.replace(/\.md$/, '');
@@ -53,9 +51,8 @@ function extractCandidates(body) {
     if (out.length >= MAX_DEAD_REF_CANDIDATES) break;
     let token = m[1].replace(/:\d+$/, '');
     if (token.startsWith('/') || token.startsWith('~')) continue; // not repo-relative
-    const ext = token.includes('.') ? token.split('.').pop().toLowerCase() : '';
-    const hasSlash = token.includes('/');
-    if (!hasSlash && !KNOWN_SOURCE_EXTENSIONS.has(ext)) continue;
+    // A bare filename can never resolve from the repo root — only slashed paths are checkable.
+    if (!token.includes('/')) continue;
     if (seen.has(token)) continue;
     seen.add(token);
     out.push(token);
@@ -63,12 +60,30 @@ function extractCandidates(body) {
   return out;
 }
 
+/**
+ * Extract up to MAX_ROOTS distinct directory tokens (`~/...`, `/home/<user>/...`)
+ * named anywhere in the body, so a sibling-repo path can resolve against them.
+ * Pure, no fs.
+ */
+function extractRoots(body) {
+  const out = [];
+  let m;
+  ROOT_TOKEN_RE.lastIndex = 0;
+  while ((m = ROOT_TOKEN_RE.exec(body)) !== null) {
+    const root = m[0].replace(/[/.,)]+$/, '');
+    if (!root.includes('/') || out.includes(root)) continue;
+    out.push(root);
+    if (out.length >= MAX_ROOTS) break;
+  }
+  return out;
+}
+
 /**
  * scoreMemories({ entries, now, existsPath })
  *
  * entries: Array<{ name, mtimeMs, body }>
  * now: ms epoch
- * existsPath: (relPath: string) => boolean
+ * existsPath: (relPath: string, roots?: string[]) => boolean
  *
  * Complexity: O(total body bytes) — a single pass per entry to extract
  * wikilink targets and dead-ref candidates; the inbound-link fold is
@@ -105,7 +120,8 @@ function scoreMemories({ entries, now, existsPath }) {
     const inboundLinks = inboundCounts.get(slug) || 0;
 
     const candidates = extractCandidates(e.body);
-    const deadRefs = candidates.filter((c) => !existsPath(c));
+    const roots = extractRoots(e.body);
+    const deadRefs = candidates.filter((c) => !existsPath(c, roots));
 
     const reasons = [];
     if (deadRefs.length > 0) {
@@ -136,4 +152,4 @@ function scoreMemories({ entries, now, existsPath }) {
   });
 }
 
-module.exports = { scoreMemories };
+module.exports = { scoreMemories, extractRoots };

package/src/main/lib/persona-macro/macroLibrary.cjs

@@ -60,6 +60,39 @@ const MacroProjectEntrySchema = z.union([z.literal(ALL_PROJECTS), AbsolutePathSc
 const MacroProjectsSchema = z.array(MacroProjectEntrySchema).max(200);
 const MacroSurfaceSchema = z.enum(['sessions', 'project-home']);
 
+const MACRO_INPUT_MAX_LEN = 500;
+const MACRO_PLACEHOLDER_RE = /\{\{\s*([a-z][a-z0-9_]{0,31})\s*\}\}/g;
+
+const MacroInputSchema = z.object({
+  name: z.string().regex(/^[a-z][a-z0-9_]{0,31}$/, 'invalid input name'),
+  label: z.string().trim().min(1).max(60),
+  default: z.string().max(MACRO_INPUT_MAX_LEN).optional(),
+  required: z.boolean().optional(),
+  options: z.array(z.string().min(1).max(MACRO_INPUT_MAX_LEN)).min(1).max(20).optional(),
+});
+const MacroInputsSchema = z.array(MacroInputSchema).max(10);
+
+/** Cross-field checks; a no-op when `inputs` is absent/empty so legacy literal `{{x}}` prompts still load. */
+function refineInputs(value, ctx) {
+  if (!value.inputs || value.inputs.length === 0) return;
+  const seen = new Set();
+  value.inputs.forEach((input, i) => {
+    if (seen.has(input.name)) {
+      ctx.addIssue({ code: 'custom', path: ['inputs', i, 'name'], message: `duplicate input name: ${input.name}` });
+    }
+    seen.add(input.name);
+    if (input.default !== undefined && input.options && !input.options.includes(input.default)) {
+      ctx.addIssue({ code: 'custom', path: ['inputs', i, 'default'], message: `default for "${input.name}" is not one of its options` });
+    }
+  });
+  const re = new RegExp(MACRO_PLACEHOLDER_RE.source, 'g');
+  for (const m of value.prompt.matchAll(re)) {
+    if (!seen.has(m[1])) {
+      ctx.addIssue({ code: 'custom', path: ['prompt'], message: `prompt placeholder {{${m[1]}}} is not declared in inputs` });
+    }
+  }
+}
+
 const MacroSchema = z.object({
   id: MacroIdSchema,
   label: MacroLabelSchema,
@@ -72,7 +105,8 @@ const MacroSchema = z.object({
   builtinVersion: z.number().int().optional(),
   createdAt: z.string().min(1).max(64),
   updatedAt: z.string().min(1).max(64),
-});
+  inputs: MacroInputsSchema.optional(),
+}).superRefine(refineInputs);
 
 const MacroSaveSchema = z.object({
   id: MacroIdSchema.optional(),
@@ -85,7 +119,9 @@ const MacroSaveSchema = z.object({
   // wipe its visibility back to no projects. `undefined` on create means [].
   projects: MacroProjectsSchema.optional(),
   surface: MacroSurfaceSchema.optional(),
-});
+  // Omitted keeps the stored list on update; `[]` clears it.
+  inputs: MacroInputsSchema.optional(),
+}).superRefine(refineInputs);
 
 const MacroDeleteSchema = z.object({ id: MacroIdSchema });
 
@@ -399,6 +435,13 @@ async function saveMacro(input, opts = {}) {
         surface: parsed.surface ?? macros[idx].surface,
         updatedAt: now,
       };
+      if (parsed.inputs === undefined) {
+        // keep whatever the spread carried over
+      } else if (parsed.inputs.length === 0) {
+        delete saved.inputs;
+      } else {
+        saved.inputs = parsed.inputs;
+      }
       macros[idx] = saved;
     } else {
       const projects = parsed.projects !== undefined ? normalizeProjects(parsed.projects) : [];
@@ -413,6 +456,7 @@ async function saveMacro(input, opts = {}) {
         createdAt: now,
         updatedAt: now,
       };
+      if (parsed.inputs && parsed.inputs.length > 0) saved.inputs = parsed.inputs;
       macros.push(saved);
     }
     await writeStore(filePath, macros);
@@ -467,6 +511,9 @@ async function setMacroProject(input, opts = {}) {
 
 module.exports = {
   ALL_PROJECTS,
+  MACRO_INPUT_MAX_LEN,
+  MACRO_PLACEHOLDER_RE,
+  MacroInputSchema,
   MacroSchema,
   MacroSaveSchema,
   MacroDeleteSchema,

package/src/main/lib/scheduler/baselineGate.cjs

@@ -0,0 +1,128 @@
+'use strict';
+
+/**
+ * baselineGate.cjs — pure decision rule for "baseline gate authority": whether
+ * a needs_review park whose gate is red may complete on its own because every
+ * failure at HEAD already existed at the job's base commit.
+ *
+ * The park class: an executor committed correct work, but the PRD gate is red
+ * for reasons the job did not cause ("N pre-existing failures, identical on
+ * base"). The proof is a subset test on failing-test ids — HEAD's failing ids
+ * in the failing gate step must all appear in the base run's failing ids for
+ * that SAME step. A job that adds even one new failing test is refused.
+ *
+ * Pure: no fs/git/process I/O. scheduler.cjs runs the gate at HEAD and at the
+ * base commit and passes the two runGateSequence outcomes (each result carries
+ * `outputTail`) plus the git proofs in.
+ */
+
+// eslint-disable-next-line no-control-regex
+const ANSI_RE = /\u001b\[[0-9;?]*[ -/]*[@-~]/g;
+
+/** Strip a trailing vitest/jest duration like " 12ms" / " (3 ms)". */
+function stripDuration(s) {
+  return s.replace(/\s+\(?\d+(?:\.\d+)?\s*m?s\)?\s*$/, '').trim();
+}
+
+/**
+ * parseFailingTests(output) → sorted unique failing-test ids, or null when the
+ * output shows failure but no id is parseable.
+ *
+ * Formats: pytest `FAILED path::name`; vitest `FAIL  path > ... > name` and
+ * `× name` under a FAIL file; jest `● Suite › name`; tsc
+ * `file(line,col): error TSnnnn` → `file:TSnnnn`.
+ *
+ * @param {string} output
+ * @returns {string[]|null}
+ */
+function parseFailingTests(output) {
+  const text = typeof output === 'string' ? output.replace(ANSI_RE, '') : '';
+  const ids = new Set();
+  let currentFile = null;
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trimEnd();
+    let m;
+    if ((m = /^FAILED\s+(\S+?)(?:\s+-\s.*)?$/.exec(line))) {
+      ids.add(m[1]);
+      continue;
+    }
+    if ((m = /^\s*FAIL\s+(.+)$/.exec(line))) {
+      const body = stripDuration(m[1]);
+      if (body.includes(' > ')) {
+        ids.add(body);
+        currentFile = body.split(' > ')[0].trim();
+      } else {
+        currentFile = body;
+      }
+      continue;
+    }
+    if (currentFile && (m = /^\s*[×✗✕]\s+(.+)$/.exec(line))) {
+      ids.add(`${currentFile} > ${stripDuration(m[1])}`);
+      continue;
+    }
+    if ((m = /^\s*●\s+(.+?\s›\s.+)$/.exec(line))) {
+      ids.add(m[1].trim());
+      continue;
+    }
+    if ((m = /^(.+?)\(\d+,\d+\):\s*error\s+(TS\d+)\b/.exec(line))) {
+      ids.add(`${m[1].trim()}:${m[2]}`);
+      continue;
+    }
+    if ((m = /^(.+?):\d+:\d+\s+-\s*error\s+(TS\d+)\b/.exec(line))) {
+      ids.add(`${m[1].trim()}:${m[2]}`);
+    }
+  }
+  return ids.size ? [...ids].sort() : null;
+}
+
+/** The failing step of a red outcome: runGateSequence stops at the first failure. */
+function failingStep(outcome) {
+  const results = Array.isArray(outcome?.results) ? outcome.results : [];
+  if (!results.length) return null;
+  const index = results.length - 1;
+  return { index, output: results[index]?.outputTail };
+}
+
+/**
+ * decideBaselineAuthority({ job, headOutcome, baseOutcome, evidenceOk, ancestorOk, cleanOk, headStable, env })
+ *   → { complete, reason, preexisting }
+ *
+ * Checks run in a fixed order; the first failed check is the reason.
+ *
+ * @param {object} params
+ * @param {object} params.job - needs_review row: reads `status`, `verifierVerdict`, `landedCommit`.
+ * @param {{status: string, results: object[]}} params.headOutcome - runGateSequence at HEAD.
+ * @param {{status: string, results: object[]}} params.baseOutcome - runGateSequence at the job's base commit.
+ * @param {boolean} params.evidenceOk - landedCommit is git-verified evidence from THIS dispatch.
+ * @param {boolean} params.ancestorOk - landedCommit is an ancestor of (or equal to) the pre-gate HEAD.
+ * @param {boolean} params.cleanOk - tree clean before and after the gate.
+ * @param {boolean} params.headStable - HEAD unmoved across the gate.
+ * @param {object} [params.env] - defaults to process.env.
+ * @returns {{complete: boolean, reason: string, preexisting: string[]}}
+ */
+function decideBaselineAuthority({ job, headOutcome, baseOutcome, evidenceOk, ancestorOk, cleanOk, headStable, env = process.env } = {}) {
+  const no = (reason) => ({ complete: false, reason, preexisting: [] });
+  if (env?.SM_BASELINE_GATE_AUTHORITY_DISABLE === '1') return no('kill-switch');
+  if (!job || job.status !== 'needs_review' || job.verifierVerdict !== 'sentinel_fail') {
+    return no('verdict-not-eligible');
+  }
+  if (typeof job.landedCommit !== 'string' || job.landedCommit.length === 0) return no('no-landed-commit');
+  if (evidenceOk !== true) return no('commit-not-from-this-run');
+  if (ancestorOk !== true) return no('commit-not-on-head');
+  if (cleanOk !== true) return no('tree-dirty');
+  if (headStable !== true) return no('head-moved-during-gate');
+  if (headOutcome?.status !== 'red') return no('head-not-red');
+  if (baseOutcome?.status === 'green') return no('base-green');
+  if (baseOutcome?.status !== 'red') return no('base-unavailable');
+  const head = failingStep(headOutcome);
+  const base = failingStep(baseOutcome);
+  if (!head || !base || head.index !== base.index) return no('different-failing-step');
+  const headIds = parseFailingTests(head.output);
+  const baseIds = parseFailingTests(base.output);
+  if (!headIds || !baseIds) return no('unparseable-output');
+  const baseSet = new Set(baseIds);
+  if (headIds.some((id) => !baseSet.has(id))) return no('new-failures');
+  return { complete: true, reason: 'baseline-identical', preexisting: headIds };
+}
+
+module.exports = { parseFailingTests, decideBaselineAuthority };

package/src/main/lib/scheduler/definitionOfDone.cjs

@@ -758,6 +758,8 @@ function writeReport(key, { acResults = [], riskFlags = [], runsDir } = {}) {
 // shadow gate in flight machine-wide (the scheduler is one process).
 let gateInFlight = false;
 const OUTPUT_TAIL_CHARS = 1000;
+// Bounded full-output ring kept for baseline comparison (failing test ids).
+const OUTPUT_RING_CHARS = 64 * 1024;
 
 function runOneGateCommand(cmd, { cwd, env }) {
   return new Promise((resolve) => {
@@ -776,11 +778,15 @@ function runOneGateCommand(cmd, { cwd, env }) {
         // No shell:true — the sequence was tokenized by tokenizeNoShell.
       });
     } catch {
-      resolve({ cmd: label, status: 'unavailable', code: null, ms: ms(), timedOut: false, tail: '' });
+      resolve({ cmd: label, status: 'unavailable', code: null, ms: ms(), timedOut: false, tail: '', outputTail: '' });
       return;
     }
     let tail = '';
-    const onData = (d) => { tail = (tail + d).slice(-OUTPUT_TAIL_CHARS); };
+    let outputTail = '';
+    const onData = (d) => {
+      tail = (tail + d).slice(-OUTPUT_TAIL_CHARS);
+      outputTail = (outputTail + d).slice(-OUTPUT_RING_CHARS);
+    };
     child.stdout.on('data', onData);
     child.stderr.on('data', onData);
     let settled = false;
@@ -800,7 +806,7 @@ function runOneGateCommand(cmd, { cwd, env }) {
       settled = true;
       clearTimeout(killTimer);
       clearTimeout(escalate);
-      resolve({ cmd: label, ms: ms(), timedOut, tail, ...r });
+      resolve({ cmd: label, ms: ms(), timedOut, tail, outputTail, ...r });
     };
     child.on('error', () => finish({ status: 'unavailable', code: null }));
     child.on('close', (code) => {

package/src/main/lib/scheduler/needsReviewLedger.cjs

@@ -60,7 +60,7 @@ function classifyLadderRung({ source, reason } = {}) {
   if (s === 'spawnInvestigation:start' || s === 'spawnJob:auto-promote' || s === 'reverifyNeedsReview:auto-promote') {
     return 'auto-fix';
   }
-  if (s === 'reverifyNeedsReview:heal' || s === 'needsReviewAutoResolve' || s === 'gateAuthoritative') return 'reverify';
+  if (s === 'reverifyNeedsReview:heal' || s === 'needsReviewAutoResolve' || s === 'gateAuthoritative' || s === 'gateAuthority:baseline') return 'reverify';
   // No transitionJob call site resolves needs_review with a 'quarantine'
   // source today (performLeftoverQuarantine cleans up leftover paths without
   // itself changing job.status — the row stays needs_review until a later