tickmarkr 1.30.0

package/dist/run/daemon.js

@@ -0,0 +1,728 @@
+import { randomBytes } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { trailerPattern, writePrompt } from "../adapters/prompt.js";
+import { allAdapters, discoverChannels, getAdapter, probeAll, readDoctor } from "../adapters/registry.js";
+import { addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
+import { loadConfig } from "../config/config.js";
+import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
+import { formatOwnedName } from "../drivers/types.js";
+import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
+import { runGates } from "../gates/run-gates.js";
+import { addEvidence, attributeBlocked, blockedTasks, getTask, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
+import { consult } from "./consult.js";
+import { gitHead, sh } from "./git.js";
+import { Journal, loadRoutingProfile, newRunId } from "./journal.js";
+import { acquireRunLock, releaseRunLock } from "./lock.js";
+import { ensureIntegration, integrationBranch, integrationHead, mergeTask } from "./merge.js";
+import { nextChannel, route } from "../route/router.js";
+import { desiredPanes } from "./reconcile.js";
+// VIS-01: one formatter, four readers (run-end journal event, run/resume CLI, run-end notify).
+// Parity by construction — every caller renders the same complete bucket line.
+export function formatSummary(s) {
+    return `done: ${s.done.length}, failed: ${s.failed.length}, human: ${s.human.length}, blocked: ${s.blocked.length}, pending: ${s.pending.length}\nintegration branch: ${s.branch}`;
+}
+const MAX_ATTEMPTS = 10; // ponytail: hard cap so a pathological ladder can never loop forever
+const BLOCKED_POLL_MS = 30_000; // between trailer-wait slices, check whether the pane is blocked on a prompt
+export async function runDaemon(repoRoot, opts = {}) {
+    const cfg = loadConfig(repoRoot, { globalDir: opts.globalDir });
+    const adapters = opts.adapters ?? allAdapters();
+    const health = readDoctor(repoRoot) ?? (await probeAll(adapters));
+    const channels = discoverChannels(cfg, adapters, health);
+    // v1.6 ROUTE-06: build the learned profile ONCE at startup (never per task, never in the comparator).
+    // No preview — the daemon honors routing.learned:off and gets undefined; this snapshot is immutable
+    // for the run, so this run's own telemetry never feeds back into its own routing.
+    const profile = loadRoutingProfile(repoRoot, cfg);
+    const driver = opts.driver ?? new SubprocessDriver();
+    // HARD-01/02: hold the run lock across the whole read-modify-write of graph.json. Acquire
+    // BEFORE loadGraph; release in the finally below (every exit path, incl. throws).
+    const runId = opts.runId ?? newRunId();
+    // T6 narrator: one live status surface per run (herdr only — driver.narrator is undefined on
+    // subprocess, so the optional-chain open below is a no-op there). Declared out here so the finally
+    // can close it on every exit path. Cosmetic-only: any failure is swallowed (never affects the run).
+    let narrator = null;
+    const lock = acquireRunLock(repoRoot, runId);
+    try {
+        let graph = loadGraph(repoRoot);
+        const journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
+        const branchEvent = opts.resume
+            ? [...journal.read()].reverse().find((e) => (e.event === "run-start" || e.event === "run-end" || e.event === "merge") && typeof e.data.branch === "string")
+            : undefined;
+        const recordedBranch = typeof branchEvent?.data.branch === "string" ? branchEvent.data.branch : undefined;
+        const branch = recordedBranch
+            ? branchEvent.event === "merge" ? recordedBranch.slice(0, recordedBranch.lastIndexOf("--")) : recordedBranch
+            : opts.resume ? `drovr/${runId}` : integrationBranch(cfg, runId);
+        if (lock.reclaimed)
+            journal.append("lock-reclaimed", undefined, lock.reclaimed); // HARD-02 audit trail
+        // GATE-08 (v1.12): the humanGate guard consults this run's journaled approvals, not just the compiled
+        // flag. Built ONCE at startup from the journal; a fresh run's journal is empty ⇒ empty set ⇒ unapproved
+        // gates park exactly as today. (D-02 step 3 — the load-bearing change: a command + event WITHOUT this
+        // guard change ships a no-op; the task replays to pending, re-enters execTask, and re-parks.)
+        const approved = new Set(journal.read().filter((e) => e.event === "task-approved" && e.taskId).map((e) => e.taskId));
+        const commands = detectGateCommands(repoRoot, cfg);
+        let baseRef;
+        let baseline;
+        // Phase 46 (RES-01/RES-02): the resume-state map is built ONCE here so execTask closes over it.
+        // Empty Map on fresh runs — every seed below conditions on resume.get(t.id), never on opts.resume (the
+        // GATE-08 lesson at the humanGate guard: condition on the data, not the code path). Dead-code
+        // equivalence to the router.ts:194 profile⇒undefined pattern: no map entry ⇒ today's literal.
+        const resume = opts.resume ? journal.replayResumeState() : new Map();
+        if (opts.resume) {
+            const start = journal.read().find((e) => e.event === "run-start");
+            if (!start)
+                throw new Error(`journal for ${runId} has no run-start event`);
+            baseRef = start.data.baseRef;
+            baseline = JSON.parse(readFileSync(join(journal.dir, "baseline.json"), "utf8"));
+            for (const [id, st] of journal.replayStatuses()) {
+                // operator release: a graph.json edit back to "pending" beats a replayed human/failed park (locked decision 12)
+                if ((st === "human" || st === "failed") && getTask(graph, id).status === "pending")
+                    continue;
+                graph = setStatus(graph, id, st);
+            }
+            journal.append("run-resume", undefined, { pid: process.pid }); // v1.13 (VIS-11): record the live daemon pid for status liveness
+        }
+        else {
+            baseRef = await gitHead(repoRoot);
+            baseline = await captureBaseline(repoRoot, commands);
+            writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(baseline, null, 2));
+            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch }); // pid: v1.13 (VIS-11) liveness
+        }
+        // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
+        // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
+        // a failed-to-open or later-dead watch pane never affects the run.
+        try {
+            narrator = await driver.narrator?.(repoRoot, "drovr status --watch", runId) ?? null;
+        }
+        catch {
+            narrator = null; // cosmetic-only — the run proceeds without a live surface
+        }
+        const intWt = await ensureIntegration(repoRoot, branch, baseRef);
+        const concurrency = opts.concurrency ?? cfg.concurrency;
+        // v1.1 visibility: role-named slots; panes persist per keepPanes (attempt = v1 close-after-harvest)
+        const keepOpen = cfg.visibility.keepPanes !== "attempt";
+        // D-07 (HYG-09) fleet hygiene — ephemeral panes self-clean + done means gone. keepLlm decouples the
+        // judge/review/consult panes from the worker-oriented keepOpen: they close when their result is read
+        // unless the operator opts into "forever" (the keep-everything debug override). Reproduces the
+        // leftover-judge-pane incident (under keepPanes:"run" the run-end sweep left them open until the end).
+        const keepForever = cfg.visibility.keepPanes === "forever";
+        const keepLlm = keepForever;
+        const keptSlots = [];
+        const runTag = runId.replace(/^run-/, ""); // full date-time — cross-run unique even across days
+        // OBS-17 T2: reconcile at every safe point — run start/resume (just journaled above), each task
+        // terminal event, and run-end. The desired set is the pure journal fold (reconcile.ts); the driver
+        // owns listing/parsing/closing. Cosmetic by contract: failures are swallowed and subprocess has no
+        // reconcile (optional chain → no-op), so gates and the oracle suite never feel this. keepPanes
+        // "forever" is the keep-everything debug override — it disables the sweep entirely.
+        const reconcile = async (opts) => {
+            if (keepForever)
+                return;
+            try {
+                await driver.reconcile?.(desiredPanes(journal.read(), runId), runId, opts);
+            }
+            catch {
+                /* cosmetic — visibility is never a gate */
+            }
+        };
+        await reconcile(); // run start/resume boundary: nothing in flight — full sweep, incl. older runs' leftovers
+        // v1.4 self-reference guard: a random nonce on the worker trailer AND exit marker. Displayed
+        // source/diffs (e.g. a worker editing drovr's own prompt.ts/daemon.ts) can't know it, so an echoed
+        // DROVR_RESULT/DROVR_EXIT literal can never premature-harvest the worker. Quote-split keeps the
+        // echoed command line itself from matching the marker it prints.
+        //
+        // v1.13 (VIS-09 safety, 43-02): the nonce is per-ATTEMPT, declared at the top of the attempt loop
+        // below — NOT here at run scope. A run-scoped nonce is a latent hazard: HerdrDriver.read() is
+        // `pane read --lines 1000` over scrollback and SubprocessDriver never clears s.buf, so any transcript
+        // retention across attempts would let attempt N harvest attempt N-1's DROVR_RESULT out of scrollback
+        // as its OWN completion — silently LYING about a worker's outcome. Pinned by the stale-trailer oracle
+        // in tests/run/daemon.test.ts ("a retained prior-attempt trailer cannot complete a retry"); a future
+        // hoist back to run scope reddens it.
+        // merges are serialized — two concurrent `git merge`s in one worktree would corrupt each other
+        let mergeChain = Promise.resolve();
+        const mergeSerial = (taskBranch, t, gated) => {
+            const next = mergeChain.then(() => mergeTask(intWt, taskBranch, `drovr: merge ${t.id} ${t.title}`, gated));
+            mergeChain = next.catch(() => undefined);
+            return next;
+        };
+        // kind is null only at the humanGate call (assignment null ⇒ no row anyway); gateFails/consults are
+        // execTask-scoped counters passed in so a park row is a rich verified-failure observation (e.g. ladder-exhausted + gateFails:4).
+        const park = async (t, reason, kind, assignment, attempts, startMs, gateFails = 0, consults = 0, tokens, metered = 0, retryMode = "fresh") => {
+            graph = setStatus(graph, t.id, "human");
+            saveGraph(repoRoot, graph);
+            journal.append("task-human", t.id, { reason });
+            if (assignment) {
+                journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts, outcome: "human", durationMs: Date.now() - startMs, parkKind: kind ?? undefined, gateFails, consults, tokens, meteredAttempts: tokens ? metered : undefined, retryMode });
+            }
+            await reconcile({ spareLiveLlm: true }); // task-human is a terminal event — sweep, sparing sibling tasks' live LLM panes
+            await driver.notify(`drovr ${runId}: ${t.id} needs a human — ${reason}`, { tier: "attention" });
+        };
+        const execTask = async (t) => {
+            const startMs = Date.now();
+            if (t.humanGate && !approved.has(t.id)) {
+                // GATE-08: the condition is the APPROVAL, never the code path. `!opts.resume` (or any run-phase
+                // term) would silently dispatch every unapproved gate that becomes ready during a resume — pinned
+                // by the resume-path guard pin in tests/run/daemon.test.ts (the only test that reaches this guard
+                // on the resume path; a park-then-resume task is filtered out by readyTasks() and never gets here).
+                await park(t, `humanGate: "${t.title}" requires approval before dispatch`, null, null, 0, startMs);
+                return;
+            }
+            const r = route(t, cfg, channels, profile);
+            for (const lint of r.lints)
+                journal.append("routing-lint", t.id, { lint });
+            // VIS-02: journal a deviation from the static choice ONLY when one occurred (greppable absence = no deviation)
+            if (r.deviation)
+                journal.append("route-deviation", t.id, { ...r.deviation, provenance: r.provenance });
+            let assignment = r.assignment;
+            // Phase 46 (RES-01/RES-02, incident run-20260711-185020 L57-58): resume continues the escalation
+            // ladder. Replaying `tried` alone does NOT fix the incident — the first post-resume assignment comes
+            // from route() above, which is history-free by design and statically re-picked the consult-banned
+            // channel 2 ms after run-resume (daemon.ts:160, the incident's exact mechanism). The override below
+            // IS the fix; the tried seed and the attempt-loop start close RES-01/RES-02 alongside it.
+            //
+            // v1.24 OBS-18: a task-approved{release:attempt-cap} zeros rs.attempts (fresh budget) and clears
+            // lastAssignment while keeping tried. Only restore lastAssignment when attempts > 0 — after a
+            // fresh-budget release, prefer nextChannel over the surviving tried-list so burned channels are
+            // not re-tried first (consult bans / prior failovers survive the release).
+            const rs = resume.get(t.id);
+            if (rs?.lastAssignment && rs.attempts > 0 && channels.some((c) => channelKey(c) === channelKey(rs.lastAssignment))) {
+                assignment = rs.lastAssignment; // restore the consult-chosen assignment (bypasses route()'s static re-pick)
+            }
+            else if (rs && rs.tried.length) {
+                // trailing-reroute edge (kill between verdict and dispatch), a stale fleet, OR a fresh-budget
+                // release (attempts 0 + non-empty tried): pick a failover over the replayed exclusions via the
+                // EXISTING nextChannel `tried` parameter — zero router changes (D-03).
+                const next = nextChannel(assignment, t, cfg, channels, rs.tried, profile);
+                if (next)
+                    assignment = next;
+                // ponytail: nextChannel null (every channel already tried / none available) — keep the static
+                // assignment and proceed. Dispatching on a previously-tried channel beats deadlocking a resumed
+                // run; a park-instead policy can come later if it ever bites.
+            }
+            // pre-kill invariant: tried always contains the current assignment. Spread, never alias the
+            // journal-derived array (no hidden mutation of replayed state).
+            const tried = rs?.tried.length ? [...rs.tried] : [channelKey(assignment)];
+            if (!tried.includes(channelKey(assignment)))
+                tried.push(channelKey(assignment));
+            // VIS-02 convention: absence = no seeding happened. The observable surface for criterion 2's
+            // exclusion-list-equality oracle. Daemon-side append only — no journal.ts write-path change (Phase 48
+            // stays unblocked); inert to replayStatuses (unknown events ignored, pinned at journal.test.ts:70-80).
+            if (rs)
+                journal.append("resume-restore", t.id, { attempts: rs.attempts, tried: [...tried], assignment });
+            const badReviewers = []; // v1.1: reviewer channels that produced unparseable output for this task
+            let feedback = "";
+            let ladderIdx = 0;
+            let modeFallbackNoted = false; // v1.2: journal the interactive→print fallback once per task, not per attempt
+            let gateFails = 0; // TEL-02: incremented ONLY where feedback is built from failing gates — never derived from attempts (quota failovers bump attempts too, Pitfall 6)
+            let consults = 0; // TEL-02: bumped in the runConsult wrapper so one counter covers all three trigger sites, across the attempt loop
+            let tokens; // SPEND-02: accumulated across attempts — parked spend is still spend
+            let metered = 0; // SPEND-02: attempts that returned a usage record; distinguishes unmetered from measured-zero
+            let tipMoves = 0; // OBS-15: one re-gate allowance per task, never reset by a worker retry
+            let retryMode = "fresh";
+            let lastContextTokens; // v1.23 reset signal, including stalled/quota attempts
+            // v1.29: only a gate-failed attempt can seed same-session retry. The next attempt consumes this
+            // once; a changed channel, unknown context, or missing resumeCommand falls back to fresh.
+            let retrySession;
+            // ROUTE-13: learned within-band failover + deviation audit. nextChannel stays pure (route/ never
+            // journals); the daemon compares the learned pick against the static pick and owns the journal write.
+            const failover = (site) => {
+                const next = nextChannel(assignment, t, cfg, channels, tried, profile);
+                if (profile && next) {
+                    const staticNext = nextChannel(assignment, t, cfg, channels, tried);
+                    if (staticNext && channelKey(next) !== channelKey(staticNext)) {
+                        journal.append("failover-deviation", t.id, { site, static: channelKey(staticNext), chosen: channelKey(next) });
+                    }
+                }
+                return next;
+            };
+            const runConsult = (trigger, transcript, diffOrFeedback, gates) => {
+                consults++;
+                return consult({
+                    taskId: t.id, trigger,
+                    journalTail: JSON.stringify(journal.read().slice(-20)),
+                    transcript: transcript.slice(-8000),
+                    diff: diffOrFeedback, gates,
+                }, cfg, adapters, driver, repoRoot, journal.dir, 
+                // D-07: consult panes self-clean when the verdict is read (keepLlm) — only "forever" keeps them.
+                { keep: keepLlm, onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined, runId });
+            };
+            // returns true → continue attempting, false → task is terminal (parked)
+            // trigger (why the consult ran) is threaded in so the decompose/human park keeps its cause —
+            // rows 6/10/11 of the mapping (gate-fail vs stall vs merge-conflict) would otherwise conflate.
+            const applyVerdict = async (v, attempts, trigger) => {
+                journal.append("consult-verdict", t.id, {
+                    action: v.action, notes: v.notes,
+                    ...(v.excludeAdapter ? { excludeAdapter: v.excludeAdapter } : {}),
+                });
+                await driver.notify(`drovr ${runId}: ${t.id} consult verdict: ${v.action}`, { tier: "attention" });
+                if (v.action === "retry") {
+                    feedback = v.notes || feedback;
+                    return true;
+                }
+                if (v.action === "reroute") {
+                    // OBS-20 / v1.24 T1: adapter-scoped exclusion for environmental CLI failures. Expand the
+                    // task-local tried list with every available channel of the named adapter, then reuse
+                    // nextChannel's existing tried parameter — zero router changes (D-03). Unknown adapter
+                    // (zero matches) is a no-op expansion ⇒ ordinary channel-level reroute. Task-scoped:
+                    // `tried` lives inside execTask, so a sibling task is unaffected.
+                    if (v.excludeAdapter) {
+                        for (const c of channels) {
+                            if (c.adapter === v.excludeAdapter) {
+                                const k = channelKey(c);
+                                if (!tried.includes(k))
+                                    tried.push(k);
+                            }
+                        }
+                    }
+                    const next = failover("consult-reroute");
+                    if (next) {
+                        assignment = next;
+                        tried.push(channelKey(next));
+                        return true;
+                    }
+                    await park(t, "consult said reroute but every channel is exhausted", "reroute-exhausted", assignment, attempts, startMs, gateFails, consults, tokens, metered, retryMode);
+                    return false;
+                }
+                await park(t, `consult verdict: ${v.action} — ${v.notes}`, trigger, assignment, attempts, startMs, gateFails, consults, tokens, metered, retryMode); // decompose|human
+                return false;
+            };
+            // Phase 46 (RES-01): start at the replayed attempt count; a replayed count ≥ MAX_ATTEMPTS parks via
+            // the existing attempt-cap check below with zero new code. Fresh path: rs is undefined ⇒ 0.
+            // v1.24 OBS-18: after task-approved{release:attempt-cap}, replay zeros attempts so this loop
+            // starts at 0 (fresh budget) instead of re-parking at the cap in the same tick.
+            attempts: for (let attempt = rs?.attempts ?? 0;; attempt++) {
+                // v1.13 (VIS-09 safety): one FRESH nonce per attempt — see the run-scope comment above. A retained
+                // prior-attempt trailer (herdr scrollback / subprocess buffer) must never satisfy this attempt.
+                const nonce = randomBytes(4).toString("hex");
+                const exitMarkerCmd = `printf '\\nDROVR_''EXIT_${nonce}:%s\\n' $?`;
+                const exitRe = new RegExp(`DROVR_EXIT_${nonce}:(\\d+)`);
+                if (attempt >= MAX_ATTEMPTS) {
+                    await park(t, `attempt cap (${MAX_ATTEMPTS}) reached`, "attempt-cap", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                    return;
+                }
+                // v1.29: consume the prior gate-failed session once. Same channel + known under-threshold context
+                // + adapter capability resumes; every other path is today's fresh dispatch.
+                const priorSession = retrySession;
+                retrySession = undefined;
+                retryMode = priorSession
+                    && priorSession.channel === channelKey(assignment)
+                    && priorSession.contextTokens !== undefined
+                    && priorSession.contextTokens < cfg.contextWarnTokens
+                    && adapters.find((a) => a.id === assignment.adapter)?.resumeCommand
+                    ? "resume"
+                    : "fresh";
+                // v1.23 T3: over-threshold context still forces fresh at the retry boundary; never interrupt a
+                // running attempt. Unknown/below emits no reset event.
+                if (attempt > 0 && lastContextTokens !== undefined && lastContextTokens >= cfg.contextWarnTokens) {
+                    journal.append("session-reset", t.id, {
+                        tokens: lastContextTokens,
+                        threshold: cfg.contextWarnTokens,
+                        attempt, // the fresh attempt about to dispatch
+                    });
+                }
+                lastContextTokens = undefined;
+                graph = setStatus(graph, t.id, "running");
+                saveGraph(repoRoot, graph);
+                journal.append("task-dispatch", t.id, { assignment, attempt, provenance: r.provenance, retryMode });
+                const taskBase = await integrationHead(intWt); // deps are merged → visible to this task
+                const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
+                const wt = await driver.worktree(repoRoot, taskBranch, taskBase);
+                if (cfg.setup) {
+                    // v1.22 T3: setup runs inside the task worktree — seal herdr control vars so a setup script
+                    // cannot mutate the operator's panes. Worker/judge/review/consult are sealed at the driver
+                    // boundary (SubprocessDriver spawn env / HerdrDriver pane seed); this is the remaining
+                    // daemon-owned child shell that is not a driver.slot.
+                    const sr = await sh(`${herdrSealShellPrefix()}${cfg.setup}`, wt, 10 * 60_000);
+                    journal.append("worktree-setup", t.id, { code: sr.code });
+                    if (sr.code !== 0) {
+                        await park(t, `worktree setup failed (exit ${sr.code}): ${cfg.setup}`, "setup", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                        return;
+                    }
+                }
+                const promptFile = writePrompt(journal.dir, t, attempt, feedback, nonce);
+                const adapter = getAdapter(assignment.adapter, adapters);
+                // VIS-04: workers share one role tab. T2: `owned` names the pane canonically (ownership contract);
+                // the legacy name stays the fallback for drivers without owned handling (subprocess spies).
+                const slot = await driver.slot(wt, `${t.id}-worker-${assignment.adapter}-a${attempt}-${runTag}`, { group: "workers", owned: { role: "worker", taskId: t.id, attempt, runId } });
+                const sessionId = retryMode === "resume" ? priorSession.id : slot.name;
+                const icmd = retryMode === "resume"
+                    ? adapter.resumeCommand(sessionId, promptFile, assignment.model)
+                    : cfg.visibility.worker === "interactive" && driver.interactive
+                        ? adapter.interactiveCommand(promptFile, assignment.model)
+                        : null;
+                if (cfg.visibility.worker === "interactive" && icmd === null && !modeFallbackNoted) {
+                    modeFallbackNoted = true;
+                    journal.append("worker-mode-fallback", t.id, { reason: driver.interactive ? "adapter" : "driver" });
+                }
+                const interactive = icmd !== null;
+                // SPEND-01: this attempt's dispatch wall-clock — the usage collect cursor. Captured once here, the
+                // single site, so a test can reason about it; keep Date.now() out of profile.ts (still pure) and
+                // out of adapter module scope (the cursor is a parameter, threaded from the daemon).
+                const attemptStart = Date.now();
+                // v1.23 T2: once-per-attempt latch for context threshold crossing. Sample ONLY at existing poll
+                // seams (interactive wait slices) — never a new timer loop. null/unknown usage fails OPEN
+                // (never treated as over-threshold). Journal + notify fire at most once while the value stays high.
+                let contextWarned = false;
+                let contextTokens;
+                const sampleContext = async () => {
+                    if (contextWarned || !adapter.contextUsage)
+                        return;
+                    let usage = null;
+                    try {
+                        // SessionRef id stays stable across resume attempts; adapters return null on a store miss.
+                        usage = adapter.contextUsage({ cwd: wt, id: sessionId });
+                    }
+                    catch {
+                        return; // fail-open: a broken reader never blocks the attempt
+                    }
+                    if (!usage || typeof usage.tokens !== "number" || !Number.isFinite(usage.tokens))
+                        return;
+                    contextTokens = usage.tokens; // last known valid sample, including under-threshold resume candidates
+                    if (usage.tokens < cfg.contextWarnTokens)
+                        return;
+                    contextWarned = true;
+                    lastContextTokens = usage.tokens;
+                    journal.append("context-sample", t.id, {
+                        tokens: usage.tokens,
+                        ...(usage.limit !== undefined ? { limit: usage.limit } : {}),
+                        threshold: cfg.contextWarnTokens,
+                        attempt,
+                    });
+                    await driver.notify(`drovr ${runId}: ${t.id} context ${usage.tokens} tokens ≥ ${cfg.contextWarnTokens}`, { tier: "attention" });
+                };
+                let finished;
+                let output;
+                let exitCode;
+                if (interactive) {
+                    // v1.2 interactive: the TUI doesn't exit on completion — the trailer is the finish line.
+                    // The exit wrapper still fires if the TUI dies (crash/quit): fast-fail instead of burning the timeout.
+                    await driver.run(slot, `${icmd}; ${exitMarkerCmd}`);
+                    let paged = false;
+                    // v1.22 T5 / OBS-19: auto-answer a fingerprint-matched trust dialog exactly once per slot.
+                    // Any other blocked/idle dialog still pages the operator (paged latch below).
+                    let trustAnswered = false;
+                    finished = false;
+                    exitCode = null;
+                    output = "";
+                    const deadline = Date.now() + cfg.taskTimeoutMinutes * 60_000;
+                    while (Date.now() < deadline) {
+                        const sliceStart = Date.now();
+                        const slice = Math.min(BLOCKED_POLL_MS, deadline - sliceStart);
+                        if (await driver.waitOutput(slot, `(${trailerPattern(nonce)})|DROVR_EXIT_${nonce}:\\d`, slice, { regex: true })) {
+                            // verify before accepting: a worker that merely DISPLAYS a marker (e.g. editing drovr's
+                            // own source, where "DROVR_EXIT:" is a string literal) must not end the wait. Only a
+                            // parseable trailer or a digit-suffixed exit marker in the harvest is completion.
+                            output = await driver.read(slot, 1000); // TUI transcripts carry chrome — read deeper than print's 500
+                            finished = new RegExp(trailerPattern(nonce)).test(output);
+                            const exit = exitRe.exec(output);
+                            if (finished || exit) {
+                                exitCode = exit ? Number(exit[1]) : null; // null ⇔ the TUI is still alive
+                                await sampleContext(); // final poll-seam sample before leaving the wait
+                                break;
+                            }
+                        }
+                        // v1.23 T2: piggyback on this poll slice — same cadence as blocked/idle checks, no new timer.
+                        await sampleContext();
+                        // page on "idle" too: herdr's blocked-scrape is strict and proved flaky for TUI dialogs
+                        // (live check: cursor's trust dialog scraped as idle). "unknown" never pages — that's just
+                        // a pane the scraper can't read (subprocess, dead pane); the task timeout covers those.
+                        const st = paged ? "" : await driver.status(slot);
+                        if (!paged && (st === "blocked" || st === "idle")) {
+                            // T5: once-per-slot auto-answer when the adapter declares a trust dialog and the pane
+                            // text matches. drovr created the worktree from the operator's own repo — safe by construction.
+                            if (!trustAnswered && adapter.trustDialog && driver.sendKey) {
+                                try {
+                                    const paneText = await driver.read(slot, 80);
+                                    if (matchesTrustDialog(paneText, adapter.trustDialog)) {
+                                        trustAnswered = true;
+                                        // v1.25 T1: audit trail for live runs — prove the dialog appeared and was answered.
+                                        // Latch + sendKey + no-page continue stay byte-identical; this append is additive only.
+                                        journal.append("trust-auto-answer", t.id, { slot: slot.name, adapter: adapter.id });
+                                        await driver.sendKey(slot, adapter.trustDialog.key);
+                                        const spent = Date.now() - sliceStart;
+                                        if (spent < slice)
+                                            await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
+                                        continue; // do not page — keep waiting for the trailer
+                                    }
+                                }
+                                catch {
+                                    /* read/send failed — fall through to page the operator */
+                                }
+                            }
+                            paged = true; // page once — the visible pane is the operator's to unblock; task timeout is the backstop
+                            const why = st === "blocked" ? "is blocked on a prompt — approve in its pane" : "looks idle without finishing — check its pane";
+                            await driver.notify(`drovr ${runId}: ${slot.name} ${why}`, { tier: "attention" });
+                        }
+                        // a dead pane or a false-positive marker display returns fast — sleep the unspent slice, never hot-spin
+                        const spent = Date.now() - sliceStart;
+                        if (spent < slice)
+                            await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
+                    }
+                    if (!finished && exitCode === null) {
+                        // timed out (or only ever saw false positives): harvest whatever the pane holds now
+                        output = await driver.read(slot, 1000);
+                        finished = new RegExp(trailerPattern(nonce)).test(output);
+                        const exit = exitRe.exec(output);
+                        exitCode = exit ? Number(exit[1]) : null;
+                    }
+                    if (finished) {
+                        await driver.waitAgentStatus(slot, "idle", 5_000); // settle, then re-harvest the final render
+                        output = await driver.read(slot, 1000);
+                    }
+                }
+                else {
+                    const inv = adapter.invoke(t, wt, assignment, { promptFile });
+                    await driver.run(slot, `${inv.command}; ${exitMarkerCmd}`);
+                    finished = await driver.waitOutput(slot, `DROVR_EXIT_${nonce}:\\d`, cfg.taskTimeoutMinutes * 60_000, { regex: true });
+                    output = await driver.read(slot, 500);
+                    exitCode = Number(exitRe.exec(output)?.[1] ?? 1);
+                }
+                if (keepOpen)
+                    keptSlots.push(slot);
+                else
+                    await driver.close(slot);
+                // SPEND-01: usage from the harness's own cwd-keyed structured store, read POST-HOC from disk —
+                // `wt` is this task's private worktree, so the path is unique; the read is sliced to records
+                // stamped at/after this attempt's dispatch instant. Never the harvested pane text, never the
+                // parsed worker trailer. No interactive branch: a TUI writes the same store. undefined ⇒ unmetered.
+                // SPEND-02: fold this attempt's slice into the task accumulator only when it's a real observation —
+                // an absent record leaves `tokens`/`metered` untouched (never a materialized zero).
+                const attemptUsage = adapter.collectUsage?.(wt, attemptStart);
+                if (attemptUsage) {
+                    tokens = addUsage(tokens, attemptUsage);
+                    metered++;
+                }
+                const result = adapter.parse(output, nonce);
+                journal.append("worker-result", t.id, { ok: result.ok, summary: result.summary, deviations: result.deviations, finished, exitCode, mode: interactive ? "interactive" : "print" });
+                // quota exhaustion → failover within floor; does NOT consume the ladder (spec §4)
+                // print: guarded on exit code — exit-0 output that merely MENTIONS "rate limit" must not failover
+                // interactive: a harvested trailer beats quota mentions; without one, quota text fails over (spec v1.2 §2)
+                const quotaHit = (interactive ? !finished : exitCode !== 0) && QUOTA_RE.test(output);
+                if (quotaHit) {
+                    const next = failover("quota-failover");
+                    journal.append("quota-failover", t.id, { from: channelKey(assignment), to: next ? channelKey(next) : null });
+                    if (next) {
+                        await driver.notify(`drovr ${runId}: ${t.id} quota failover`, { tier: "attention" });
+                        // OBS-17 T2: the superseded slot's pane closes AT REROUTE TIME — it holds a throttled
+                        // dead-end, not failure context; the next safe-point reconcile catches a missed close.
+                        if (!keepForever) {
+                            const idx = keptSlots.indexOf(slot);
+                            if (idx >= 0) {
+                                keptSlots.splice(idx, 1);
+                                try {
+                                    await driver.close(slot);
+                                }
+                                catch { /* cosmetic — reconcile is the backstop */ }
+                            }
+                        }
+                        // v1.8 TEL-05 — FROM-channel attribution for mid-task quota failover: `assignment` is still the
+                        // throttled-away-FROM channel here (before the reassign below). durationMs:0 marks this as a
+                        // failover FACT, not a timed attempt. The park branch is deliberately NOT written here — park()
+                        // already records parkKind:"quota", so writing here too would double-count in Phase 26 ROUTE-12.
+                        journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts: attempt + 1, outcome: "failed", durationMs: 0, quotaFailover: true, retryMode });
+                        assignment = next;
+                        tried.push(channelKey(next));
+                        continue;
+                    }
+                    await park(t, "quota exhausted on every eligible channel", "quota", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                    return;
+                }
+                if (!finished) {
+                    // ROUTE-18 (OBS-04): the channel burned a window without emitting a trailer (no-trailer timeout
+                    // OR trailer-less crash-exit — both finished:false). durationMs:0 marks a FACT row, not a timed
+                    // attempt; attributed to the still-current assignment (the TEL-05 quotaFailover:382 shape, field
+                    // swapped). Strictly AFTER the quota check above — the quota branch returns/continues before
+                    // reaching here, so a quota hit can never also carry overrun (no double-count). Read side: 48-01.
+                    journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts: attempt + 1, outcome: "failed", durationMs: 0, overrun: true, retryMode });
+                    const v = await runConsult("stall", output, exitCode !== null && interactive
+                        ? `worker process exited (code ${exitCode}) without a trailer`
+                        : `no completion marker within ${cfg.taskTimeoutMinutes}m`, []);
+                    if (await applyVerdict(v, attempt + 1, "stall"))
+                        continue;
+                    return;
+                }
+                graph = setStatus(graph, t.id, "gated");
+                saveGraph(repoRoot, graph);
+                const onGate = async (e) => {
+                    if (e.phase === "start")
+                        return;
+                    const g = e.result;
+                    // GATE-09 (ROADMAP SC-4): journal every judge retry as an attributable event — which gate flaked,
+                    // which channel flaked, which channel retried — so `drovr journal`/report can distinguish "judge
+                    // flaked, retried" from "worker failed" (run-20260711-185020 P43-03 L70-72 billed a judge flake as
+                    // a worker attempt; 47-01 fixed WHO retries, this closes the audit-trail half). The condition is
+                    // META-ONLY (D-03): gate === "acceptance" + typeof-shape guards on meta.judgeRetry — never a
+                    // details-regex. The v1.1 review regex below is grandfathered, not precedent. Appended BEFORE the
+                    // gate-result so attribution precedes the verdict in the stream. secondUnparseable is derived from
+                    // the final result's meta.unparseable (set by run-gates when the retry ALSO flaked — double-garbage).
+                    if (g.gate === "acceptance" && typeof g.meta?.judgeRetry === "object" && g.meta.judgeRetry !== null) {
+                        const jr = g.meta.judgeRetry;
+                        if (typeof jr.flaked === "string" && typeof jr.retried === "string") {
+                            journal.append("judge-retry", t.id, {
+                                gate: "acceptance", flaked: jr.flaked, retried: jr.retried,
+                                ...(g.meta.unparseable === true ? { secondUnparseable: true } : {}),
+                            });
+                        }
+                    }
+                    journal.append("gate-result", t.id, { gate: g.gate, pass: g.pass, details: g.details });
+                    // v1.1 failover: never re-ask a reviewer channel that produced garbage for this task
+                    if (g.gate === "review" && !g.pass && /unparseable/.test(g.details) && typeof g.meta?.reviewer === "string") {
+                        badReviewers.push(g.meta.reviewer);
+                    }
+                };
+                let results = [];
+                let commits = [];
+                gateLoop: while (true) {
+                    const gated = await gitHead(wt);
+                    ({ results, commits } = await runGates(t, {
+                        worktree: wt, baseRef: taskBase, result, author: assignment,
+                        commands, baseline, channels, adapters, cfg,
+                        via: cfg.visibility.llm === "pane"
+                            ? {
+                                driver,
+                                // D-07: judge/review panes self-clean when their verdict is read (keepLlm) — only "forever" keeps them.
+                                keep: keepLlm,
+                                onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined,
+                                // T2 ownership contract: canonical names (drovr:<role>:<task>:0:<runId>) so reconcile
+                                // owns judge/review panes; run-gates' -r1 retry suffix becomes attempt 1 in llm.ts.
+                                // Same-name reuse across worker attempts is safe: panes self-clean when read (keepLlm),
+                                // and herdr's DEFECT-01 reclaim covers a kept holdover under keepPanes:forever.
+                                nameFor: (role) => formatOwnedName({ role, taskId: t.id, attempt: 0, runId }),
+                                // role-tab label (SUP-01): role-first + task id, unique per concurrent instance within a run.
+                                // Duplicate labels from a resumed run or operator-made tabs are accepted (per-process state).
+                                labelFor: (role) => `${role.toUpperCase()} ${t.id}`,
+                            }
+                            : undefined,
+                        excludeReviewers: badReviewers,
+                        onGate,
+                    }));
+                    graph = addEvidence(graph, t.id, { commits, gateResults: results, artifacts: [promptFile] });
+                    saveGraph(repoRoot, graph);
+                    if (results.every((g) => g.pass)) {
+                        const m = await mergeSerial(taskBranch, t, gated);
+                        if (m.tipMoved) {
+                            journal.append("tip-moved", t.id, m.tipMoved);
+                            if (tipMoves++ === 0)
+                                continue gateLoop;
+                            await park(t, "task branch tip moved twice after gating", null, assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
+                        if (!m.ok) {
+                            journal.append("merge-conflict", t.id, { conflict: m.conflict });
+                            const v = await runConsult("merge-conflict", output, m.conflict ?? "", results);
+                            if (await applyVerdict(v, attempt + 1, "merge-conflict"))
+                                continue attempts;
+                            return;
+                        }
+                        graph = setStatus(graph, t.id, "done");
+                        saveGraph(repoRoot, graph);
+                        journal.append("task-done", t.id, { attempts: attempt + 1, assignment });
+                        journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
+                        // firstAttemptOk/gateFails/consults are recorded FACTS, not policy — a parkKind:"stall" row is
+                        // recorded but NOT quality-negative in v1.6; Phase 12 owns reward policy, so flipping it later needs zero data migration.
+                        journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts: attempt + 1, outcome: "done", durationMs: Date.now() - startMs, firstAttemptOk: attempt === 0, gateFails, consults, tokens, meteredAttempts: tokens ? metered : undefined, retryMode });
+                        // D-07 done means gone (merged-P42-01-worker incident): a merged task's worker pane closes on
+                        // the task-done path, not at run end. Only THIS successful attempt's `slot` is in scope — prior
+                        // failed attempts' slots stay in keptSlots governed by keepPanes (they hold failure context the
+                        // operator may need). keepPanes:"forever" is the keep-everything debug override. Removing from
+                        // keptSlots guarantees the run-end sweep cannot double-close; the indexOf guard also covers
+                        // "attempt" (slot already closed per-attempt at the worker line above) — close only what you own (Pitfall 5).
+                        if (!keepForever) {
+                            const idx = keptSlots.indexOf(slot);
+                            if (idx >= 0) {
+                                keptSlots.splice(idx, 1);
+                                await driver.close(slot);
+                            }
+                        }
+                        await reconcile({ spareLiveLlm: true }); // task-done is a terminal event — sweep this task's leftovers
+                        return;
+                    }
+                    break gateLoop;
+                }
+                gateFails++; // this attempt's gates failed — the one place quality degradation is verified (never inferred from attempts)
+                retrySession = { channel: channelKey(assignment), id: sessionId, contextTokens };
+                feedback = results.filter((g) => !g.pass).map((g) => `${g.gate}: ${g.details}`).join("\n\n");
+                const step = r.ladder[Math.min(ladderIdx++, r.ladder.length - 1)];
+                journal.append("escalation", t.id, { step, attempt: attempt + 1 });
+                await driver.notify(`drovr ${runId}: ${t.id} escalation: ${step}`, { tier: "attention" });
+                if (step === "retry")
+                    continue;
+                if (step === "escalate") {
+                    const next = failover("escalate");
+                    if (next) {
+                        assignment = next;
+                        tried.push(channelKey(next));
+                        continue;
+                    }
+                    // no channel left — fall through to a consult
+                }
+                if (step === "escalate" || step === "consult") {
+                    const v = await runConsult("gate-fail", output, feedback, results);
+                    if (await applyVerdict(v, attempt + 1, "gate-fail"))
+                        continue;
+                    return;
+                }
+                await park(t, "escalation ladder exhausted", "ladder-exhausted", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                return;
+            }
+        };
+        const inflight = new Map();
+        while (true) {
+            const ready = readyTasks(graph)
+                .filter((t) => !inflight.has(t.id))
+                .slice(0, Math.max(0, concurrency - inflight.size));
+            for (const t of ready) {
+                const p = execTask(t)
+                    .catch(async (err) => {
+                    graph = setStatus(graph, t.id, "failed");
+                    saveGraph(repoRoot, graph);
+                    journal.append("task-failed", t.id, { error: String(err) });
+                    journal.telemetry({ taskId: t.id, shape: t.shape, adapter: "-", model: "-", channel: "-", attempts: 0, outcome: "failed", durationMs: 0 });
+                    await reconcile({ spareLiveLlm: true }); // task-failed is a terminal event
+                })
+                    .finally(() => inflight.delete(t.id));
+                inflight.set(t.id, p);
+            }
+            if (inflight.size === 0)
+                break;
+            await Promise.race(inflight.values());
+        }
+        // D-07: the sweep now closes only what's LEFT in keptSlots — done-closed worker slots were removed
+        // (no double-close) and self-cleaned LLM/consult panes were never added under keepLlm:false. This
+        // leaves failed/parked attempts' worker slots, which keep their failure context until run end.
+        if (cfg.visibility.keepPanes === "run") {
+            for (const s of keptSlots)
+                await driver.close(s); // panes persist for the run's duration, then clean up
+        }
+        saveGraph(repoRoot, graph);
+        const byStatus = (s) => graph.tasks.filter((t) => t.status === s).map((t) => t.id);
+        // buckets derived from the graph at summary time (D-01/D-02); the loop has exited with
+        // inflight.size === 0, so the five buckets sum to graph.tasks.length by construction.
+        const summary = {
+            runId,
+            branch,
+            done: byStatus("done"),
+            failed: byStatus("failed"),
+            human: byStatus("human"),
+            blocked: blockedTasks(graph).map((t) => t.id),
+            pending: pendingTasks(graph).map((t) => t.id),
+        };
+        journal.append("run-end", undefined, { ...summary });
+        await reconcile(); // run-end boundary: nothing in flight — full sweep (empty desired set)
+        // VIS-02: name each blocked subtree by its nearest parked/failed root, e.g. "3 blocked behind P40-02".
+        const attribution = [...attributeBlocked(graph).entries()]
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([root, count]) => `${count} blocked behind ${root}`)
+            .join(", ");
+        await driver.notify(`drovr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""} — integration branch ${branch} (merge to main is yours)`, { tier: "attention" });
+        return summary;
+    }
+    finally {
+        // T6: close the narrator at run end — cosmetic, swallowed (never blocks lock release)
+        if (narrator) {
+            try {
+                await driver.close(narrator);
+            }
+            catch { /* cosmetic */ }
+        }
+        releaseRunLock(repoRoot);
+    }
+}