tickmarkr 1.44.0 → 1.46.0

package/dist/run/consult.js

@@ -1,8 +1,8 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getAdapter } from "../adapters/registry.js";
-import { bannerShell, paneDispatchCommand, paneDispatchScript } from "../brand.js";
-import { extractJson, gatePaneName } from "../gates/llm.js";
+import { bannerShell, paneDispatchCommand } from "../brand.js";
+import { augmentFakeVerdictOutput, extractVerdictJson, gateExitTrailer, gatePaneName, generateVerdictNonce, verdictNonceLine } from "../gates/llm.js";
 import { sh } from "./git.js";
 const MAX_RETRY_GUIDANCE_LINES = 10;
 function guidanceParts(text) {
@@ -19,8 +19,43 @@ export function renderRetryGuidance(v) {
         lines.push(part);
     return lines.slice(0, MAX_RETRY_GUIDANCE_LINES).map((l) => `- ${l}`).join("\n");
 }
+const LANDED_COMMIT_PREMISE_RE = /\b(?:already\s+committed|is\s+already\s+committed|landed\s+commit|implementation\s+is\s+already)\b/i;
+const COMMIT_HASH_RE = /\b[0-9a-f]{7,40}\b/gi;
+// OBS-58: name prior attempt commits by hash and drop consult premises about landed work that the
+// fresh worktree does not satisfy — regenerated against post-recreation state, not inherited verbatim.
+export function augmentRetryBrief(feedback, opts) {
+    const { attempted, carried, present } = opts;
+    const named = [...new Set([...attempted, ...carried])];
+    const presentLower = new Set([...present].map((h) => h.toLowerCase()));
+    const parts = [];
+    if (named.length > 0) {
+        parts.push("## Prior attempt commits (by hash)\n"
+            + named.map((h) => `- ${h}${presentLower.has(h.toLowerCase()) ? " — present in this worktree" : " — not in this worktree"}`).join("\n"));
+    }
+    let body = feedback.trim();
+    if (body && LANDED_COMMIT_PREMISE_RE.test(body)) {
+        const falseHash = [...body.matchAll(COMMIT_HASH_RE)].some((m) => !presentLower.has(m[0].toLowerCase()));
+        const falseLanded = carried.length === 0 && attempted.length > 0;
+        if (falseHash || falseLanded) {
+            body = body
+                .split("\n")
+                .filter((line) => !LANDED_COMMIT_PREMISE_RE.test(line))
+                .join("\n")
+                .trim();
+            const correction = carried.length > 0
+                ? `Prior attempt work is present at: ${carried.join(", ")}.`
+                : attempted.length > 0
+                    ? "Prior attempt commits could not be carried forward onto this worktree — re-land the work or continue from the integration tip."
+                    : "No prior attempt commits are present in this worktree — implement from the integration tip.";
+            body = body ? `${correction}\n\n${body}` : correction;
+        }
+    }
+    if (body)
+        parts.push(body);
+    return parts.join("\n\n");
+}
 const ACTIONS = ["retry", "reroute", "decompose", "human"];
-export function buildDossierPrompt(d) {
+export function buildDossierPrompt(d, nonce) {
     return `TICKMARKR-CONSULT
 You are a senior engineering consult for the tickmarkr orchestrator. A worker task hit trouble.
 Read the dossier and return a verdict. Be decisive; cost is the lowest priority, quality the highest.
@@ -47,8 +82,10 @@ channel of that adapter for this task. Use it for environmental failures ("the C
 trust dialog, broken install) — not when a single model produced bad code. Omit for model-level
 reroutes so other models of the same adapter remain eligible.
 
+${verdictNonceLine(nonce)}
+
 Respond with ONLY this JSON:
-{"action": "retry" | "reroute" | "decompose" | "human", "reason": "why this action", "guidance": "imperative steps for the worker (newline-separated ok)", "excludeAdapter"?: "<adapter-id>"}
+{"nonce": "${nonce}", "action": "retry" | "reroute" | "decompose" | "human", "reason": "why this action", "guidance": "imperative steps for the worker (newline-separated ok)", "excludeAdapter"?: "<adapter-id>"}
 `;
 }
 let consultSeq = 0;
@@ -57,15 +94,17 @@ export async function consult(d, cfg, adapters, driver, cwd, runDir,
 // via SlotOpts.owned; without it the legacy gatePaneName shape survives (non-daemon callers/tests).
 opts = {}) {
     const n = ++consultSeq;
+    const nonce = generateVerdictNonce();
     const dir = join(runDir, "consults");
     mkdirSync(dir, { recursive: true });
     const promptFile = join(dir, `${d.taskId}-${n}.md`);
-    writeFileSync(promptFile, buildDossierPrompt(d));
+    writeFileSync(promptFile, buildDossierPrompt(d, nonce));
     const adapter = getAdapter(cfg.consult.adapter, adapters);
     let out;
     if (cfg.visibility.llm === "headless") {
         const r = await sh(adapter.headlessCommand(promptFile, cfg.consult.model), cwd, cfg.consult.stallMinutes * 60_000);
         out = r.stdout + r.stderr;
+        out = augmentFakeVerdictOutput(adapter, out, nonce);
     }
     else {
         // T8: role-first pane name for fleet visibility (consult · T2); consultSeq stays on the dossier artifact only
@@ -76,16 +115,21 @@ opts = {}) {
         opts.onSlot?.(slot);
         const scriptPath = join(dir, `${d.taskId}-${n}.sh`);
         // OBS-50: visible consult panes get the brand banner; headless path above stays banner-free (machine-parsed stdout)
-        writeFileSync(scriptPath, paneDispatchScript([bannerShell(), adapter.headlessCommand(promptFile, cfg.consult.model)]));
+        writeFileSync(scriptPath, [
+            "export BASH_SILENCE_DEPRECATION_WARNING=1",
+            bannerShell(),
+            adapter.headlessCommand(promptFile, cfg.consult.model),
+            gateExitTrailer(nonce),
+        ].join("\n"));
         await driver.run(slot, paneDispatchCommand(scriptPath));
-        // digit-suffixed marker only: a dossier quoting tickmarkr's own "TICKMARKR_EXIT:" literal must not
-        // false-complete the consult pane before its verdict (same guard as daemon.ts:193 / llm.ts).
-        await driver.waitOutput(slot, "TICKMARKR_EXIT:\\d", cfg.consult.stallMinutes * 60_000, { regex: true });
+        // nonce-suffixed exit only: a dossier quoting tickmarkr's own exit literal must not false-complete.
+        await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, cfg.consult.stallMinutes * 60_000, { regex: true });
         out = await driver.read(slot, 300);
         if (!opts.keep)
             await driver.close(slot);
+        out = augmentFakeVerdictOutput(adapter, out, nonce);
     }
-    const v = extractJson(out);
+    const v = extractVerdictJson(out, nonce);
     if (!v || !ACTIONS.includes(v.action)) {
         return { action: "human", notes: "consult verdict unparseable — failing safe to human" };
     }

package/dist/run/daemon.d.ts

@@ -4,6 +4,7 @@ import { type JournalEvent } from "./journal.js";
 export interface RunOptions {
     runId?: string;
     resume?: boolean;
+    graphChanged?: boolean;
     concurrency?: number;
     driver?: ExecutorDriver;
     adapters?: WorkerAdapter[];

package/dist/run/daemon.js

@@ -1,5 +1,6 @@
 import { randomBytes } from "node:crypto";
-import { readFileSync, writeFileSync } from "node:fs";
+import { shq } from "../adapters/types.js";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { trailerPattern, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, discoverChannels, getAdapter, probeAll, readDoctor } from "../adapters/registry.js";
@@ -9,10 +10,10 @@ import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
-import { addEvidence, attributeBlocked, blockedTasks, getTask, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
-import { consult, renderRetryGuidance } from "./consult.js";
-import { cleanupRunWorktrees, gitHead, linkNodeModules, sh, WORKTREE_LAYOUT_CONTRACT } from "./git.js";
-import { Journal, loadRoutingProfile, newRunId } from "./journal.js";
+import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
+import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
+import { cleanupRunWorktrees, gitHead, linkNodeModules, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { classifyWorkerResultCause, engagementComparable, Journal, loadRoutingProfile, newRunId } from "./journal.js";
 import { acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
 import { nextChannel, route } from "../route/router.js";
@@ -27,6 +28,30 @@ export function formatSummary(s) {
 }
 const MAX_ATTEMPTS = 10; // ponytail: hard cap so a pathological ladder can never loop forever
 const BLOCKED_POLL_MS = 30_000; // between trailer-wait slices, check whether the pane is blocked on a prompt
+const PROVIDER_DEATH_REQUEUE_CAP = 2; // v1.46 T1: requeue same assignment twice, then fall through to the normal ladder
+const PROVIDER_DEATH_BACKOFF_MS = 500; // short backoff before provider-death requeue
+const NO_TRAILER_DEMOTION_STREAK = 2; // OBS-57: consecutive no-trailer windows demote a channel for the rest of the run
+async function commitsAheadOf(base, wt) {
+    const head = await gitHead(wt);
+    if (head === base)
+        return [];
+    const r = await shGit(`git log --reverse --format=%H ${shq(base)}..${shq(head)}`, wt);
+    if (r.code !== 0)
+        return [];
+    return r.stdout.trim().split("\n").filter(Boolean);
+}
+async function cherryPickCommits(wt, commits) {
+    const carried = [];
+    for (const hash of commits) {
+        const r = await shGit(`git cherry-pick --no-gpg-sign ${shq(hash)}`, wt);
+        if (r.code !== 0) {
+            await shGit("git cherry-pick --abort", wt);
+            break;
+        }
+        carried.push(hash);
+    }
+    return carried;
+}
 export async function runDaemon(repoRoot, opts = {}) {
     const cfg = loadConfig(repoRoot, { globalDir: opts.globalDir });
     const adapters = opts.adapters ?? allAdapters();
@@ -74,6 +99,24 @@ export async function runDaemon(repoRoot, opts = {}) {
             if (!start)
                 throw new Error(`journal for ${runId} has no run-start event`);
             baseRef = start.data.baseRef;
+            // T3 (Sol #2 / Fable F2): refuse to replay this journal's task states onto a graph it does not
+            // belong to — overlapping ids would inherit foreign done/human/approval state, missing ids throw.
+            // The SAME comparator status uses (engagementComparable); one decision, two consumers. Fail closed:
+            // no resume path silently accepts a mismatched or unbound journal. --graph-changed is the operator's
+            // audited release for the stop-amend-resume workflow, journaling a graph-rehash naming both hashes.
+            const loadedHash = graphDefinitionHash(graph);
+            const cmp = engagementComparable(journal.read(), loadedHash);
+            if (!cmp.comparable) {
+                if (!opts.graphChanged) {
+                    throw new Error(cmp.reason === "unbound"
+                        ? `refusing to resume ${runId}: journal has no recorded graph definition hash (older tickmarkr) — pass --graph-changed to override`
+                        : `refusing to resume ${runId}: graph changed since this run (recorded ${cmp.recorded} ≠ loaded ${loadedHash}) — pass --graph-changed to override`);
+                }
+                journal.append("graph-rehash", undefined, {
+                    from: cmp.reason === "mismatch" ? cmp.recorded : null,
+                    to: loadedHash,
+                });
+            }
             baseline = JSON.parse(readFileSync(join(journal.dir, "baseline.json"), "utf8"));
             for (const [id, st] of journal.replayStatuses()) {
                 // operator release: a graph.json edit back to "pending" beats a replayed human/failed park (locked decision 12)
@@ -87,7 +130,7 @@ export async function runDaemon(repoRoot, opts = {}) {
             baseRef = await gitHead(repoRoot);
             baseline = await captureBaseline(repoRoot, commands);
             writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(baseline, null, 2));
-            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphHash: graph.spec.hash }); // graphHash: OBS-52 status join guard; pid: v1.13 (VIS-11) liveness
+            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphDefinitionHash: graphDefinitionHash(graph) }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness
         }
         // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
         // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
@@ -110,6 +153,9 @@ export async function runDaemon(repoRoot, opts = {}) {
         const keepLlm = keepForever;
         const keptSlots = [];
         const runTag = runId.replace(/^run-/, ""); // full date-time — cross-run unique even across days
+        // OBS-57: per-run in-run demotion — channels that burn consecutive no-trailer windows route around for later attempts.
+        const demotedChannels = new Set();
+        const noTrailerStreak = new Map();
         // OBS-17 T2: reconcile at every safe point — run start/resume (just journaled above), each task
         // terminal event, and run-end. The desired set is the pure journal fold (reconcile.ts); the driver
         // owns listing/parsing/closing. Cosmetic by contract: failures are swallowed and subprocess has no
@@ -145,14 +191,14 @@ export async function runDaemon(repoRoot, opts = {}) {
             mergeChain = next.catch(() => undefined);
             return next;
         };
-        // kind is null only at the humanGate call (assignment null ⇒ no row anyway); gateFails/consults are
-        // execTask-scoped counters passed in so a park row is a rich verified-failure observation (e.g. ladder-exhausted + gateFails:4).
+        // gateFails/consults are execTask-scoped counters passed in so a park row is a rich verified-failure
+        // observation (e.g. ladder-exhausted + gateFails:4); every task-human row has a closed kind, never prose alone.
         const park = async (t, reason, kind, assignment, attempts, startMs, gateFails = 0, consults = 0, tokens, metered = 0, retryMode = "fresh") => {
             graph = setStatus(graph, t.id, "human");
             saveGraph(repoRoot, graph);
-            journal.append("task-human", t.id, { reason });
+            journal.append("task-human", t.id, { reason, kind });
             if (assignment) {
-                journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts, outcome: "human", durationMs: Date.now() - startMs, parkKind: kind ?? undefined, gateFails, consults, tokens, meteredAttempts: tokens ? metered : undefined, retryMode });
+                journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts, outcome: "human", durationMs: Date.now() - startMs, parkKind: kind, gateFails, consults, tokens, meteredAttempts: tokens ? metered : undefined, retryMode });
             }
             await reconcile({ spareLiveLlm: true }); // task-human is a terminal event — sweep, sparing sibling tasks' live LLM panes
             await driver.notify(`tickmarkr ${runId}: ${t.id} needs a human — ${reason}`, { tier: "attention" });
@@ -165,10 +211,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // term) would silently dispatch every unapproved gate that becomes ready during a resume — pinned
                 // by the resume-path guard pin in tests/run/daemon.test.ts (the only test that reaches this guard
                 // on the resume path; a park-then-resume task is filtered out by readyTasks() and never gets here).
-                await park(t, `humanGate: "${t.title}" requires approval before dispatch`, null, null, 0, startMs);
+                await park(t, `humanGate: "${t.title}" requires approval before dispatch`, "human-gate", null, 0, startMs);
                 return;
             }
-            const r = route(t, cfg, channels, profile);
+            const r = route(t, cfg, channels, profile, undefined, demotedChannels);
             for (const lint of r.lints)
                 journal.append("routing-lint", t.id, { lint });
             // VIS-02: journal a deviation from the static choice ONLY when one occurred (greppable absence = no deviation)
@@ -193,7 +239,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // trailing-reroute edge (kill between verdict and dispatch), a stale fleet, OR a fresh-budget
                 // release (attempts 0 + non-empty tried): pick a failover over the replayed exclusions via the
                 // EXISTING nextChannel `tried` parameter — zero router changes (D-03).
-                const next = nextChannel(assignment, t, cfg, channels, rs.tried, profile);
+                const next = nextChannel(assignment, t, cfg, channels, rs.tried, profile, demotedChannels);
                 if (next)
                     assignment = next;
                 // ponytail: nextChannel null (every channel already tried / none available) — keep the static
@@ -227,9 +273,9 @@ export async function runDaemon(repoRoot, opts = {}) {
             // ROUTE-13: learned within-band failover + deviation audit. nextChannel stays pure (route/ never
             // journals); the daemon compares the learned pick against the static pick and owns the journal write.
             const failover = (site) => {
-                const next = nextChannel(assignment, t, cfg, channels, tried, profile);
+                const next = nextChannel(assignment, t, cfg, channels, tried, profile, demotedChannels);
                 if (profile && next) {
-                    const staticNext = nextChannel(assignment, t, cfg, channels, tried);
+                    const staticNext = nextChannel(assignment, t, cfg, channels, tried, undefined, demotedChannels);
                     if (staticNext && channelKey(next) !== channelKey(staticNext)) {
                         journal.append("failover-deviation", t.id, { site, static: channelKey(staticNext), chosen: channelKey(next) });
                     }
@@ -293,7 +339,13 @@ export async function runDaemon(repoRoot, opts = {}) {
             // the existing attempt-cap check below with zero new code. Fresh path: rs is undefined ⇒ 0.
             // v1.24 OBS-18: after task-approved{release:attempt-cap}, replay zeros attempts so this loop
             // starts at 0 (fresh budget) instead of re-parking at the cap in the same tick.
+            let providerDeathRequeues = 0;
+            let providerDeathAttempt = -1;
             attempts: for (let attempt = rs?.attempts ?? 0;; attempt++) {
+                if (attempt !== providerDeathAttempt) {
+                    providerDeathRequeues = 0;
+                    providerDeathAttempt = attempt;
+                }
                 // v1.13 (VIS-09 safety): one FRESH nonce per attempt — see the run-scope comment above. A retained
                 // prior-attempt trailer (herdr scrollback / subprocess buffer) must never satisfy this attempt.
                 const nonce = randomBytes(4).toString("hex");
@@ -303,6 +355,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                     await park(t, `attempt cap (${MAX_ATTEMPTS}) reached`, "attempt-cap", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
                     return;
                 }
+                // OBS-57: a demoted channel must not be re-dispatched on consult retry or provider requeue.
+                if (demotedChannels.has(channelKey(assignment))) {
+                    const next = nextChannel(assignment, t, cfg, channels, tried, profile, demotedChannels);
+                    if (next) {
+                        assignment = next;
+                        const k = channelKey(next);
+                        if (!tried.includes(k))
+                            tried.push(k);
+                    }
+                }
                 // v1.29: consume the prior gate-failed session once. Same channel + known under-threshold context
                 // + adapter capability resumes; every other path is today's fresh dispatch.
                 const priorSession = retrySession;
@@ -329,7 +391,27 @@ export async function runDaemon(repoRoot, opts = {}) {
                 journal.append("task-dispatch", t.id, { assignment, attempt, provenance: r.provenance, retryMode });
                 const taskBase = await integrationHead(intWt); // deps are merged → visible to this task
                 const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
+                const priorWt = worktreePath(repoRoot, taskBranch);
+                const commitsToCarry = existsSync(priorWt) ? await commitsAheadOf(taskBase, priorWt) : [];
                 const wt = await driver.worktree(repoRoot, taskBranch, taskBase);
+                // OBS-58: quota-failover and every retry recreate the task worktree from the integration tip —
+                // cherry-pick prior attempts' landed commits forward so a failover dispatch cannot silently
+                // orphan work a consult already verified as landed.
+                let carriedCommits = [];
+                if (commitsToCarry.length > 0) {
+                    carriedCommits = await cherryPickCommits(wt, commitsToCarry);
+                    journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
+                }
+                const priorNamed = [...new Set([...commitsToCarry, ...carriedCommits])];
+                const presentCommits = new Set(carriedCommits);
+                for (const h of commitsToCarry) {
+                    if (!presentCommits.has(h) && (await shGit(`git merge-base --is-ancestor ${shq(h)} HEAD`, wt)).code === 0) {
+                        presentCommits.add(h);
+                    }
+                }
+                if (feedback || priorNamed.length > 0) {
+                    feedback = augmentRetryBrief(feedback, { attempted: commitsToCarry, carried: carriedCommits, present: presentCommits });
+                }
                 if (cfg.setup) {
                     // v1.22 T3: setup runs inside the task worktree — seal herdr control vars so a setup script
                     // cannot mutate the operator's panes. Worker/judge/review/consult are sealed at the driver
@@ -343,11 +425,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                 }
                 const promptFile = writePrompt(journal.dir, t, attempt, feedback, nonce);
+                // OBS-56: state the non-interactive, one-pass finish contract and the OBS-54 stall budget in every
+                // worker prompt, not only consult retry guidance. Prepended so prompt.ts's completion trailer stays last.
+                const workerContract = `## Harness contract\n- This harness is non-interactive: make one continuous pass; do not stop for questions or follow-up input.\n- You have a ${taskTimeoutMinutes} minute stall window. Budget the full suite once, then commit and emit the completion trailer before it expires.`;
                 // OBS-47: state the worktree layout contract in the worker prompt (cheap-tier workers were
-                // committing/deleting node_modules and tripping the scope gate). Prepended, not appended, so the
-                // completion trailer stays the structural last line (prompt.ts's design). The harness re-asserts
-                // the link itself before gates regardless of what the worker does with it.
-                writeFileSync(promptFile, `${WORKTREE_LAYOUT_CONTRACT}\n\n${readFileSync(promptFile, "utf8")}`);
+                // committing/deleting node_modules and tripping the scope gate). The harness re-asserts the link
+                // itself before gates regardless of what the worker does with it.
+                writeFileSync(promptFile, `${WORKTREE_LAYOUT_CONTRACT}\n\n${workerContract}\n\n${readFileSync(promptFile, "utf8")}`);
                 const adapter = getAdapter(assignment.adapter, adapters);
                 // VIS-04: workers share one role tab. T2: `owned` names the pane canonically (ownership contract);
                 // the legacy name stays the fallback for drivers without owned handling (subprocess spies).
@@ -401,6 +485,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 let finished;
                 let output;
                 let exitCode;
+                let timedOut = false;
                 if (interactive) {
                     // v1.2 interactive: the TUI doesn't exit on completion — the trailer is the finish line.
                     // The exit wrapper still fires if the TUI dies (crash/quit): fast-fail instead of burning the timeout.
@@ -411,11 +496,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                     let trustAnswered = false;
                     finished = false;
                     exitCode = null;
-                    output = "";
-                    const deadline = Date.now() + taskTimeoutMinutes * 60_000;
-                    while (Date.now() < deadline) {
+                    output = await driver.read(slot, 1000);
+                    // OBS-54: reaping keys on new pane output, not dispatch wall clock. Poll at least twice per
+                    // stall window (and at the existing 30s cadence for normal windows) so an active worker resets it.
+                    const stallWindowMs = taskTimeoutMinutes * 60_000;
+                    let lastOutput = output;
+                    let lastOutputAt = Date.now();
+                    while (Date.now() - lastOutputAt < stallWindowMs) {
                         const sliceStart = Date.now();
-                        const slice = Math.min(BLOCKED_POLL_MS, deadline - sliceStart);
+                        const remaining = stallWindowMs - (sliceStart - lastOutputAt);
+                        const slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
                         if (await driver.waitOutput(slot, `(${trailerPattern(nonce)})|TICKMARKR_EXIT_${nonce}:\\d`, slice, { regex: true })) {
                             // verify before accepting: a worker that merely DISPLAYS a marker (e.g. editing tickmarkr's
                             // own source, where "TICKMARKR_EXIT:" is a string literal) must not end the wait. Only a
@@ -429,6 +519,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 break;
                             }
                         }
+                        const currentOutput = await driver.read(slot, 1000);
+                        if (currentOutput !== lastOutput) {
+                            lastOutput = currentOutput;
+                            lastOutputAt = Date.now();
+                        }
                         // v1.23 T2: piggyback on this poll slice — same cadence as blocked/idle checks, no new timer.
                         await sampleContext();
                         // page on "idle" too: herdr's blocked-scrape is strict and proved flaky for TUI dialogs
@@ -468,6 +563,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                     if (!finished && exitCode === null) {
                         // timed out (or only ever saw false positives): harvest whatever the pane holds now
+                        timedOut = Date.now() - lastOutputAt >= stallWindowMs;
                         output = await driver.read(slot, 1000);
                         finished = new RegExp(trailerPattern(nonce)).test(output);
                         const exit = exitRe.exec(output);
@@ -481,9 +577,27 @@ export async function runDaemon(repoRoot, opts = {}) {
                 else {
                     const inv = adapter.invoke(t, wt, assignment, { promptFile });
                     await driver.run(slot, `${inv.command}; ${exitMarkerCmd}`);
-                    finished = await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, taskTimeoutMinutes * 60_000, { regex: true });
+                    // OBS-54: headless workers have the same output-inactivity budget as visible panes.
+                    const stallWindowMs = taskTimeoutMinutes * 60_000;
+                    let lastOutput = await driver.read(slot, 500);
+                    let lastOutputAt = Date.now();
+                    finished = false;
+                    while (Date.now() - lastOutputAt < stallWindowMs) {
+                        const remaining = stallWindowMs - (Date.now() - lastOutputAt);
+                        const slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
+                        if (await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, slice, { regex: true })) {
+                            finished = true;
+                            break;
+                        }
+                        const currentOutput = await driver.read(slot, 500);
+                        if (currentOutput !== lastOutput) {
+                            lastOutput = currentOutput;
+                            lastOutputAt = Date.now();
+                        }
+                    }
                     output = await driver.read(slot, 500);
                     exitCode = Number(exitRe.exec(output)?.[1] ?? 1);
+                    timedOut = !finished && Date.now() - lastOutputAt >= stallWindowMs;
                 }
                 // SPEND-01 interactive metering race: the harvest loop breaks on the trailer, but the worker
                 // shell may still be running post-trailer bookkeeping (session-store flush, fake usage stamp,
@@ -511,7 +625,31 @@ export async function runDaemon(repoRoot, opts = {}) {
                     metered++;
                 }
                 const result = adapter.parse(output, nonce);
-                journal.append("worker-result", t.id, { ok: result.ok, summary: result.summary, deviations: result.deviations, finished, exitCode, mode: interactive ? "interactive" : "print" });
+                const cause = classifyWorkerResultCause({ output, ok: result.ok, finished, exitCode, summary: result.summary, timedOut });
+                journal.append("worker-result", t.id, {
+                    ok: result.ok, summary: result.summary, deviations: result.deviations, finished, exitCode,
+                    mode: interactive ? "interactive" : "print", ...(cause ? { cause } : {}),
+                });
+                if (result.ok && finished)
+                    noTrailerStreak.set(channelKey(assignment), 0);
+                else if (!finished && cause !== "provider-death") {
+                    const ck = channelKey(assignment);
+                    const streak = (noTrailerStreak.get(ck) ?? 0) + 1;
+                    noTrailerStreak.set(ck, streak);
+                    // OBS-57: two consecutive no-trailer windows in one run demote the channel for later attempts.
+                    if (streak >= NO_TRAILER_DEMOTION_STREAK && !demotedChannels.has(ck)) {
+                        demotedChannels.add(ck);
+                        journal.append("channel-demotion", t.id, { channel: ck, streak });
+                    }
+                }
+                // v1.46 T1: provider-outage requeue — same assignment, no attempt burn, no consult, capped.
+                if (cause === "provider-death" && providerDeathRequeues < PROVIDER_DEATH_REQUEUE_CAP) {
+                    providerDeathRequeues++;
+                    journal.append("provider-death-requeue", t.id, { attempt, requeue: providerDeathRequeues, assignment });
+                    await new Promise((r) => setTimeout(r, PROVIDER_DEATH_BACKOFF_MS));
+                    attempt--;
+                    continue;
+                }
                 // quota exhaustion → failover within floor; does NOT consume the ladder (spec §4)
                 // print: guarded on exit code — exit-0 output that merely MENTIONS "rate limit" must not failover
                 // interactive: a harvested trailer beats quota mentions; without one, quota text fails over (spec v1.2 §2)
@@ -632,7 +770,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("tip-moved", t.id, m.tipMoved);
                             if (tipMoves++ === 0)
                                 continue gateLoop;
-                            await park(t, "task branch tip moved twice after gating", null, assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                            await park(t, "task branch tip moved twice after gating", "tip-moved", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
                             return;
                         }
                         if (!m.ok) {
@@ -777,7 +915,7 @@ export async function runDaemon(repoRoot, opts = {}) {
         const tipFail = summary.tipVerify === "failed"
             ? ` — TIP VERIFY FAILED on ${summary.lastMergedTask ? `last merge ${summary.lastMergedTask}` : "integration tip"}`
             : "";
-        await driver.notify(`tickmarkr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""}${tipFail} — integration branch ${branch} (merge to main is yours)`, { tier: summary.tipVerify === "failed" ? "attention" : "attention" });
+        await driver.notify(`tickmarkr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""}${tipFail} — integration branch ${branch} (merge to main is yours)`, { tier: summary.tipVerify === "failed" ? "attention" : "routine" });
         return summary;
     }
     finally {

package/dist/run/git.d.ts

@@ -5,7 +5,9 @@ export interface ShResult {
     timedOut?: boolean;
 }
 export declare function sh(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
+export declare function shGit(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
+export declare function shGitOk(cmd: string, cwd: string): Promise<string>;
 export declare function gitHead(cwd: string): Promise<string>;
 export declare const sanitizeBranch: (branch: string) => string;
 export declare const WORKTREES_DIR = "worktrees.noindex";

package/dist/run/git.js

@@ -5,12 +5,12 @@ import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 // stdin "ignore": same class as HARD-05 / SubprocessDriver — never leave an open pipe a child can block on
 // (pi -p / codex exec wait for stdin EOF). timedOut distinguishes SIGKILL-timeout from a real nonzero exit.
-export function sh(cmd, cwd, timeoutMs = 600000) {
+function shell(cmd, cwd, timeoutMs, login) {
     return new Promise((resolve) => {
         // detached: bash gets its own process group so a timeout can kill the whole tree —
         // SIGKILLing bash alone orphans grandchildren (codex/pi) that hold the stdio pipes
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
-        const p = spawn("bash", ["-lc", cmd], { cwd, stdio: ["ignore", "pipe", "pipe"], detached: true });
+        const p = spawn("bash", [login ? "-lc" : "-c", cmd], { cwd, stdio: ["ignore", "pipe", "pipe"], detached: true });
         let stdout = "", stderr = "";
         let timedOut = false, done = false;
         const finish = (code, err) => {
@@ -38,14 +38,27 @@ export function sh(cmd, cwd, timeoutMs = 600000) {
             finish(code ?? 1); });
     });
 }
+export function sh(cmd, cwd, timeoutMs = 600000) {
+    return shell(cmd, cwd, timeoutMs, true);
+}
+// Git plumbing never needs an operator profile; skip login-shell startup and its side effects.
+export function shGit(cmd, cwd, timeoutMs = 600000) {
+    return shell(cmd, cwd, timeoutMs, false);
+}
 export async function shOk(cmd, cwd) {
     const r = await sh(cmd, cwd);
     if (r.code !== 0)
         throw new Error(`command failed (${r.code}): ${cmd}\n${r.stderr || r.stdout}`);
     return r.stdout;
 }
+export async function shGitOk(cmd, cwd) {
+    const r = await shGit(cmd, cwd);
+    if (r.code !== 0)
+        throw new Error(`command failed (${r.code}): ${cmd}\n${r.stderr || r.stdout}`);
+    return r.stdout;
+}
 export async function gitHead(cwd) {
-    return (await shOk("git rev-parse HEAD", cwd)).trim();
+    return (await shGitOk("git rev-parse HEAD", cwd)).trim();
 }
 export const sanitizeBranch = (branch) => branch.replace(/[^\w.-]+/g, "-");
 const sanitize = sanitizeBranch;
@@ -77,7 +90,7 @@ export async function createWorktree(repo, branch, baseRef) {
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
     if (existsSync(dir))
         await removeWorktree(repo, dir);
-    await shOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);
+    await shGitOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);
     linkNodeModules(repo, dir);
     return dir;
 }
@@ -116,7 +129,7 @@ export function linkNodeModules(repo, dir, { force = false } = {}) {
 export const WORKTREE_LAYOUT_CONTRACT = `## Worktree layout contract (harness-provisioned — do not modify)
 - node_modules is a symlink into the main repo's node_modules, provisioned by tickmarkr. Never commit, delete, or replace it — the harness re-asserts this link before gates run, so modifying it cannot help and may fail your attempt.`;
 export async function removeWorktree(repo, dir) {
-    await sh(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
-    await sh(`rm -rf ${shq(dir)}`, repo);
-    await sh("git worktree prune", repo);
+    await shGit(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
+    await shGit(`rm -rf ${shq(dir)}`, repo);
+    await shGit("git worktree prune", repo);
 }