tickmarkr 1.45.0 → 1.47.0

package/dist/route/router.js

@@ -1,7 +1,27 @@
 import { channelKey, channelsFromConfig } from "../adapters/types.js";
 import { TIER_RANK } from "../config/config.js";
 import { disallowedBy } from "./preference.js";
-import { cellOf, EXPLORE_CAP, explorationBonus, learnedScore } from "./profile.js";
+import { cellOf, EXPLORE_CAP, explorationBonus, learnedScore, MIN_SAMPLES } from "./profile.js";
+export const NO_EXPLORE_ENV = "TICKMARKR_NO_EXPLORE";
+export const QUALITY_ENV = "TICKMARKR_QUALITY";
+const exploreCap = (cfg) => cfg.routing.explore?.cap ?? EXPLORE_CAP;
+const qualityOn = (exploreCtx) => !!exploreCtx?.quality || process.env[QUALITY_ENV] === "1";
+export const raiseTier = (tier) => tier === "cheap" ? "mid" : tier === "mid" ? "frontier" : "frontier";
+const exploreOff = (task, cfg, exploreCtx) => {
+    if (qualityOn(exploreCtx) || exploreCtx?.noExplore || process.env[NO_EXPLORE_ENV] === "1")
+        return true;
+    const e = cfg.routing.explore;
+    if (!e)
+        return false;
+    if (e.mode === "off")
+        return true;
+    if (e.excludeShapes?.includes(task.shape))
+        return true;
+    const thr = e.excludeComplexityAtOrAbove;
+    if (thr != null && task.complexity >= thr)
+        return true;
+    return false;
+};
 const autoPreferList = (doc, shape) => {
     const v = doc?.[shape];
     return Array.isArray(v) ? v : undefined;
@@ -44,9 +64,42 @@ function ladderFor(task, entry) {
     const escalate = task.routingHints?.escalate ?? entry?.escalate ?? true;
     return escalate ? ["retry", "escalate", "consult", "human"] : ["retry", "consult", "human"];
 }
-export function route(task, cfg, channels, profile, preferCtx) {
+function withoutExcluded(channels, exclude) {
+    if (!exclude?.size)
+        return channels;
+    // OBS-57: in-run demotion after consecutive no-trailer windows — route around poisoned channels for the rest of the run.
+    return channels.filter((c) => !exclude.has(channelKey(c)));
+}
+const qualityBound = (quality, configFloor, taskFloor) => {
+    if (!quality)
+        return undefined;
+    if (configFloor)
+        return `floor ${configFloor}→${raiseTier(configFloor)} (--quality)`;
+    if (taskFloor)
+        return `floor ${taskFloor}→${raiseTier(taskFloor)} (--quality)`;
+    return undefined;
+};
+const maybeSlaLint = (lints, task, profile, slaMinutes, c) => {
+    if (slaMinutes === undefined || !profile)
+        return;
+    const cell = cellOf(profile, task.shape, channelKey(c), c.channel);
+    if (!cell?.doneMedianMs || cell.doneCount < MIN_SAMPLES)
+        return;
+    const slaMs = slaMinutes * 60_000;
+    if (cell.doneMedianMs <= slaMs)
+        return;
+    const medianMin = Math.round(cell.doneMedianMs / 60_000);
+    lints.push(`${task.id} (${task.shape}): median ${medianMin}m exceeds sla ${slaMinutes}m — learned perf term references sla ${slaMinutes}m ref`);
+};
+export function route(task, cfg, channels, profile, preferCtx, exclude, exploreCtx) {
+    channels = withoutExcluded(channels, exclude);
     const lints = [];
-    const floor = cfg.routing.floors[task.shape];
+    const advisoryFloor = cfg.routing.floors[task.shape];
+    const quality = qualityOn(exploreCtx);
+    const floor = advisoryFloor;
+    const slaMinutes = cfg.routing.sla?.[task.shape];
+    // ponytail: sla is plan-time advisory only — never thread into learnedScore (would reroute warm rivals).
+    const scoreOpts = { availWeight: cfg.routing.learnedTuning?.availWeight };
     const entry = cfg.routing.map[task.shape];
     const prefer = effectivePrefer(task.shape, entry, preferCtx);
     const prefActive = !!(cfg.routing.allow || cfg.routing.deny);
@@ -76,11 +129,12 @@ export function route(task, cfg, channels, profile, preferCtx) {
         }
     };
     const lintFloor = (tier, what) => {
-        if (floor && TIER_RANK[tier] < TIER_RANK[floor]) {
-            lints.push(`${task.id} (${task.shape}): ${what} routes ${tier}, below advisory floor ${floor}`);
+        if (advisoryFloor && TIER_RANK[tier] < TIER_RANK[advisoryFloor]) {
+            lints.push(`${task.id} (${task.shape}): ${what} routes ${tier}, below advisory floor ${advisoryFloor}`);
         }
     };
-    const taskFloor = task.routingHints?.floor;
+    const taskFloorRaw = task.routingHints?.floor;
+    const taskFloor = taskFloorRaw && quality ? raiseTier(taskFloorRaw) : taskFloorRaw;
     const source = task.routingHints?.source;
     const src = source ? `, ${source}` : ""; // never interpolate a possibly-undefined source
     // task pin: planner-authored, try-first — degrades on miss or below-floor (D-05, research A3), never throws
@@ -91,6 +145,7 @@ export function route(task, cfg, channels, profile, preferCtx) {
         const c = channels.find((c) => c.adapter === taskPin.via && c.model === taskPin.model);
         if (c && (!taskFloor || TIER_RANK[c.tier] >= TIER_RANK[taskFloor])) {
             lintFloor(c.tier, "task pin");
+            maybeSlaLint(lints, task, profile, slaMinutes, c);
             return { assignment: toAssignment(c), ladder: ladderFor(task, entry), lints, provenance: `pin ${taskPin.via}:${taskPin.model} (task hint${src})` };
         }
         const why = c ? `below task floor ${taskFloor}` : "unavailable";
@@ -102,10 +157,16 @@ export function route(task, cfg, channels, profile, preferCtx) {
         disallowedPin(entry.pin.via, entry.pin.model, "map pin (config routing.map)");
         const c = resolvePin(entry.pin, channels);
         lintFloor(c.tier, "map pin");
+        maybeSlaLint(lints, task, profile, slaMinutes, c);
         return { assignment: toAssignment(c), ladder: ladderFor(task, entry), lints, provenance: `${degraded}pin ${entry.pin.via}:${entry.pin.model} (config routing.map)` };
     }
     const baseTier = entry?.tier ?? floor ?? "cheap";
-    const minTier = taskFloor && TIER_RANK[taskFloor] > TIER_RANK[baseTier] ? taskFloor : baseTier; // task floor is a hard >= constraint in all paths (D-04)
+    let minTier = taskFloor && TIER_RANK[taskFloor] > TIER_RANK[baseTier] ? taskFloor : baseTier; // task floor is a hard >= constraint in all paths (D-04)
+    if (quality && advisoryFloor) {
+        const raised = raiseTier(advisoryFloor);
+        if (TIER_RANK[raised] > TIER_RANK[minTier])
+            minTier = raised;
+    }
     if (entry?.tier)
         lintFloor(entry.tier, "map tier");
     if (prefActive)
@@ -138,13 +199,15 @@ export function route(task, cfg, channels, profile, preferCtx) {
         // is keyed by channelKey alone, which would collide only if a fleet exposed the same adapter:model on
         // both classes at once — impossible under today's scalar TierEntrySchema.channel.
         // ROUTE-15: availWeight threads from config as a pure param; undefined ⇒ module default (byte-identical).
-        const scores = new Map(eligibleRaw.map((c) => [channelKey(c), learnedScore(profile, task.shape, channelKey(c), c.channel, { availWeight: cfg.routing.learnedTuning?.availWeight })]));
+        const scores = new Map(eligibleRaw.map((c) => [channelKey(c), learnedScore(profile, task.shape, channelKey(c), c.channel, scoreOpts)]));
         const scoreOf = (c) => scores.get(channelKey(c));
         // v1.6 Phase 14: exploration bonus precomputed ONCE (Pitfall 5), a new key ABOVE the score. EXP-01 needs
         // it above the score (a warm-good incumbent can't permanently outrank an under-cap rival in a static tie);
         // magnitude-free as its own lexicographic key. EXP-02 holds structurally: pins returned at :67/:78 and the
         // floor filtered eligibleRaw at :89, all upstream of this block, so the bonus decides only within a static tie.
-        const bonuses = new Map(eligibleRaw.map((c) => [channelKey(c), explorationBonus(cellOf(profile, task.shape, channelKey(c), c.channel))]));
+        const cap = exploreCap(cfg);
+        const off = exploreOff(task, cfg, exploreCtx);
+        const bonuses = new Map(eligibleRaw.map((c) => [channelKey(c), off ? 0 : explorationBonus(cellOf(profile, task.shape, channelKey(c), c.channel), cap)]));
         const bonusOf = (c) => bonuses.get(channelKey(c));
         const staticWinner = [...eligibleRaw].sort(staticCmp)[0];
         // Phase 34 ROUTE-17: prefer becomes a BAND + group-rep keys so exploration fires ACROSS prefer
@@ -175,7 +238,7 @@ export function route(task, cfg, channels, profile, preferCtx) {
         const diffKey = ru ? firstDiff(w, ru) : -1;
         const probe = diffKey === 1 || diffKey === 6;
         if (probe) {
-            learnedChosen = `via exploration probe (dispatches=${cellOf(profile, task.shape, channelKey(w), w.channel)?.dispatches ?? 0} < ${EXPLORE_CAP})`;
+            learnedChosen = `via exploration probe (dispatches=${cellOf(profile, task.shape, channelKey(w), w.channel)?.dispatches ?? 0} < ${cap})`;
         }
         else if (diffKey === 2 || diffKey === 7) {
             const n = cellOf(profile, task.shape, channelKey(w), w.channel)?.n ?? 0;
@@ -188,10 +251,11 @@ export function route(task, cfg, channels, profile, preferCtx) {
     else {
         eligible = eligibleRaw.sort(staticCmp); // ROUTE-07/09: literally the v1.5 code path — dead code cannot deviate
     }
-    const bound = taskFloor && TIER_RANK[taskFloor] >= TIER_RANK[baseTier] ? `floor ${taskFloor} (task hint${src})` :
-        entry?.tier ? `tier ${entry.tier} (config routing.map)` :
-            floor ? `floor ${floor} (config floors)` :
-                "tier cheap (default)";
+    const bound = qualityBound(quality, advisoryFloor, taskFloorRaw) ??
+        (taskFloor && TIER_RANK[taskFloor] >= TIER_RANK[baseTier] ? `floor ${taskFloor} (task hint${src})` :
+            entry?.tier ? `tier ${entry.tier} (config routing.map)` :
+                floor ? `floor ${floor} (config floors)` :
+                    "tier cheap (default)");
     // name the key that actually broke the tie: prefer outranks the marginal-cost/tier keys, so if the
     // winner matched a prefer entry, prefer decided it — not "cheapest sufficient tier" (ROUTE-03, WR-01)
     const preferVia = preferFromAuto(task.shape, preferCtx)
@@ -199,9 +263,11 @@ export function route(task, cfg, channels, profile, preferCtx) {
         : "via prefer";
     const chosenBy = learnedChosen || (prefer && preferIndex(eligible[0], prefer) < prefer.length
         ? preferVia : "cheapest sufficient tier");
+    maybeSlaLint(lints, task, profile, slaMinutes, eligible[0]);
     return { assignment: toAssignment(eligible[0]), ladder: ladderFor(task, entry), lints, provenance: `${degraded}${bound}, marginal-cost auto (${chosenBy})`, ...(deviation ? { deviation } : {}) };
 }
-export function nextChannel(current, task, cfg, channels, tried, profile) {
+export function nextChannel(current, task, cfg, channels, tried, profile, exclude) {
+    channels = withoutExcluded(channels, exclude);
     // already cheapest-sufficient: TIER_RANK asc is the PRIMARY key so escalation climbs one band at a time.
     // Do NOT "unify" this onto route()'s key order (marginal-cost first) — that reverses climb-one-band on mixed fleets (ROUTE-02, D2).
     // ROUTE-13: learnedScore is the STRICTLY-LAST key — within-band tiebreak only. Precomputed

package/dist/run/consult.d.ts

@@ -10,6 +10,11 @@ export interface ConsultVerdict {
     excludeAdapter?: string;
 }
 export declare function renderRetryGuidance(v: ConsultVerdict): string;
+export declare function augmentRetryBrief(feedback: string, opts: {
+    attempted: string[];
+    carried: string[];
+    present: Set<string>;
+}): string;
 export interface Dossier {
     taskId: string;
     trigger: string;

package/dist/run/consult.js

@@ -19,6 +19,41 @@ export function renderRetryGuidance(v) {
         lines.push(part);
     return lines.slice(0, MAX_RETRY_GUIDANCE_LINES).map((l) => `- ${l}`).join("\n");
 }
+const LANDED_COMMIT_PREMISE_RE = /\b(?:already\s+committed|is\s+already\s+committed|landed\s+commit|implementation\s+is\s+already)\b/i;
+const COMMIT_HASH_RE = /\b[0-9a-f]{7,40}\b/gi;
+// OBS-58: name prior attempt commits by hash and drop consult premises about landed work that the
+// fresh worktree does not satisfy — regenerated against post-recreation state, not inherited verbatim.
+export function augmentRetryBrief(feedback, opts) {
+    const { attempted, carried, present } = opts;
+    const named = [...new Set([...attempted, ...carried])];
+    const presentLower = new Set([...present].map((h) => h.toLowerCase()));
+    const parts = [];
+    if (named.length > 0) {
+        parts.push("## Prior attempt commits (by hash)\n"
+            + named.map((h) => `- ${h}${presentLower.has(h.toLowerCase()) ? " — present in this worktree" : " — not in this worktree"}`).join("\n"));
+    }
+    let body = feedback.trim();
+    if (body && LANDED_COMMIT_PREMISE_RE.test(body)) {
+        const falseHash = [...body.matchAll(COMMIT_HASH_RE)].some((m) => !presentLower.has(m[0].toLowerCase()));
+        const falseLanded = carried.length === 0 && attempted.length > 0;
+        if (falseHash || falseLanded) {
+            body = body
+                .split("\n")
+                .filter((line) => !LANDED_COMMIT_PREMISE_RE.test(line))
+                .join("\n")
+                .trim();
+            const correction = carried.length > 0
+                ? `Prior attempt work is present at: ${carried.join(", ")}.`
+                : attempted.length > 0
+                    ? "Prior attempt commits could not be carried forward onto this worktree — re-land the work or continue from the integration tip."
+                    : "No prior attempt commits are present in this worktree — implement from the integration tip.";
+            body = body ? `${correction}\n\n${body}` : correction;
+        }
+    }
+    if (body)
+        parts.push(body);
+    return parts.join("\n\n");
+}
 const ACTIONS = ["retry", "reroute", "decompose", "human"];
 export function buildDossierPrompt(d, nonce) {
     return `TICKMARKR-CONSULT

package/dist/run/daemon.js

@@ -1,5 +1,6 @@
 import { randomBytes } from "node:crypto";
-import { readFileSync, writeFileSync } from "node:fs";
+import { shq } from "../adapters/types.js";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { trailerPattern, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, discoverChannels, getAdapter, probeAll, readDoctor } from "../adapters/registry.js";
@@ -10,9 +11,9 @@ import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
 import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
-import { consult, renderRetryGuidance } from "./consult.js";
-import { cleanupRunWorktrees, gitHead, linkNodeModules, sh, WORKTREE_LAYOUT_CONTRACT } from "./git.js";
-import { engagementComparable, Journal, loadRoutingProfile, newRunId } from "./journal.js";
+import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
+import { cleanupRunWorktrees, gitHead, linkNodeModules, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { classifyWorkerResultCause, engagementComparable, Journal, loadRoutingProfile, newRunId } from "./journal.js";
 import { acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
 import { nextChannel, route } from "../route/router.js";
@@ -27,6 +28,30 @@ export function formatSummary(s) {
 }
 const MAX_ATTEMPTS = 10; // ponytail: hard cap so a pathological ladder can never loop forever
 const BLOCKED_POLL_MS = 30_000; // between trailer-wait slices, check whether the pane is blocked on a prompt
+const PROVIDER_DEATH_REQUEUE_CAP = 2; // v1.46 T1: requeue same assignment twice, then fall through to the normal ladder
+const PROVIDER_DEATH_BACKOFF_MS = 500; // short backoff before provider-death requeue
+const NO_TRAILER_DEMOTION_STREAK = 2; // OBS-57: consecutive no-trailer windows demote a channel for the rest of the run
+async function commitsAheadOf(base, wt) {
+    const head = await gitHead(wt);
+    if (head === base)
+        return [];
+    const r = await shGit(`git log --reverse --format=%H ${shq(base)}..${shq(head)}`, wt);
+    if (r.code !== 0)
+        return [];
+    return r.stdout.trim().split("\n").filter(Boolean);
+}
+async function cherryPickCommits(wt, commits) {
+    const carried = [];
+    for (const hash of commits) {
+        const r = await shGit(`git cherry-pick --no-gpg-sign ${shq(hash)}`, wt);
+        if (r.code !== 0) {
+            await shGit("git cherry-pick --abort", wt);
+            break;
+        }
+        carried.push(hash);
+    }
+    return carried;
+}
 export async function runDaemon(repoRoot, opts = {}) {
     const cfg = loadConfig(repoRoot, { globalDir: opts.globalDir });
     const adapters = opts.adapters ?? allAdapters();
@@ -128,6 +153,9 @@ export async function runDaemon(repoRoot, opts = {}) {
         const keepLlm = keepForever;
         const keptSlots = [];
         const runTag = runId.replace(/^run-/, ""); // full date-time — cross-run unique even across days
+        // OBS-57: per-run in-run demotion — channels that burn consecutive no-trailer windows route around for later attempts.
+        const demotedChannels = new Set();
+        const noTrailerStreak = new Map();
         // OBS-17 T2: reconcile at every safe point — run start/resume (just journaled above), each task
         // terminal event, and run-end. The desired set is the pure journal fold (reconcile.ts); the driver
         // owns listing/parsing/closing. Cosmetic by contract: failures are swallowed and subprocess has no
@@ -163,14 +191,14 @@ export async function runDaemon(repoRoot, opts = {}) {
             mergeChain = next.catch(() => undefined);
             return next;
         };
-        // kind is null only at the humanGate call (assignment null ⇒ no row anyway); gateFails/consults are
-        // execTask-scoped counters passed in so a park row is a rich verified-failure observation (e.g. ladder-exhausted + gateFails:4).
+        // gateFails/consults are execTask-scoped counters passed in so a park row is a rich verified-failure
+        // observation (e.g. ladder-exhausted + gateFails:4); every task-human row has a closed kind, never prose alone.
         const park = async (t, reason, kind, assignment, attempts, startMs, gateFails = 0, consults = 0, tokens, metered = 0, retryMode = "fresh") => {
             graph = setStatus(graph, t.id, "human");
             saveGraph(repoRoot, graph);
-            journal.append("task-human", t.id, { reason });
+            journal.append("task-human", t.id, { reason, kind });
             if (assignment) {
-                journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts, outcome: "human", durationMs: Date.now() - startMs, parkKind: kind ?? undefined, gateFails, consults, tokens, meteredAttempts: tokens ? metered : undefined, retryMode });
+                journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts, outcome: "human", durationMs: Date.now() - startMs, parkKind: kind, gateFails, consults, tokens, meteredAttempts: tokens ? metered : undefined, retryMode });
             }
             await reconcile({ spareLiveLlm: true }); // task-human is a terminal event — sweep, sparing sibling tasks' live LLM panes
             await driver.notify(`tickmarkr ${runId}: ${t.id} needs a human — ${reason}`, { tier: "attention" });
@@ -183,10 +211,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // term) would silently dispatch every unapproved gate that becomes ready during a resume — pinned
                 // by the resume-path guard pin in tests/run/daemon.test.ts (the only test that reaches this guard
                 // on the resume path; a park-then-resume task is filtered out by readyTasks() and never gets here).
-                await park(t, `humanGate: "${t.title}" requires approval before dispatch`, null, null, 0, startMs);
+                await park(t, `humanGate: "${t.title}" requires approval before dispatch`, "human-gate", null, 0, startMs);
                 return;
             }
-            const r = route(t, cfg, channels, profile);
+            const r = route(t, cfg, channels, profile, undefined, demotedChannels);
             for (const lint of r.lints)
                 journal.append("routing-lint", t.id, { lint });
             // VIS-02: journal a deviation from the static choice ONLY when one occurred (greppable absence = no deviation)
@@ -211,7 +239,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // trailing-reroute edge (kill between verdict and dispatch), a stale fleet, OR a fresh-budget
                 // release (attempts 0 + non-empty tried): pick a failover over the replayed exclusions via the
                 // EXISTING nextChannel `tried` parameter — zero router changes (D-03).
-                const next = nextChannel(assignment, t, cfg, channels, rs.tried, profile);
+                const next = nextChannel(assignment, t, cfg, channels, rs.tried, profile, demotedChannels);
                 if (next)
                     assignment = next;
                 // ponytail: nextChannel null (every channel already tried / none available) — keep the static
@@ -245,9 +273,9 @@ export async function runDaemon(repoRoot, opts = {}) {
             // ROUTE-13: learned within-band failover + deviation audit. nextChannel stays pure (route/ never
             // journals); the daemon compares the learned pick against the static pick and owns the journal write.
             const failover = (site) => {
-                const next = nextChannel(assignment, t, cfg, channels, tried, profile);
+                const next = nextChannel(assignment, t, cfg, channels, tried, profile, demotedChannels);
                 if (profile && next) {
-                    const staticNext = nextChannel(assignment, t, cfg, channels, tried);
+                    const staticNext = nextChannel(assignment, t, cfg, channels, tried, undefined, demotedChannels);
                     if (staticNext && channelKey(next) !== channelKey(staticNext)) {
                         journal.append("failover-deviation", t.id, { site, static: channelKey(staticNext), chosen: channelKey(next) });
                     }
@@ -311,7 +339,13 @@ export async function runDaemon(repoRoot, opts = {}) {
             // the existing attempt-cap check below with zero new code. Fresh path: rs is undefined ⇒ 0.
             // v1.24 OBS-18: after task-approved{release:attempt-cap}, replay zeros attempts so this loop
             // starts at 0 (fresh budget) instead of re-parking at the cap in the same tick.
+            let providerDeathRequeues = 0;
+            let providerDeathAttempt = -1;
             attempts: for (let attempt = rs?.attempts ?? 0;; attempt++) {
+                if (attempt !== providerDeathAttempt) {
+                    providerDeathRequeues = 0;
+                    providerDeathAttempt = attempt;
+                }
                 // v1.13 (VIS-09 safety): one FRESH nonce per attempt — see the run-scope comment above. A retained
                 // prior-attempt trailer (herdr scrollback / subprocess buffer) must never satisfy this attempt.
                 const nonce = randomBytes(4).toString("hex");
@@ -321,6 +355,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                     await park(t, `attempt cap (${MAX_ATTEMPTS}) reached`, "attempt-cap", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
                     return;
                 }
+                // OBS-57: a demoted channel must not be re-dispatched on consult retry or provider requeue.
+                if (demotedChannels.has(channelKey(assignment))) {
+                    const next = nextChannel(assignment, t, cfg, channels, tried, profile, demotedChannels);
+                    if (next) {
+                        assignment = next;
+                        const k = channelKey(next);
+                        if (!tried.includes(k))
+                            tried.push(k);
+                    }
+                }
                 // v1.29: consume the prior gate-failed session once. Same channel + known under-threshold context
                 // + adapter capability resumes; every other path is today's fresh dispatch.
                 const priorSession = retrySession;
@@ -347,7 +391,27 @@ export async function runDaemon(repoRoot, opts = {}) {
                 journal.append("task-dispatch", t.id, { assignment, attempt, provenance: r.provenance, retryMode });
                 const taskBase = await integrationHead(intWt); // deps are merged → visible to this task
                 const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
+                const priorWt = worktreePath(repoRoot, taskBranch);
+                const commitsToCarry = existsSync(priorWt) ? await commitsAheadOf(taskBase, priorWt) : [];
                 const wt = await driver.worktree(repoRoot, taskBranch, taskBase);
+                // OBS-58: quota-failover and every retry recreate the task worktree from the integration tip —
+                // cherry-pick prior attempts' landed commits forward so a failover dispatch cannot silently
+                // orphan work a consult already verified as landed.
+                let carriedCommits = [];
+                if (commitsToCarry.length > 0) {
+                    carriedCommits = await cherryPickCommits(wt, commitsToCarry);
+                    journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
+                }
+                const priorNamed = [...new Set([...commitsToCarry, ...carriedCommits])];
+                const presentCommits = new Set(carriedCommits);
+                for (const h of commitsToCarry) {
+                    if (!presentCommits.has(h) && (await shGit(`git merge-base --is-ancestor ${shq(h)} HEAD`, wt)).code === 0) {
+                        presentCommits.add(h);
+                    }
+                }
+                if (feedback || priorNamed.length > 0) {
+                    feedback = augmentRetryBrief(feedback, { attempted: commitsToCarry, carried: carriedCommits, present: presentCommits });
+                }
                 if (cfg.setup) {
                     // v1.22 T3: setup runs inside the task worktree — seal herdr control vars so a setup script
                     // cannot mutate the operator's panes. Worker/judge/review/consult are sealed at the driver
@@ -361,11 +425,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                 }
                 const promptFile = writePrompt(journal.dir, t, attempt, feedback, nonce);
+                // OBS-56: state the non-interactive, one-pass finish contract and the OBS-54 stall budget in every
+                // worker prompt, not only consult retry guidance. Prepended so prompt.ts's completion trailer stays last.
+                const workerContract = `## Harness contract\n- This harness is non-interactive: make one continuous pass; do not stop for questions or follow-up input.\n- You have a ${taskTimeoutMinutes} minute stall window. Budget the full suite once, then commit and emit the completion trailer before it expires.\n- Each test: acceptance criterion must exist as a vitest test whose title matches the criterion string verbatim.`; // OBS-64
                 // OBS-47: state the worktree layout contract in the worker prompt (cheap-tier workers were
-                // committing/deleting node_modules and tripping the scope gate). Prepended, not appended, so the
-                // completion trailer stays the structural last line (prompt.ts's design). The harness re-asserts
-                // the link itself before gates regardless of what the worker does with it.
-                writeFileSync(promptFile, `${WORKTREE_LAYOUT_CONTRACT}\n\n${readFileSync(promptFile, "utf8")}`);
+                // committing/deleting node_modules and tripping the scope gate). The harness re-asserts the link
+                // itself before gates regardless of what the worker does with it.
+                writeFileSync(promptFile, `${WORKTREE_LAYOUT_CONTRACT}\n\n${workerContract}\n\n${readFileSync(promptFile, "utf8")}`);
                 const adapter = getAdapter(assignment.adapter, adapters);
                 // VIS-04: workers share one role tab. T2: `owned` names the pane canonically (ownership contract);
                 // the legacy name stays the fallback for drivers without owned handling (subprocess spies).
@@ -419,6 +485,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 let finished;
                 let output;
                 let exitCode;
+                let timedOut = false;
                 if (interactive) {
                     // v1.2 interactive: the TUI doesn't exit on completion — the trailer is the finish line.
                     // The exit wrapper still fires if the TUI dies (crash/quit): fast-fail instead of burning the timeout.
@@ -429,11 +496,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                     let trustAnswered = false;
                     finished = false;
                     exitCode = null;
-                    output = "";
-                    const deadline = Date.now() + taskTimeoutMinutes * 60_000;
-                    while (Date.now() < deadline) {
+                    output = await driver.read(slot, 1000);
+                    // OBS-54: reaping keys on new pane output, not dispatch wall clock. Poll at least twice per
+                    // stall window (and at the existing 30s cadence for normal windows) so an active worker resets it.
+                    const stallWindowMs = taskTimeoutMinutes * 60_000;
+                    let lastOutput = output;
+                    let lastOutputAt = Date.now();
+                    while (Date.now() - lastOutputAt < stallWindowMs) {
                         const sliceStart = Date.now();
-                        const slice = Math.min(BLOCKED_POLL_MS, deadline - sliceStart);
+                        const remaining = stallWindowMs - (sliceStart - lastOutputAt);
+                        const slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
                         if (await driver.waitOutput(slot, `(${trailerPattern(nonce)})|TICKMARKR_EXIT_${nonce}:\\d`, slice, { regex: true })) {
                             // verify before accepting: a worker that merely DISPLAYS a marker (e.g. editing tickmarkr's
                             // own source, where "TICKMARKR_EXIT:" is a string literal) must not end the wait. Only a
@@ -447,6 +519,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 break;
                             }
                         }
+                        const currentOutput = await driver.read(slot, 1000);
+                        if (currentOutput !== lastOutput) {
+                            lastOutput = currentOutput;
+                            lastOutputAt = Date.now();
+                        }
                         // v1.23 T2: piggyback on this poll slice — same cadence as blocked/idle checks, no new timer.
                         await sampleContext();
                         // page on "idle" too: herdr's blocked-scrape is strict and proved flaky for TUI dialogs
@@ -486,6 +563,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                     if (!finished && exitCode === null) {
                         // timed out (or only ever saw false positives): harvest whatever the pane holds now
+                        timedOut = Date.now() - lastOutputAt >= stallWindowMs;
                         output = await driver.read(slot, 1000);
                         finished = new RegExp(trailerPattern(nonce)).test(output);
                         const exit = exitRe.exec(output);
@@ -499,9 +577,27 @@ export async function runDaemon(repoRoot, opts = {}) {
                 else {
                     const inv = adapter.invoke(t, wt, assignment, { promptFile });
                     await driver.run(slot, `${inv.command}; ${exitMarkerCmd}`);
-                    finished = await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, taskTimeoutMinutes * 60_000, { regex: true });
+                    // OBS-54: headless workers have the same output-inactivity budget as visible panes.
+                    const stallWindowMs = taskTimeoutMinutes * 60_000;
+                    let lastOutput = await driver.read(slot, 500);
+                    let lastOutputAt = Date.now();
+                    finished = false;
+                    while (Date.now() - lastOutputAt < stallWindowMs) {
+                        const remaining = stallWindowMs - (Date.now() - lastOutputAt);
+                        const slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
+                        if (await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, slice, { regex: true })) {
+                            finished = true;
+                            break;
+                        }
+                        const currentOutput = await driver.read(slot, 500);
+                        if (currentOutput !== lastOutput) {
+                            lastOutput = currentOutput;
+                            lastOutputAt = Date.now();
+                        }
+                    }
                     output = await driver.read(slot, 500);
                     exitCode = Number(exitRe.exec(output)?.[1] ?? 1);
+                    timedOut = !finished && Date.now() - lastOutputAt >= stallWindowMs;
                 }
                 // SPEND-01 interactive metering race: the harvest loop breaks on the trailer, but the worker
                 // shell may still be running post-trailer bookkeeping (session-store flush, fake usage stamp,
@@ -529,7 +625,31 @@ export async function runDaemon(repoRoot, opts = {}) {
                     metered++;
                 }
                 const result = adapter.parse(output, nonce);
-                journal.append("worker-result", t.id, { ok: result.ok, summary: result.summary, deviations: result.deviations, finished, exitCode, mode: interactive ? "interactive" : "print" });
+                const cause = classifyWorkerResultCause({ output, ok: result.ok, finished, exitCode, summary: result.summary, timedOut });
+                journal.append("worker-result", t.id, {
+                    ok: result.ok, summary: result.summary, deviations: result.deviations, finished, exitCode,
+                    mode: interactive ? "interactive" : "print", ...(cause ? { cause } : {}),
+                });
+                if (result.ok && finished)
+                    noTrailerStreak.set(channelKey(assignment), 0);
+                else if (!finished && cause !== "provider-death") {
+                    const ck = channelKey(assignment);
+                    const streak = (noTrailerStreak.get(ck) ?? 0) + 1;
+                    noTrailerStreak.set(ck, streak);
+                    // OBS-57: two consecutive no-trailer windows in one run demote the channel for later attempts.
+                    if (streak >= NO_TRAILER_DEMOTION_STREAK && !demotedChannels.has(ck)) {
+                        demotedChannels.add(ck);
+                        journal.append("channel-demotion", t.id, { channel: ck, streak });
+                    }
+                }
+                // v1.46 T1: provider-outage requeue — same assignment, no attempt burn, no consult, capped.
+                if (cause === "provider-death" && providerDeathRequeues < PROVIDER_DEATH_REQUEUE_CAP) {
+                    providerDeathRequeues++;
+                    journal.append("provider-death-requeue", t.id, { attempt, requeue: providerDeathRequeues, assignment });
+                    await new Promise((r) => setTimeout(r, PROVIDER_DEATH_BACKOFF_MS));
+                    attempt--;
+                    continue;
+                }
                 // quota exhaustion → failover within floor; does NOT consume the ladder (spec §4)
                 // print: guarded on exit code — exit-0 output that merely MENTIONS "rate limit" must not failover
                 // interactive: a harvested trailer beats quota mentions; without one, quota text fails over (spec v1.2 §2)
@@ -650,7 +770,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("tip-moved", t.id, m.tipMoved);
                             if (tipMoves++ === 0)
                                 continue gateLoop;
-                            await park(t, "task branch tip moved twice after gating", null, assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                            await park(t, "task branch tip moved twice after gating", "tip-moved", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
                             return;
                         }
                         if (!m.ok) {
@@ -795,7 +915,7 @@ export async function runDaemon(repoRoot, opts = {}) {
         const tipFail = summary.tipVerify === "failed"
             ? ` — TIP VERIFY FAILED on ${summary.lastMergedTask ? `last merge ${summary.lastMergedTask}` : "integration tip"}`
             : "";
-        await driver.notify(`tickmarkr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""}${tipFail} — integration branch ${branch} (merge to main is yours)`, { tier: summary.tipVerify === "failed" ? "attention" : "attention" });
+        await driver.notify(`tickmarkr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""}${tipFail} — integration branch ${branch} (merge to main is yours)`, { tier: summary.tipVerify === "failed" ? "attention" : "routine" });
         return summary;
     }
     finally {

package/dist/run/git.d.ts

@@ -5,7 +5,9 @@ export interface ShResult {
     timedOut?: boolean;
 }
 export declare function sh(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
+export declare function shGit(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
+export declare function shGitOk(cmd: string, cwd: string): Promise<string>;
 export declare function gitHead(cwd: string): Promise<string>;
 export declare const sanitizeBranch: (branch: string) => string;
 export declare const WORKTREES_DIR = "worktrees.noindex";

package/dist/run/git.js

@@ -5,12 +5,12 @@ import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 // stdin "ignore": same class as HARD-05 / SubprocessDriver — never leave an open pipe a child can block on
 // (pi -p / codex exec wait for stdin EOF). timedOut distinguishes SIGKILL-timeout from a real nonzero exit.
-export function sh(cmd, cwd, timeoutMs = 600000) {
+function shell(cmd, cwd, timeoutMs, login) {
     return new Promise((resolve) => {
         // detached: bash gets its own process group so a timeout can kill the whole tree —
         // SIGKILLing bash alone orphans grandchildren (codex/pi) that hold the stdio pipes
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
-        const p = spawn("bash", ["-lc", cmd], { cwd, stdio: ["ignore", "pipe", "pipe"], detached: true });
+        const p = spawn("bash", [login ? "-lc" : "-c", cmd], { cwd, stdio: ["ignore", "pipe", "pipe"], detached: true });
         let stdout = "", stderr = "";
         let timedOut = false, done = false;
         const finish = (code, err) => {
@@ -38,14 +38,27 @@ export function sh(cmd, cwd, timeoutMs = 600000) {
             finish(code ?? 1); });
     });
 }
+export function sh(cmd, cwd, timeoutMs = 600000) {
+    return shell(cmd, cwd, timeoutMs, true);
+}
+// Git plumbing never needs an operator profile; skip login-shell startup and its side effects.
+export function shGit(cmd, cwd, timeoutMs = 600000) {
+    return shell(cmd, cwd, timeoutMs, false);
+}
 export async function shOk(cmd, cwd) {
     const r = await sh(cmd, cwd);
     if (r.code !== 0)
         throw new Error(`command failed (${r.code}): ${cmd}\n${r.stderr || r.stdout}`);
     return r.stdout;
 }
+export async function shGitOk(cmd, cwd) {
+    const r = await shGit(cmd, cwd);
+    if (r.code !== 0)
+        throw new Error(`command failed (${r.code}): ${cmd}\n${r.stderr || r.stdout}`);
+    return r.stdout;
+}
 export async function gitHead(cwd) {
-    return (await shOk("git rev-parse HEAD", cwd)).trim();
+    return (await shGitOk("git rev-parse HEAD", cwd)).trim();
 }
 export const sanitizeBranch = (branch) => branch.replace(/[^\w.-]+/g, "-");
 const sanitize = sanitizeBranch;
@@ -77,7 +90,7 @@ export async function createWorktree(repo, branch, baseRef) {
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
     if (existsSync(dir))
         await removeWorktree(repo, dir);
-    await shOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);
+    await shGitOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);
     linkNodeModules(repo, dir);
     return dir;
 }
@@ -116,7 +129,7 @@ export function linkNodeModules(repo, dir, { force = false } = {}) {
 export const WORKTREE_LAYOUT_CONTRACT = `## Worktree layout contract (harness-provisioned — do not modify)
 - node_modules is a symlink into the main repo's node_modules, provisioned by tickmarkr. Never commit, delete, or replace it — the harness re-asserts this link before gates run, so modifying it cannot help and may fail your attempt.`;
 export async function removeWorktree(repo, dir) {
-    await sh(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
-    await sh(`rm -rf ${shq(dir)}`, repo);
-    await sh("git worktree prune", repo);
+    await shGit(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
+    await shGit(`rm -rf ${shq(dir)}`, repo);
+    await shGit("git worktree prune", repo);
 }