tickmarkr 1.84.0 → 1.86.0

package/dist/run/journal.d.ts

@@ -25,9 +25,61 @@ export declare const GATE_SATISFIED_RELEASE: "gate-satisfied";
 export declare const REVIEW_UPHELD_RELEASE: "review-upheld";
 export declare const RECHECK_RELEASE: "recheck";
 export declare function reviewRoundsSinceApproval(events: JournalEvent[], taskId: string): number;
+export declare function upheldFeedbackByTask(events: JournalEvent[]): Map<string, string>;
+export interface StructuredFinding {
+    class: string;
+    path: string;
+    symbol: string;
+    note: string;
+    fingerprint: string;
+}
+export declare const UNIDENTIFIED = "<unidentified>";
+/**
+ * Structured findings for a BLOCKING review/judge gate result, parsed from the details the gate
+ * already writes (D-03: no gate-module change, so an older gate's prose degrades to one unclassified
+ * finding rather than to none). Never empty for a blocking result — a finding the journal cannot
+ * classify is still a finding the next retry must not lose.
+ *
+ * Rule: a finding's path is its verdict row's own evidence path. An inline path and an anchored row's
+ * path therefore resolve; a different anchor or the task's declared scope never substitutes for a
+ * pathless finding. That row fails closed as UNIDENTIFIED instead of manufacturing an R4 identity.
+ * A symbol the row's own prose does not name falls back to the criterion id, then to the row's own
+ * normalized words (see toFinding).
+ */
+export declare function structuredFindings(gate: string, details: string, _scopeFiles?: string[]): StructuredFinding[];
+/** Normalized identity of a gate failure: the same defect, seen twice, normalizes to the same bytes. */
+export declare function normalizeGateFailure(details: string): string;
+export declare const GATE_FINGERPRINT_CAP = 2;
+export declare function identicalGateFailures(events: JournalEvent[], taskId: string, gate: string, normalized: string): number;
+/** Repair attempts this engagement has already funded — journal-derived, so a resume inherits it. */
+export declare function repairsSinceApproval(events: JournalEvent[], taskId: string): number;
+/**
+ * Why the last attempt failed, one row per journaled cause, in the daemon's own `source: details`
+ * shape. The daemon builds that brief in a loop-local variable, which dies with the process: a resumed
+ * or `--retry-failed` run rebuilt the prompt from nothing and dispatched a retry that had lost the
+ * reason it was retrying — OBS-254's class, one layer below the upheld brief. Re-derived here so the
+ * bytes the journal already holds cannot be taken away by any reset of attempt or channel state.
+ *
+ * The same rule governs a dead DISPATCH: its exact task-failed error is retained until
+ * `worker-launch`, never retired at
+ * `task-dispatch`: everything between the two — worktree recreation, setup, prompt write, slot
+ * allocation, the launch itself — can still die with no worker having read a word, and clearing at
+ * task-dispatch meant `--retry-failed` after exactly that death rebuilt the prompt without the gate
+ * failures OR the delivery failure that preceded it. `task-approved` also clears (an operator approval
+ * retires the findings it settled — the uphold case re-derives its own brief separately).
+ */
+export declare function journaledFailureBrief(events: JournalEvent[], taskId: string): string[];
+/** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
+export declare function pendingRepairFindings(events: JournalEvent[], taskId: string): string | undefined;
+/**
+ * The gate whose identical failure banned an identical retry of the NEXT dispatch — bound to the
+ * channel that produced it, so a verdict that has already moved the work elsewhere is not refused for
+ * a channel it is no longer using, and a later unrelated failure is not parked under a stale reason.
+ */
+export declare function activeRetryBan(events: JournalEvent[], taskId: string, channel: string): string | undefined;
 export declare const PARK_KINDS: readonly ["human-gate", "ladder-exhausted", "attempt-cap", "gate-fail", "quota", "reroute-exhausted", "setup", "stall", "merge-conflict", "tip-moved", "infra", "dispatch"];
 export type ParkKind = (typeof PARK_KINDS)[number];
-export declare const RETRY_MODES: readonly ["resume", "fresh"];
+export declare const RETRY_MODES: readonly ["resume", "fresh", "repair"];
 export type RetryMode = (typeof RETRY_MODES)[number];
 export declare const WORKER_RESULT_CAUSES: readonly ["provider-death", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer"];
 export type WorkerResultCause = (typeof WORKER_RESULT_CAUSES)[number];
@@ -66,13 +118,13 @@ export declare const TelemetryRowSchema: z.ZodObject<{
         "attempt-cap": "attempt-cap";
         "gate-fail": "gate-fail";
         quota: "quota";
+        dispatch: "dispatch";
         "human-gate": "human-gate";
         "reroute-exhausted": "reroute-exhausted";
         stall: "stall";
         "merge-conflict": "merge-conflict";
         "tip-moved": "tip-moved";
         infra: "infra";
-        dispatch: "dispatch";
     }>>;
     tokens: z.ZodCatch<z.ZodOptional<z.ZodObject<{
         input: z.ZodNumber;
@@ -87,13 +139,14 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     retryMode: z.ZodOptional<z.ZodEnum<{
         resume: "resume";
         fresh: "fresh";
+        repair: "repair";
     }>>;
     signalQuality: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<0>, z.ZodLiteral<0.25>, z.ZodLiteral<0.5>, z.ZodLiteral<0.75>, z.ZodLiteral<1>]>>;
     signalBasis: z.ZodOptional<z.ZodEnum<{
+        "judge-only": "judge-only";
         skipped: "skipped";
         proved: "proved";
         "review-agree": "review-agree";
-        "judge-only": "judge-only";
         legacy: "legacy";
         vacuous: "vacuous";
     }>>;

package/dist/run/journal.js

@@ -70,6 +70,329 @@ export function reviewRoundsSinceApproval(events, taskId) {
     }
     return rounds;
 }
+// OBS-189/OBS-254: the uphold brief is the operator's funded decision, not attempt state. ONE fold,
+// two consumers — replayResumeState seeds it, and the daemon re-derives it from the journal at
+// prompt-build time so no reset of attempt/channel state can take the findings with it (OBS-254 deleted
+// the whole resume entry and dispatched a funded attempt with an empty "fix these specifically" heading).
+export function upheldFeedbackByTask(events) {
+    const upheld = new Map();
+    const lastReviewFail = new Map(); // newest failed review details per task
+    for (const e of events) {
+        if (!e.taskId)
+            continue;
+        if (e.event === "gate-result" && e.data.gate === "review" && e.data.pass === false
+            && typeof e.data.details === "string") {
+            lastReviewFail.set(e.taskId, e.data.details);
+        }
+        else if (e.event === "task-approved") {
+            // any later approval supersedes: a plain accept-the-diff approval retires the uphold brief.
+            if (e.data.release === REVIEW_UPHELD_RELEASE) {
+                const details = lastReviewFail.get(e.taskId);
+                if (details)
+                    upheld.set(e.taskId, details);
+                else
+                    upheld.delete(e.taskId);
+            }
+            else {
+                upheld.delete(e.taskId);
+            }
+        }
+    }
+    return upheld;
+}
+// Reserved for a finding whose OWN evidence names no path. Reporting a blank path a reader would take
+// for a resolved one is the silent-lie shape the gates exist to refuse, so the field says so outright.
+export const UNIDENTIFIED = "<unidentified>";
+const ANCHORED_RE = /^- (\S+?):(\d+) — (.*)$/; // "## Anchored review" rows (llm.ts)
+const REVIEW_ROW_RE = /^- \[([^\]]+)\] (.*)$/; // "- [material] …" (review.ts)
+const JUDGE_ROW_RE = /^✗ ([\w.-]+): (.*)$/; // "✗ c1: …" (acceptance.ts) — id, then reason
+const PATH_RE = /\b((?:[\w.@~+-]+\/)+[\w.@~+-]+\.\w{1,6})\b/;
+const LINE_REF_RE = /(:\d+(?::\d+)?\b)|(\bline \d+\b)/gi;
+// ponytail: repo-relative tail from the first known top-level directory — enough to make an absolute
+// worktree path and its repo-relative twin the same identity. Widen the marker list if a run ever
+// names findings outside these roots.
+function canonicalPath(raw) {
+    const cleaned = raw.replace(/^["'`(]+/, "").replace(/["'`),.]+$/, "").replace(/^\.\//, "");
+    const m = /(?:^|\/)((?:src|tests|scripts|docs|fixtures|specs|schema|skills|assets)\/.+)$/.exec(cleaned);
+    return m ? m[1] : cleaned;
+}
+// The code identity a finding names, if it names one: a backticked identifier, then a call/member
+// expression. Line references are stripped first so no identity can carry one. "" means the prose
+// named no symbol — the caller decides what stands in, rather than this guessing from prose.
+function identifierIn(note) {
+    const text = note.replace(LINE_REF_RE, " ");
+    const ticked = /`([^`]{1,80})`/.exec(text);
+    if (ticked)
+        return ticked[1].trim();
+    // no whitespace before the paren: "the brief (see …)" is prose, not a call expression, and a prose
+    // word standing in for a symbol is the guessing this function exists to refuse.
+    const call = /\b([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\(/.exec(text);
+    return call ? call[1] : "";
+}
+// The SYMBOL of last resort. R4 admits "stable symbol/test title" — a finding whose prose names no
+// code identity still has one stable identity of its own: its own words, with the volatile tokens
+// swept out so line/path churn cannot mint a new symbol for the same finding. It is the reviewer's
+// own bytes, never a guess, and it can never fuse two different findings into one.
+function toFinding(cls, note, path, symbol) {
+    const p = path || UNIDENTIFIED;
+    const s = symbol || normalizeGateFailure(note) || UNIDENTIFIED;
+    return { class: cls, path: p, symbol: s, note, fingerprint: `${cls}|${p}|${s}` };
+}
+/**
+ * Structured findings for a BLOCKING review/judge gate result, parsed from the details the gate
+ * already writes (D-03: no gate-module change, so an older gate's prose degrades to one unclassified
+ * finding rather than to none). Never empty for a blocking result — a finding the journal cannot
+ * classify is still a finding the next retry must not lose.
+ *
+ * Rule: a finding's path is its verdict row's own evidence path. An inline path and an anchored row's
+ * path therefore resolve; a different anchor or the task's declared scope never substitutes for a
+ * pathless finding. That row fails closed as UNIDENTIFIED instead of manufacturing an R4 identity.
+ * A symbol the row's own prose does not name falls back to the criterion id, then to the row's own
+ * normalized words (see toFinding).
+ */
+export function structuredFindings(gate, details, _scopeFiles = []) {
+    const lines = details.split("\n");
+    const rows = [];
+    const push = (cls, note, ownPath, fallbackSymbol = "") => {
+        const own = canonicalPath(ownPath || PATH_RE.exec(note)?.[1] || "");
+        const sym = identifierIn(note) || fallbackSymbol;
+        rows.push(toFinding(cls, note, own, sym));
+    };
+    for (const line of lines) {
+        const a = ANCHORED_RE.exec(line);
+        if (a) {
+            push(`${gate}:anchored`, a[3], a[1]);
+            continue;
+        }
+        if (gate === "review") {
+            const r = REVIEW_ROW_RE.exec(line);
+            if (r) {
+                push(`review:${r[1]}`, r[2], "");
+                continue;
+            }
+        }
+        if (gate === "acceptance") {
+            const j = JUDGE_ROW_RE.exec(line);
+            // the criterion id IS a stable symbol for an unmet acceptance criterion — the same criterion is
+            // the same finding however the judge rephrases its reason — so it backs the prose-derived one.
+            if (j) {
+                push("acceptance:unmet", j[2], "", j[1]);
+                continue;
+            }
+        }
+    }
+    if (rows.length === 0) {
+        const head = lines.map((l) => l.trim()).find(Boolean) ?? "";
+        push(`${gate}:unclassified`, head, "");
+    }
+    return rows;
+}
+// v1.85 T3: volatile tokens carry no information about WHY a gate failed — ~663m across 5 runs went to
+// re-dispatching against failures that differed only in these. Every rule below erases a token PROVEN
+// to be a diagnostic location or a clock reading; nothing erases a value the failure asserts ABOUT.
+// Ordered: styling, then timestamps (they contain colon-digits), then paths (they end before a :line),
+// then line refs, durations, long hex.
+const VOLATILE_TOKENS = [
+    [/\u001b\[[0-9;]*[a-zA-Z]/g, ""], // ANSI styling
+    [/\b\d{4}-\d{2}-\d{2}[T ][\d:]+(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?\b/g, "<ts>"], // timestamps
+    [/\brun-\d{8}-\d{6}(?:-\d{16})?\b/g, "<run>"], // run identifiers
+    [/\b0x[0-9a-fA-F]+\b/g, "<addr>"], // memory addresses
+    // An absolute path INTO the repo keeps its repo-relative tail — that tail IS identity (a defect in
+    // daemon.ts is not a defect in journal.ts); only the machine/worktree prefix ahead of it is volatile.
+    [/\/(?:[\w.@~+%-]+\/)*((?:src|tests|scripts|docs|fixtures|specs|schema|skills|assets)\/[\w.@~+%/-]+)/g, "<path>/$1"],
+    // Rule: an absolute diagnostic path's machine/worktree prefix is volatile, but its named file is
+    // identity. Therefore paths outside the repo-marker set keep their final segment: two machines
+    // naming parse.js normalize together, while parse.js and render.js can never spend one another's
+    // retry budget. A path-shaped VALUE ("/api/v1/users") is rooted nowhere real and survives.
+    [/\/(?:tmp|private|var|Users|home|opt|workspace|w)(?:\/[\w.@~+%-]+)*\/([\w.@~+%-]+)\/?/g, "<path>/$1"],
+    // A line[:col] ref counts as one only when it hangs off a file-ish token (a dot or a slash in it):
+    // R4 says the line number is evidence, not identity. "exit 1" and "expected 3" are neither.
+    [/([\w.@~+%-]*[./][\w.@~+%-]*):\d+(?::\d+)?\b/g, "$1:<line>"],
+    [/\bline \d+\b/gi, "line <line>"],
+    [/\b\d+(?:[.,]\d+)?\s?(?:ms|µs|us|ns|s|sec|secs|m|min|mins|h|hrs)\b/g, "<dur>"], // durations
+    [/\b[0-9a-f]{12,40}\b/g, "<hex>"], // sha / worktree ids
+];
+// Rule: a quoted span is protected IFF it is assertion payload. Quoting alone is ordinary diagnostic
+// rendering, so paths/timestamps inside ENOENT and worker messages still normalize. A value introduced
+// by an assertion cue is payload whether quoted or bare: `expected /tmp/actual-a to be /tmp/want-a`
+// must not collapse with an assertion about actual-b.
+//
+// The asymmetry is deliberate: a missed cap costs one extra round, a false cap bans a legitimate retry.
+const ASSERTION_CUE = "expected|received|actual|got|to be|to equal|to match|to contain|instead of|but was|but got|but received";
+const PAYLOAD_SPAN = new RegExp(`(?<=\\b(?:${ASSERTION_CUE})[:=]?[ \\t])(?:'[^'\\n]*'|"[^"\\n]*"|\`[^\`\\n]*\`|[^\\s,;)]+)`, "gi");
+const eraseVolatile = (text) => VOLATILE_TOKENS.reduce((out, [re, replacement]) => out.replace(re, replacement), text);
+// Whitespace RUNS are rendering, so they collapse — but only outside a payload, exactly like every
+// other rule here. Inside one it is part of what the failure asserts: `expected "a  b"` and
+// `expected "a b"` are two different assertions, and collapsing the joined string erased that
+// difference and banned a retry that was never redundant. Newlines survive (payload spans cannot
+// cross one) and the line-wise trim below finishes the job.
+const collapseRuns = (text) => text.replace(/[^\S\n]+/g, " ");
+// v1.85 T34: the runner's TALLY moves with the base, not with the defect. When another task merges
+// ahead and adds test files, vitest re-counts the suite — `192 passed (197)` becomes `193 passed
+// (198)` — while the FAIL headlines name the same defect in the same order, so a substantively
+// identical gate failure re-fingerprinted and gate-fingerprint-cap never counted the repeat
+// (measured on T21 in run-20260805-164546: details at 17:33:02 and 18:11:01 differ only so).
+//
+// Why provenance AND shape, and why not digits as a class: a blanket \d+ collapse also erases counts
+// that ARE identity — the failed-assertion count, the failing-suite count, an exit status, an error
+// code — and the rule above governs: a missed cap costs one extra round, a false cap bans a
+// legitimate retry. So the mask is gated on PROVENANCE first: only lines inside the `failing tests:`
+// block baseline.ts:209-219 emits (up to its blank-line/`new failure fingerprints` boundary) are
+// eligible, which keeps review prose, quoted diffs and assertion payloads structurally unreachable —
+// and that block's own `FAIL … > test name` headlines are excluded by SHAPE: only a line that starts
+// with the runner's own `Tests`/`Test Files` summary token is a tally line.
+//
+// Masked tally FIELDS, exactly: the passed count, the skipped and todo counts, and the derived
+// parenthesized total immediately following the tally sequence. Deliberately KEPT (a reader uses
+// each of them to tell two failures apart): every `N failed` count on the line (which suites and how
+// many assertions actually broke — the defect's identity), everything after the derived total (an
+// appended `| exit 1`, an appended `(404)` code), and every other number anywhere.
+const RUNNER_TALLY_LINE = /^([ \t]*(?:Test Files|Tests)[ \t]+)((?:\d+ (?:failed|passed|skipped|todo)[ \t]*\|[ \t]*)*\d+ (?:failed|passed|skipped|todo))([ \t]*\(\d+\))?(.*)$/;
+const TALLY_MOVED_FIELD = /\d+ (?=passed|skipped|todo)/g;
+const maskTallyLine = (line) => {
+    const m = RUNNER_TALLY_LINE.exec(line);
+    if (!m)
+        return line;
+    const fields = m[2].replace(TALLY_MOVED_FIELD, "#");
+    const total = (m[3] ?? "").replace(/\d+/, "#");
+    return m[1] + fields + total + m[4];
+};
+// Computed on the FULL details text BEFORE any payload split: every recorded tally-bearing detail
+// carries the `failing tests:` header, so gating on it closes the false-line-start axis (the mask
+// never sees a slice boundary) and the wrong-provenance axis in one place.
+const maskRunnerTallies = (text) => {
+    let inBlock = false;
+    return text
+        .split("\n")
+        .map((line) => {
+        if (!inBlock) {
+            if (line.trim() === "failing tests:")
+                inBlock = true;
+            return line;
+        }
+        if (line.trim() === "" || line.startsWith("new failure fingerprints")) {
+            inBlock = false;
+            return line;
+        }
+        return maskTallyLine(line);
+    })
+        .join("\n");
+};
+/** Normalized identity of a gate failure: the same defect, seen twice, normalizes to the same bytes. */
+export function normalizeGateFailure(details) {
+    const masked = maskRunnerTallies(details);
+    let out = "";
+    let last = 0;
+    for (const m of masked.matchAll(PAYLOAD_SPAN)) {
+        out += collapseRuns(eraseVolatile(masked.slice(last, m.index))) + m[0];
+        last = m.index + m[0].length;
+    }
+    out += collapseRuns(eraseVolatile(masked.slice(last)));
+    return out.split("\n").map((l) => l.trim()).filter(Boolean).join("\n");
+}
+// Two normalized-identical failures of one gate on one task buy no more rounds (the ladder cannot fix
+// what it already re-ran verbatim). Engagement-scoped exactly like reviewRoundsSinceApproval: an
+// operator approval is a new engagement, and nothing else resets the count.
+export const GATE_FINGERPRINT_CAP = 2;
+export function identicalGateFailures(events, taskId, gate, normalized) {
+    let n = 0;
+    for (const e of events) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "task-approved")
+            n = 0;
+        else if (e.event === "gate-result" && e.data.gate === gate && e.data.pass === false
+            && typeof e.data.details === "string"
+            && normalizeGateFailure(e.data.details) === normalized)
+            n++;
+    }
+    return n;
+}
+/** Repair attempts this engagement has already funded — journal-derived, so a resume inherits it. */
+export function repairsSinceApproval(events, taskId) {
+    let n = 0;
+    for (const e of events) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "task-approved")
+            n = 0;
+        else if (e.event === "repair-attempt")
+            n++;
+    }
+    return n;
+}
+// Both retry decisions below govern exactly ONE dispatch: the next one. So both are read back from the
+// journal at the moment that dispatch is built, never carried in a process variable — a stop between
+// the decision and the dispatch (OBS-254's shape, one layer up) would otherwise send a normal prompt
+// with the findings gone, or re-run an assignment that was banned.
+//
+// Rule: retry state is spent iff a worker actually launches. The expiry is `worker-launch`, NOT
+// `task-dispatch`: task-dispatch is journaled before worktree
+// recreation, setup, prompt writing and slot allocation, so spending the decision there hands it to a
+// dispatch that may still die before any worker sees it — and `--retry-failed` would then send a fresh
+// prompt with the repair findings gone, or re-run the banned channel. worker-launch is appended only
+// once the prompt has actually been delivered to a worker, which is the dispatch the decision governs.
+const DECISION_SPENT = "worker-launch";
+function decisionForNextDispatch(events, taskId, event) {
+    let pending;
+    for (const e of events) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === event)
+            pending = e;
+        else if (e.event === DECISION_SPENT)
+            pending = undefined;
+    }
+    return pending;
+}
+/**
+ * Why the last attempt failed, one row per journaled cause, in the daemon's own `source: details`
+ * shape. The daemon builds that brief in a loop-local variable, which dies with the process: a resumed
+ * or `--retry-failed` run rebuilt the prompt from nothing and dispatched a retry that had lost the
+ * reason it was retrying — OBS-254's class, one layer below the upheld brief. Re-derived here so the
+ * bytes the journal already holds cannot be taken away by any reset of attempt or channel state.
+ *
+ * The same rule governs a dead DISPATCH: its exact task-failed error is retained until
+ * `worker-launch`, never retired at
+ * `task-dispatch`: everything between the two — worktree recreation, setup, prompt write, slot
+ * allocation, the launch itself — can still die with no worker having read a word, and clearing at
+ * task-dispatch meant `--retry-failed` after exactly that death rebuilt the prompt without the gate
+ * failures OR the delivery failure that preceded it. `task-approved` also clears (an operator approval
+ * retires the findings it settled — the uphold case re-derives its own brief separately).
+ */
+export function journaledFailureBrief(events, taskId) {
+    let rows = [];
+    for (const e of events) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "worker-launch" || e.event === "task-approved")
+            rows = [];
+        else if (e.event === "gate-result" && e.data.pass === false && e.data.skipped !== true
+            && typeof e.data.details === "string")
+            rows.push(`${e.data.gate}: ${e.data.details}`);
+        else if (e.event === "delivery-readiness-failed" && typeof e.data.transcript === "string") {
+            rows.push(`dispatch: delivery readiness failed after ${e.data.waitedMs}ms; pane transcript:\n${e.data.transcript}`);
+        }
+        else if (e.event === "task-failed" && e.data.kind === "dispatch" && typeof e.data.error === "string") {
+            rows.push(`dispatch: ${e.data.error}`);
+        }
+    }
+    return rows;
+}
+/** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
+export function pendingRepairFindings(events, taskId) {
+    const e = decisionForNextDispatch(events, taskId, "repair-attempt");
+    return typeof e?.data.findings === "string" ? e.data.findings : undefined;
+}
+/**
+ * The gate whose identical failure banned an identical retry of the NEXT dispatch — bound to the
+ * channel that produced it, so a verdict that has already moved the work elsewhere is not refused for
+ * a channel it is no longer using, and a later unrelated failure is not parked under a stale reason.
+ */
+export function activeRetryBan(events, taskId, channel) {
+    const e = decisionForNextDispatch(events, taskId, "gate-fingerprint-cap");
+    return e && e.data.channel === channel && typeof e.data.gate === "string" ? e.data.gate : undefined;
+}
 // Fail-closed shape for a dispatched assignment (journal.ts:75-90 posture): a malformed assignment in
 // one dispatch degrades that single task toward today's behavior — counts toward attempts, contributes
 // nothing to tried, poisons only lastAssignment — never crashes resume, never poisons other tasks.
@@ -81,7 +404,10 @@ const DispatchAssignmentSchema = z.object({
 });
 export const PARK_KINDS = ["human-gate", "ladder-exhausted", "attempt-cap", "gate-fail", "quota",
     "reroute-exhausted", "setup", "stall", "merge-conflict", "tip-moved", "infra", "dispatch"];
-export const RETRY_MODES = ["resume", "fresh"];
+// v1.85 T3: "repair" is a third dispatch mode beside the v1.29 session pair — a fix-only attempt that
+// carries the failing findings and the diff CONTENT of the work already landed, instead of re-buying
+// ~20m of onboarding to rediscover them (62 of 68 measured re-dispatches were fresh).
+export const RETRY_MODES = ["resume", "fresh", "repair"];
 export const WORKER_RESULT_CAUSES = ["provider-death", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer"];
 // Status consumes the routing profile's existing quality split directly: verified park kinds classify
 // to 0, while availability/recovery noise classifies to null. Keep the synthetic row here at the
@@ -264,9 +590,37 @@ export function engagementComparable(events, loadedHash) {
         return { comparable: false, reason: "unbound" };
     return recorded === loadedHash ? { comparable: true, recorded } : { comparable: false, reason: "mismatch", recorded };
 }
+const RUN_SEQUENCE_WIDTH = 16;
+// The daemon mints before acquiring graph.lock, and each CLI invocation has fresh module state. Claim
+// a repository-state ticket with mkdir's atomic EEXIST boundary instead: a losing process advances and
+// retries, while the winning directory remains as the durable high-water evidence for later invocations.
+function claimRunSequence(repoRoot = process.cwd()) {
+    const dir = join(tickmarkrDir(repoRoot), "run-id-sequence");
+    mkdirSync(dir, { recursive: true });
+    const allocated = readdirSync(dir).filter((name) => /^\d{16}$/.test(name));
+    let candidate = allocated.reduce((max, name) => {
+        const value = BigInt(name);
+        return value > max ? value : max;
+    }, 0n) + 1n;
+    while (true) {
+        const suffix = candidate.toString().padStart(RUN_SEQUENCE_WIDTH, "0");
+        if (suffix.length > RUN_SEQUENCE_WIDTH)
+            throw new Error("run id sequence exhausted");
+        try {
+            mkdirSync(join(dir, suffix));
+            return suffix;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            candidate += 1n;
+        }
+    }
+}
 export function newRunId(now = new Date()) {
     const p = (n, w = 2) => String(n).padStart(w, "0");
-    return `run-${now.getFullYear()}${p(now.getMonth() + 1)}${p(now.getDate())}-${p(now.getHours())}${p(now.getMinutes())}${p(now.getSeconds())}`;
+    const instant = `${now.getUTCFullYear()}${p(now.getUTCMonth() + 1)}${p(now.getUTCDate())}-${p(now.getUTCHours())}${p(now.getUTCMinutes())}${p(now.getUTCSeconds())}`;
+    return `run-${instant}-${claimRunSequence()}`;
 }
 // Sol #4: one strict parser for every journal open/create path — generated run-… ids plus test
 // suffix chars only; forbid path separators, dot-segments, and empty ids.
@@ -304,7 +658,7 @@ function readJsonl(path) {
     return out;
 }
 // Cross-run telemetry for Phase-12 profile derivation: the last K runs' rows, each
-// tagged with its runId (runIds are zero-padded run-YYYYMMDD-HHMMSS ⇒ plain .sort() is
+// tagged with its runId (runIds are zero-padded run-UTCYYYYMMDD-HHMMSS-sequence ⇒ plain .sort() is
 // chronological, same as latestRunId). Rows are facts, not classifications — Phase 12
 // owns the quality-denominator/reward policy. A safeParse failure drops that one row
 // (same posture as a torn line); a garbage row must never crash profile derivation.
@@ -315,7 +669,7 @@ export function readAllTelemetry(repoRoot, lastK, opts = {}) {
     if (!existsSync(dir))
         return [];
     let runIds = readdirSync(dir).filter((d) => d.startsWith("run-")).sort();
-    // VIS-03 reset cursor: runIds are zero-padded run-YYYYMMDD-HHMMSS ⇒ string > is chronological
+    // VIS-03 reset cursor: UTC clock fields and a fixed-width sequence make string > chronological
     if (opts.after)
         runIds = runIds.filter((id) => id > opts.after);
     runIds = runIds.slice(-lastK);

package/dist/run/stall.d.ts

@@ -6,6 +6,14 @@ export interface StallProgressSample {
     seedSubmitted?: boolean;
     contextTokens?: number;
 }
+export declare const NUDGEABLE_ADAPTERS: Set<string>;
+export declare const QUOTA_BANNER_TAIL_ROWS = 12;
+export declare function stallSnapshotTail(text: string, rows?: number): string;
+export declare function stallSnapshotBannerRows(text: string, rows?: number): string;
+export declare const ROW_REARM_TOKEN_FLAT_MS: number;
+export declare function setRowRearmTokenFlatMsForTests(ms: number): void;
+export declare function resetRowRearmTokenFlatMsForTests(): void;
+export declare const PANE_READ_ROWS = 1000;
 /**
  * Monotonic worker-progress measure for the stall watchdog.
  *
@@ -13,12 +21,38 @@ export interface StallProgressSample {
  * evidence of work. A rendered transcript is only known to have grown when it occupies more
  * non-empty rows than any prior sample. Same-row rewrites are deliberately ambiguous and do not
  * advance the clock: a recoverable early consult is safer than silencing the watchdog forever.
+ *
+ * CEILING: `transcriptRows` is a monotone high-water over the daemon's bounded pane read
+ * (PANE_READ_ROWS lines), so it is a one-way ratchet whose signal goes blind once the pane's
+ * content exceeds the read window — the same full window slides and `observe()` can never
+ * report row growth again. Past that point a `false` return means "unmeasurable", not "no
+ * output" — consumers making a kill decision (the dead-channel fast-kill) must check
+ * `rowSignalSaturated` and stand down on it.
  */
 export declare class StallProgressTracker {
     private transcriptRows;
+    private rawWindowLines;
     private seedSubmitted;
     private contextTokens;
-    observe(sample: StallProgressSample): boolean;
+    private lastTokenGrowthAt;
+    private rowGrowthAt;
+    /** True once a sample FILLED the bounded read window on RAW lines (blanks and chrome-only
+     * rows included): the pane's real extent is then unknown — genuinely new content scrolls out
+     * of the read and the row high-water can never advance again — so a flat tracker is blindness,
+     * not silence. The raw window is the saturation signal, NOT the normalized non-empty count: a
+     * production `read(slot, PANE_READ_ROWS)` returns at most PANE_READ_ROWS lines including blank
+     * and chrome-only rows (measured 730 non-empty of 1000 on the codex-mcp-spinner fixture), so
+     * comparing the non-empty high-water against PANE_READ_ROWS could never engage and the
+     * fast-kill's stand-down was unreachable. Sticky by construction (the high-water never
+     * decreases). */
+    get rowSignalSaturated(): boolean;
+    /** Raw row-growth clock: the last observe() that advanced the row high-water, recorded even
+     * when the flat-token rule suppresses the progress REPORT (observe returns false). T1 review:
+     * the dead-channel fast-kill's "no output growth" leg must read this, not the suppressed
+     * progress clock — a metered adapter whose sticky token counter freezes the report while the
+     * pane keeps streaming rows is alive, and only this clock sees it. */
+    get lastRowGrowthAt(): number | undefined;
+    observe(sample: StallProgressSample, now?: number): boolean;
 }
 /** Filter transcript text bound for an LLM prompt (consult dossiers, gate prompts). The classify
  * seam exists for fault injection in tests only — production callers pass text alone. */