tickmarkr 1.87.0 → 1.89.0

package/dist/run/git.d.ts

@@ -2,6 +2,18 @@ import { ROUTING_ENV_SEAMS } from "../route/router.js";
 export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export declare const DEFAULT_FORK_CAP = "6";
+/**
+ * cap = max(1, floor(cores / concurrency)). Total test parallelism is then cap × concurrency, which
+ * never exceeds max(cores, concurrency): at or below the core count the floor keeps the product
+ * under `cores`, and above it the floor is 0 so the minimum of 1 pins the product to `concurrency`
+ * itself. (The tempting `cap × concurrency ≤ cores` is unsatisfiable once concurrency > cores —
+ * a run cannot give a suite less than one fork.)
+ */
+export declare const deriveForkCap: (concurrency: number, cores?: number) => number;
+/** Run `fn` with the fork budget this run's resolved concurrency implies. */
+export declare const runWithForkBudget: <T>(concurrency: number, fn: () => Promise<T>) => Promise<T>;
+/** The cap owned by the run on this async context; the standalone default outside one. */
+export declare const resolvedForkCap: () => string;
 export interface ShResult {
     code: number;
     stdout: string;
@@ -29,4 +41,42 @@ export declare function linkNodeModules(repo: string, dir: string, { force }?: {
     force?: boolean | undefined;
 }): boolean;
 export declare const WORKTREE_LAYOUT_CONTRACT = "## Worktree layout contract (harness-provisioned \u2014 do not modify)\n- node_modules is a symlink into the main repo's node_modules, provisioned by tickmarkr. Never commit, delete, or replace it \u2014 the harness re-asserts this link before gates run, so modifying it cannot help and may fail your attempt.";
+/** A declared patch this probe could not find in the target's history, with the paths it touched. */
+export interface MissingDeclaredPatch {
+    commit: string;
+    paths: string[];
+    merge: boolean;
+}
+/**
+ * `contained` — every declared patch is in the target, by ancestry or by patch identity.
+ * `drifted`   — at least one declared patch is missing (or is an unproven merge); each is named.
+ * `unresolvable` — git could not answer; the raw git output is kept so the caller reports evidence,
+ * not a guess. Only `contained` is a clean verdict: the other two never let a caller assume one.
+ */
+export type BaseContainment = {
+    result: "contained";
+    via: "ancestry" | "patch-id";
+} | {
+    result: "drifted";
+    missing: MissingDeclaredPatch[];
+} | {
+    result: "unresolvable";
+    ref: string;
+    evidence: string;
+};
+/**
+ * Is the declared base contained in `targetRef`'s history? Pure git evidence — no journal, no daemon
+ * state, no worker claim. Ancestry answers it outright; a recreated branch carries the same patches
+ * under new commit identities, which `git cherry` settles by patch-id.
+ *
+ * The trap this probe exists to refuse: `git cherry` (like `git log -p | git patch-id`) SKIPS merge
+ * commits, so a declared tip whose unique commits are all merges produces an EMPTY patch stream, and
+ * "no missing patches" reads exactly like "contained". So the verdict is NOT read off that stream.
+ * The commits are enumerated from `git rev-list --parents`, which sees merges, and patch identity
+ * only ever SUBTRACTS from that list: every unique commit is drift until something proves it, and
+ * for a merge the only direct proof git offers is reachability from the target — which would have
+ * kept it out of the range to begin with. The `!merge` guard below keeps that fail-closed even if a
+ * future `git cherry` ever emitted a `-` line for a merge.
+ */
+export declare function declaredBaseContainment(cwd: string, declaredRef: string, targetRef?: string): Promise<BaseContainment>;
 export declare function removeWorktree(repo: string, dir: string): Promise<void>;

package/dist/run/git.js

@@ -1,5 +1,7 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { availableParallelism } from "node:os";
 import { join, resolve } from "node:path";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
@@ -11,6 +13,36 @@ export { ROUTING_ENV_SEAMS };
 // as argv (OBS-55) so child test oracles stay intact. The operator's own export wins.
 export const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export const DEFAULT_FORK_CAP = "6";
+/**
+ * The fork budget belongs to ONE run: how many gate suites can be in flight at once is exactly that
+ * run's resolved concurrency, so the per-suite cap must divide the machine by THAT number and no
+ * other. Two things rule out a module-level variable. A single Node process holds more than one
+ * runDaemon call — the suites do it, and so does a supervisor driving two repositories — so a
+ * captured-once global hands whichever run started first its cap to every other run, and only a
+ * reset seam production never calls could hide it. And re-deriving the number at spawn time reads
+ * whatever `process.argv` or the config overlay says NOW, not what the run resolved: `parseArgs`
+ * settles `--concurrency 2 --concurrency 8` on the LAST occurrence, and an overlay is a mutable
+ * file, so a re-derived cap can disagree with the concurrency the run is actually enforcing.
+ *
+ * AsyncLocalStorage is the stdlib answer to both. The store is entered once, around the run body,
+ * from the single value `runDaemon` resolved; every shell that run spawns — baseline capture, gate
+ * batteries, tip verify, worker environments — inherits it through the async context, and a
+ * concurrent run's shells inherit their own. There is nothing to reset: leaving the run leaves
+ * the store, so sequential runs cannot inherit each other either.
+ */
+const forkBudget = new AsyncLocalStorage();
+/**
+ * cap = max(1, floor(cores / concurrency)). Total test parallelism is then cap × concurrency, which
+ * never exceeds max(cores, concurrency): at or below the core count the floor keeps the product
+ * under `cores`, and above it the floor is 0 so the minimum of 1 pins the product to `concurrency`
+ * itself. (The tempting `cap × concurrency ≤ cores` is unsatisfiable once concurrency > cores —
+ * a run cannot give a suite less than one fork.)
+ */
+export const deriveForkCap = (concurrency, cores = availableParallelism()) => Math.max(1, Math.floor(cores / Math.max(1, concurrency)));
+/** Run `fn` with the fork budget this run's resolved concurrency implies. */
+export const runWithForkBudget = (concurrency, fn) => forkBudget.run(String(deriveForkCap(concurrency)), fn);
+/** The cap owned by the run on this async context; the standalone default outside one. */
+export const resolvedForkCap = () => forkBudget.getStore() ?? DEFAULT_FORK_CAP;
 // stdin "ignore": same class as HARD-05 / SubprocessDriver — never leave an open pipe a child can block on
 // (pi -p / codex exec wait for stdin EOF). timedOut distinguishes SIGKILL-timeout from a real nonzero exit.
 function shell(cmd, cwd, timeoutMs, login) {
@@ -21,9 +53,9 @@ function shell(cmd, cwd, timeoutMs, login) {
     const env = { ...process.env };
     for (const k of ROUTING_ENV_SEAMS)
         delete env[k];
-    // OBS-110: apply the default fork cap only when the operator has not already set one.
+    // OBS-110: apply the run's own fork cap only when the operator has not already set one.
     if (!(FORK_CAP_ENV in env))
-        env[FORK_CAP_ENV] = DEFAULT_FORK_CAP;
+        env[FORK_CAP_ENV] = resolvedForkCap();
     return new Promise((resolve) => {
         // detached: bash gets its own process group so a timeout can kill the whole tree —
         // SIGKILLing bash alone orphans grandchildren (codex/pi) that hold the stdio pipes
@@ -230,6 +262,85 @@ export function linkNodeModules(repo, dir, { force = false } = {}) {
 // worker from spending an attempt on environment repair.
 export const WORKTREE_LAYOUT_CONTRACT = `## Worktree layout contract (harness-provisioned — do not modify)
 - node_modules is a symlink into the main repo's node_modules, provisioned by tickmarkr. Never commit, delete, or replace it — the harness re-asserts this link before gates run, so modifying it cannot help and may fail your attempt.`;
+// First-parent name-only diff: works for ordinary commits, merges (--diff-merges=first-parent, which
+// a bare -m would widen to every parent's diff) and the root commit (--root), so one command names
+// the paths of every commit shape this probe can report. The raw result is returned, never a path
+// list: a failed diff-tree produced NO paths, and folding that into an empty array would ship a
+// drifted verdict whose "touched nothing" evidence git never said — an empty list is only an answer
+// after a successful command, so the caller turns a failure into unresolvable with git's own words.
+const touchedPaths = (cwd, sha) => shGit(`git diff-tree --no-commit-id --name-only -z -r --root --diff-merges=first-parent ${shq(sha)}`, cwd);
+/**
+ * Is the declared base contained in `targetRef`'s history? Pure git evidence — no journal, no daemon
+ * state, no worker claim. Ancestry answers it outright; a recreated branch carries the same patches
+ * under new commit identities, which `git cherry` settles by patch-id.
+ *
+ * The trap this probe exists to refuse: `git cherry` (like `git log -p | git patch-id`) SKIPS merge
+ * commits, so a declared tip whose unique commits are all merges produces an EMPTY patch stream, and
+ * "no missing patches" reads exactly like "contained". So the verdict is NOT read off that stream.
+ * The commits are enumerated from `git rev-list --parents`, which sees merges, and patch identity
+ * only ever SUBTRACTS from that list: every unique commit is drift until something proves it, and
+ * for a merge the only direct proof git offers is reachability from the target — which would have
+ * kept it out of the range to begin with. The `!merge` guard below keeps that fail-closed even if a
+ * future `git cherry` ever emitted a `-` line for a merge.
+ */
+export async function declaredBaseContainment(cwd, declaredRef, targetRef = "HEAD") {
+    for (const ref of [declaredRef, targetRef]) {
+        const r = await shGit(`git rev-parse --verify ${shq(`${ref}^{commit}`)}`, cwd);
+        if (r.code !== 0)
+            return { result: "unresolvable", ref, evidence: (r.stderr || r.stdout).trim() };
+    }
+    const ancestor = await shGit(`git merge-base --is-ancestor ${shq(declaredRef)} ${shq(targetRef)}`, cwd);
+    if (ancestor.timedOut) {
+        const detail = (ancestor.stderr || ancestor.stdout).trim();
+        return {
+            result: "unresolvable",
+            ref: declaredRef,
+            evidence: `git merge-base --is-ancestor timed out${detail ? `: ${detail}` : ""}`,
+        };
+    }
+    if (ancestor.code === 0)
+        return { result: "contained", via: "ancestry" };
+    // 1 is the honest "not an ancestor"; anything else is git failing to answer, never a clean read.
+    if (ancestor.code !== 1) {
+        return { result: "unresolvable", ref: declaredRef, evidence: (ancestor.stderr || ancestor.stdout).trim() };
+    }
+    // Ancestry above is a POSITIVE proof and survives a truncated history; everything below reads
+    // history as if it were complete, and a shallow clone is exactly the history that is not. Its
+    // graft makes the boundary commit parentless, so `rev-list` stops there and `git cherry` offers
+    // the boundary's whole tree as ONE synthetic patch — which a single squashed commit on the target
+    // matches, hiding every truncated declared patch behind it (a depth-1 clone reports one matched
+    // patch where the complete repository reports three missing ones). The same truncation on the
+    // target side invents drift just as easily, so neither verdict is available: the repository does
+    // not hold the evidence, and saying so is the only honest read.
+    const shallow = await shGit("git rev-parse --is-shallow-repository", cwd);
+    if (shallow.code !== 0 || shallow.stdout.trim() !== "false") {
+        const said = (shallow.stdout || shallow.stderr).trim();
+        return { result: "unresolvable", ref: declaredRef, evidence: `git rev-parse --is-shallow-repository: ${said}` };
+    }
+    const range = `${shq(targetRef)}..${shq(declaredRef)}`;
+    const listed = await shGit(`git rev-list --parents ${range}`, cwd);
+    if (listed.code !== 0) {
+        return { result: "unresolvable", ref: declaredRef, evidence: (listed.stderr || listed.stdout).trim() };
+    }
+    const cherry = await shGit(`git cherry ${shq(targetRef)} ${shq(declaredRef)}`, cwd);
+    if (cherry.code !== 0) {
+        return { result: "unresolvable", ref: declaredRef, evidence: (cherry.stderr || cherry.stdout).trim() };
+    }
+    const proven = new Set(cherry.stdout.split("\n").filter((l) => l.startsWith("- ")).map((l) => l.slice(2).trim()));
+    const missing = [];
+    for (const line of listed.stdout.split("\n").filter((l) => l.trim())) {
+        const [sha, ...parents] = line.trim().split(/\s+/);
+        const merge = parents.length > 1;
+        if (!merge && proven.has(sha))
+            continue;
+        const paths = await touchedPaths(cwd, sha);
+        if (paths.code !== 0) {
+            return { result: "unresolvable", ref: sha, evidence: (paths.stderr || paths.stdout).trim() };
+        }
+        missing.push({ commit: sha, paths: paths.stdout.split("\0").filter((path) => path.length > 0), merge });
+    }
+    return missing.length > 0 ? { result: "drifted", missing } : { result: "contained", via: "patch-id" };
+}
 export async function removeWorktree(repo, dir) {
     await shGit(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
     await shGit(`rm -rf ${shq(dir)}`, repo);

package/dist/run/interactive-seed.d.ts

@@ -1,16 +1,20 @@
-import type { Assignment, WorkerAdapter } from "../adapters/types.js";
+import { type Assignment, type WorkerAdapter } from "../adapters/types.js";
 import type { ExecutorDriver, Slot } from "../drivers/types.js";
 export interface InteractiveSeedResult {
     output: string;
     seedFailed: boolean;
     seedError?: string;
     sessionId?: string;
+    trustAnswered: boolean;
 }
+type SeedDriver = Pick<ExecutorDriver, "run" | "waitOutput" | "read" | "sendKey">;
 export declare function runInteractiveSeed(opts: {
-    driver: Pick<ExecutorDriver, "run" | "waitOutput" | "read">;
+    driver: SeedDriver;
     slot: Slot;
     adapter: WorkerAdapter;
     assignment: Assignment;
     promptFile: string;
     taskTimeoutMinutes: number;
+    onTrustAnswered?: () => void;
 }): Promise<InteractiveSeedResult>;
+export {};

package/dist/run/interactive-seed.js

@@ -1,3 +1,61 @@
+import { matchesTrustDialog } from "../adapters/types.js";
+// The workspace-trust prompt is a STARTUP gate: it renders before the readiness banner and blocks
+// it, so this wait is the only window in which anything can answer it. Observation therefore runs
+// for the WHOLE readiness budget. Review round 7 (material): a 60-second cutoff here was a window
+// in which a real modal is simply never read — with a two-minute deadline and the modal at 61s the
+// seed sent zero keys and failed on readiness. A cycle is a bounded readiness wait plus one pane
+// read, so readiness still returns the instant it appears and the cadence only bounds how long a
+// modal sits unanswered; the loop's total cost is one pane read per second of a launch that is
+// blocked anyway, and it ends at the first of readiness, a modal, or the deadline.
+const TRUST_POLL_MS = 1_000;
+const TRUST_PANE_ROWS = 80;
+// v1.89 T19 / OBS-406: wait for readiness, answering a fingerprint-matched trust modal at most ONCE
+// on the way. The daemon's own trust loop runs only after runInteractiveSeed returns, and this wait
+// is exactly the window the modal blocks in — a declaration consulted only there is unreachable
+// (kimi.ts states that gap at its own `trustDialog`).
+async function awaitReadiness(opts) {
+    const { driver, slot, readinessMatch, deadline } = opts;
+    const dialog = opts.adapter.trustDialog;
+    const left = () => Math.max(0, deadline - Date.now());
+    // Nothing this launch could answer (no declaration, an honest {kind:"none"}, or a driver with no
+    // keystroke surface): the single long wait, byte-identical to pre-T19 behaviour.
+    if (!dialog || dialog.kind === "none" || !driver.sendKey) {
+        return { ready: await driver.waitOutput(slot, readinessMatch, left()), trustAnswered: false };
+    }
+    let trustAnswered = false;
+    while (!trustAnswered && left() > 0) {
+        if (await driver.waitOutput(slot, readinessMatch, Math.min(TRUST_POLL_MS, left()))) {
+            return { ready: true, trustAnswered };
+        }
+        let paneText;
+        try {
+            paneText = await driver.read(slot, TRUST_PANE_ROWS);
+        }
+        catch {
+            continue; // a failed read is not a matched modal — keep observing, spend nothing
+        }
+        if (!matchesTrustDialog(paneText, dialog))
+            continue;
+        // Review round 7 (material): the latch is spent BEFORE the awaited send, not after it. A send
+        // that dispatches the key and THEN rejects is ambiguous — the keystroke may already be in the
+        // slot — so a retry is a possible SECOND Enter landing on whatever modal is showing next, the
+        // exact harm this contract exists to prevent. Ambiguity fails closed: one attempt per launch,
+        // and the attempt (not the resolution) is what the daemon's per-slot latch inherits.
+        trustAnswered = true;
+        // Review round 8 (material): the RETURN VALUE is not the only path out of this function — the
+        // seed-line delivery below it throws DeliveryReadinessError, and a daemon that learns of the
+        // answer only from a result it never receives initializes its latch false with the key already
+        // sent. So the answer is reported the instant it is spent, before anything that can throw.
+        opts.onTrustAnswered?.();
+        try {
+            await driver.sendKey(slot, dialog.key);
+        }
+        catch {
+            /* dispatched-then-rejected: never retried here, and never re-tried by the daemon either */
+        }
+    }
+    return { ready: await driver.waitOutput(slot, readinessMatch, left()), trustAnswered };
+}
 // v1.69 T6: launch-then-seed handoff for adapters whose real TUI cannot be argv-seeded.
 // Both the launch command and the seed line are delivered through the driver's existing `run`
 // primitive (pane-run on herdr). After the seed line is injected we read the pane back and
@@ -5,16 +63,25 @@
 export async function runInteractiveSeed(opts) {
     const seed = opts.adapter.interactiveSeed;
     await opts.driver.run(opts.slot, seed.launch(opts.assignment.model));
-    const ready = await opts.driver.waitOutput(opts.slot, seed.readinessMatch, opts.taskTimeoutMinutes * 60_000);
+    // `trustAnswered` rides EVERY return below, including both early ones: the daemon initializes its
+    // per-slot latch from it, and an omission there reads as "no key was sent" — the second-Enter defect.
+    const { ready, trustAnswered } = await awaitReadiness({
+        driver: opts.driver,
+        slot: opts.slot,
+        adapter: opts.adapter,
+        readinessMatch: seed.readinessMatch,
+        deadline: Date.now() + opts.taskTimeoutMinutes * 60_000,
+        ...(opts.onTrustAnswered ? { onTrustAnswered: opts.onTrustAnswered } : {}),
+    });
     const banner = await opts.driver.read(opts.slot, 1000);
     if (!ready) {
-        return { output: banner, seedFailed: true, seedError: `readiness pattern not seen: ${seed.readinessMatch}` };
+        return { output: banner, seedFailed: true, seedError: `readiness pattern not seen: ${seed.readinessMatch}`, trustAnswered };
     }
     let sessionId;
     if (seed.confirmBanner) {
         const confirm = seed.confirmBanner(banner, opts.assignment.model);
         if (!confirm.ok) {
-            return { output: banner, seedFailed: true, seedError: confirm.error };
+            return { output: banner, seedFailed: true, seedError: confirm.error, trustAnswered };
         }
         sessionId = confirm.sessionId;
     }
@@ -26,8 +93,8 @@ export async function runInteractiveSeed(opts) {
         output = await opts.driver.read(opts.slot, 1000);
         const bottom = output.trimEnd().split("\n").pop() ?? "";
         if (!bottom.includes(seedText)) {
-            return { output, seedFailed: false, ...(sessionId ? { sessionId } : {}) };
+            return { output, seedFailed: false, trustAnswered, ...(sessionId ? { sessionId } : {}) };
         }
     }
-    return { output, seedFailed: true, seedError: "seed line never left the input box", ...(sessionId ? { sessionId } : {}) };
+    return { output, seedFailed: true, seedError: "seed line never left the input box", trustAnswered, ...(sessionId ? { sessionId } : {}) };
 }

package/dist/run/journal.d.ts

@@ -3,6 +3,7 @@ import { type Assignment } from "../adapters/types.js";
 import type { TickmarkrConfig } from "../config/config.js";
 import { type GateName, type TaskStatus } from "../graph/schema.js";
 import { type ProfileDiscount, type RoutingProfile } from "../route/profile.js";
+import { type DecisionEventWrite, type TrackedJournalRow } from "./protocol.js";
 export interface JournalEvent {
     ts: string;
     event: string;
@@ -18,6 +19,10 @@ export interface ResumeState {
     lastAssignment?: Assignment;
     upheldFeedback?: string;
 }
+export interface CurrentAttemptGateReplay {
+    commit: string;
+    results: Map<GateName, boolean>;
+}
 export declare const CHANNEL_EXCLUSION_KINDS: readonly ["dead-channel"];
 export type ChannelExclusionKind = (typeof CHANNEL_EXCLUSION_KINDS)[number];
 export declare const ATTEMPT_CAP_RELEASE: "attempt-cap";
@@ -118,13 +123,13 @@ export declare const TelemetryRowSchema: z.ZodObject<{
         "attempt-cap": "attempt-cap";
         "gate-fail": "gate-fail";
         quota: "quota";
+        infra: "infra";
         dispatch: "dispatch";
         "human-gate": "human-gate";
         "reroute-exhausted": "reroute-exhausted";
         stall: "stall";
         "merge-conflict": "merge-conflict";
         "tip-moved": "tip-moved";
-        infra: "infra";
     }>>;
     tokens: z.ZodCatch<z.ZodOptional<z.ZodObject<{
         input: z.ZodNumber;
@@ -217,12 +222,15 @@ export declare class Journal {
         withJournal?: boolean;
     }): string | null;
     private get journalPath();
+    append(decision: DecisionEventWrite): void;
     append(event: string, taskId?: string, data?: Record<string, unknown>): void;
     phaseStart(taskId: string, phase: TaskPhase, data?: Record<string, unknown>): void;
     read(): JournalEvent[];
+    readTracked(): TrackedJournalRow[];
     replayStatuses(): Map<string, TaskStatus>;
     replayResumeState(): Map<string, ResumeState>;
     replaySatisfiedGates(): Map<string, GateName>;
+    replayCurrentAttemptGateResults(): Map<string, CurrentAttemptGateReplay>;
     replayExcludedChannels(): Set<string>;
     telemetry(row: TelemetryRow): void;
     readTelemetry(): TelemetryRow[];

package/dist/run/journal.js

@@ -6,6 +6,7 @@ import { channelKey, TokenUsageSchema } from "../adapters/types.js";
 import { stateDirName, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES, TIERS } from "../graph/schema.js";
 import { buildProfile, classify } from "../route/profile.js";
+import { DecisionEventSchema, trackJournalRows, } from "./protocol.js";
 import { redactSecrets } from "./redact.js";
 export function phaseForGate(gate) {
     if (gate === "acceptance")
@@ -57,7 +58,8 @@ export const REVIEW_UPHELD_RELEASE = "review-upheld";
 export const RECHECK_RELEASE = "recheck";
 // OBS-189: review rounds are scoped to the current ENGAGEMENT — the stretch since the newest operator
 // approval for the task. A whole-journal count re-parks an upheld task before its funded attempt can
-// dispatch (measured live on run-20260726-213539), making a fresh journal the only escape.
+// dispatch (measured live on run-20260726-213539), making a fresh journal the only escape. A T15
+// replayMeasurement re-observes an interrupted round and is audit evidence, not a newly funded round.
 export function reviewRoundsSinceApproval(events, taskId) {
     let rounds = 0;
     for (const e of events) {
@@ -65,7 +67,8 @@ export function reviewRoundsSinceApproval(events, taskId) {
             continue;
         if (e.event === "task-approved")
             rounds = 0;
-        else if (e.event === "gate-result" && e.data.gate === "review" && e.data.pass === false)
+        else if (e.event === "gate-result" && e.data.gate === "review" && e.data.pass === false
+            && e.data.replayMeasurement !== true)
             rounds++;
     }
     return rounds;
@@ -200,6 +203,17 @@ const VOLATILE_TOKENS = [
     // An absolute path INTO the repo keeps its repo-relative tail — that tail IS identity (a defect in
     // daemon.ts is not a defect in journal.ts); only the machine/worktree prefix ahead of it is volatile.
     [/\/(?:[\w.@~+%-]+\/)*((?:src|tests|scripts|docs|fixtures|specs|schema|skills|assets)\/[\w.@~+%/-]+)/g, "<path>/$1"],
+    // v1.88 T3: a mkdtemp directory name is a chosen prefix plus six characters the RUNTIME generates,
+    // and the final-segment rule below keeps the whole name as identity — so a failure that NAMES the
+    // temp directory carried its random suffix through, two dispatches of one defect fingerprinted
+    // apart, and gate-fingerprint-cap was unreachable (v1.87 T5 re-ran six times where the cap would
+    // have parked it at two). Only the generated suffix is volatile; the chosen prefix is identity —
+    // a tickmarkr-llm- failure is not a tickmarkr-eval- one and must not spend its retry budget.
+    // Gated three ways, because a false cap bans a legitimate retry while a missed cap costs one round:
+    // on a tmp ROOT (mkdtemp writes under os.tmpdir()), on the separator that ends the chosen prefix
+    // (it is what tells us where the prefix stops), and on the suffix carrying an uppercase or a digit
+    // so an ordinary six-letter word — /tmp/tickmarkr-worker-output — stays identity.
+    [/(\/(?:private\/)?(?:tmp|var\/folders)\/(?:[\w.@~+%-]+\/)*?[\w.@~+%-]*[-_])(?=[A-Za-z0-9]*[A-Z0-9])[A-Za-z0-9]{6}(?![\w.@~+%-])/g, "$1<tmp>"],
     // Rule: an absolute diagnostic path's machine/worktree prefix is volatile, but its named file is
     // identity. Therefore paths outside the repo-marker set keep their final segment: two machines
     // naming parse.js normalize together, while parse.js and render.js can never spend one another's
@@ -292,7 +306,8 @@ export function normalizeGateFailure(details) {
 }
 // Two normalized-identical failures of one gate on one task buy no more rounds (the ladder cannot fix
 // what it already re-ran verbatim). Engagement-scoped exactly like reviewRoundsSinceApproval: an
-// operator approval is a new engagement, and nothing else resets the count.
+// operator approval is a new engagement, and nothing else resets the count. Resume re-measurements
+// are excluded because the interrupted attempt already bought the result they confirm.
 export const GATE_FINGERPRINT_CAP = 2;
 export function identicalGateFailures(events, taskId, gate, normalized) {
     let n = 0;
@@ -302,6 +317,7 @@ export function identicalGateFailures(events, taskId, gate, normalized) {
         if (e.event === "task-approved")
             n = 0;
         else if (e.event === "gate-result" && e.data.gate === gate && e.data.pass === false
+            && e.data.replayMeasurement !== true
             && typeof e.data.details === "string"
             && normalizeGateFailure(e.data.details) === normalized)
             n++;
@@ -474,12 +490,14 @@ const PROVIDER_OUTAGE_RE = /Unable to reach the model provider|cannot reach the
 export function classifyWorkerResultCause(opts) {
     if (opts.ok && opts.finished)
         return undefined;
+    // v1.89 T7: a provider-outage signature is independent of trailer state and has its own remedy.
     if (PROVIDER_OUTAGE_RE.test(opts.output))
         return "provider-death";
+    // A stall kill is distinguished by its timeout signal, before any trailer-derived result fields.
+    if (opts.timedOut)
+        return "stall-timeout";
     if (opts.summary === "unparseable TICKMARKR_RESULT trailer")
         return "malformed-trailer";
-    if (!opts.finished && opts.timedOut)
-        return "stall-timeout";
     if (!opts.finished && opts.exitCode !== null)
         return "clean-exit-no-trailer";
     if (!opts.finished)
@@ -657,6 +675,24 @@ function readJsonl(path) {
     }
     return out;
 }
+// The tracked compatibility boundary additionally retains physical source identity. Keep it separate
+// from readJsonl so the daemon's hot raw replay path pays no schema or wrapper-allocation cost.
+function readJsonlSource(path) {
+    if (!existsSync(path))
+        return [];
+    const out = [];
+    for (const [sourceIndex, line] of readFileSync(path, "utf8").split("\n").entries()) {
+        if (!line.trim())
+            continue;
+        try {
+            out.push({ sourceIndex, raw: JSON.parse(line) });
+        }
+        catch {
+            // torn trailing write after a crash — ignore; everything before it is intact
+        }
+    }
+    return out;
+}
 // Cross-run telemetry for Phase-12 profile derivation: the last K runs' rows, each
 // tagged with its runId (runIds are zero-padded run-UTCYYYYMMDD-HHMMSS-sequence ⇒ plain .sort() is
 // chronological, same as latestRunId). Rows are facts, not classifications — Phase 12
@@ -775,17 +811,22 @@ export class Journal {
     get journalPath() {
         return join(this.dir, "journal.jsonl");
     }
-    append(event, taskId, data = {}) {
+    append(eventOrDecision, taskId, data = {}) {
+        const decisionRow = typeof eventOrDecision === "string"
+            ? undefined
+            : DecisionEventSchema.parse({ ...eventOrDecision, ts: new Date().toISOString() });
+        const event = decisionRow?.event ?? eventOrDecision;
+        const inputData = decisionRow?.data ?? data;
         const evidence = judgePersistence.getStore();
         const failed = evidence?.invocations.filter((invocation) => invocation.transcript !== undefined) ?? [];
         const persistedData = event === "judge-retry" && failed.length > 0
             ? {
-                ...data,
+                ...inputData,
                 transcript: failed[0].transcript,
                 ...(failed[1] ? { retryTranscript: failed[1].transcript } : {}),
             }
-            : data;
-        const row = {
+            : inputData;
+        const row = decisionRow ?? {
             ts: new Date().toISOString(), event, ...(taskId ? { taskId } : {}), data: persistedData,
         };
         // T3 secret redaction: only the persisted bytes are masked — the caller's data stays untouched in
@@ -825,6 +866,9 @@ export class Journal {
     read() {
         return readJsonl(this.journalPath);
     }
+    readTracked() {
+        return trackJournalRows(this.runId, readJsonlSource(this.journalPath));
+    }
     replayStatuses() {
         const s = new Map();
         for (const e of this.read()) {
@@ -956,6 +1000,52 @@ export class Journal {
         }
         return satisfied;
     }
+    // T15: replay completed measurements from the CURRENT worker attempt. A later task-dispatch starts
+    // a new attempt and erases every older result; a result naming a different commit starts a new
+    // commit-scoped set. Last result per gate wins, so a later failure retracts a pass and a later pass
+    // can replace a failure. Missing/malformed commit or gate data is inert and therefore never skipped.
+    // This fold never derives satisfaction from task-approved: failed-gate authority belongs
+    // exclusively to replaySatisfiedGates(), whose typed release-marker contract above is unchanged.
+    replayCurrentAttemptGateResults() {
+        const replay = new Map();
+        for (const e of this.read()) {
+            if (!e.taskId)
+                continue;
+            if (e.event === "task-dispatch") {
+                replay.delete(e.taskId);
+                continue;
+            }
+            // Releases that buy another worker deliberately end the attempt whose measurements preceded
+            // them. An untyped approval and gate-satisfied stay in their own authority semantics: neither
+            // can turn a failure into observed green here.
+            if (e.event === "task-approved"
+                && (e.data.release === ATTEMPT_CAP_RELEASE || e.data.release === RECHECK_RELEASE
+                    || e.data.release === REVIEW_UPHELD_RELEASE)) {
+                replay.delete(e.taskId);
+                continue;
+            }
+            if (e.event !== "gate-result")
+                continue;
+            if (typeof e.data.commit !== "string" || typeof e.data.gate !== "string"
+                || !GATE_NAMES.includes(e.data.gate)) {
+                replay.delete(e.taskId); // a newer unattributable verdict invalidates the older candidate
+                continue;
+            }
+            let state = replay.get(e.taskId);
+            if (!state || state.commit !== e.data.commit) {
+                state = { commit: e.data.commit, results: new Map() };
+                replay.set(e.taskId, state);
+            }
+            // A selected-test green is explicitly a screen, never the merge verdict. Only its later
+            // fullSuite replacement may survive a restart as a satisfied test gate.
+            const incompleteTest = e.data.gate === "test" && Array.isArray(e.data.selectedTests)
+                && e.data.fullSuite !== true;
+            const satisfied = !incompleteTest
+                && (e.data.pass === true || e.data.skipped === true) && e.data.infra !== true;
+            state.results.set(e.data.gate, satisfied);
+        }
+        return replay;
+    }
     // v1.71 OBS-119: run-wide exclusion fold — same replay discipline as replayResumeState().
     // channel-exclusion is the typed event; dead-channel-failover.from is the pre-v1.71 compat seam.
     replayExcludedChannels() {

package/dist/run/lock.d.ts

@@ -17,6 +17,17 @@ export declare function acquireRunLock(repoRoot: string, runId: string): {
     };
 };
 export declare function releaseRunLock(repoRoot: string): void;
+export interface ApprovalSerialization {
+    /** true when another approval or run-end already owned the boundary before this caller */
+    contended: boolean;
+    release(): void;
+}
+export declare function acquireApprovalSerialization(repoRoot: string, runId: string): Promise<ApprovalSerialization>;
+export declare function runLockOwner(repoRoot: string): {
+    pid?: number;
+    runId?: string;
+    live: boolean;
+} | undefined;
 export declare function isRunLockLive(repoRoot: string): boolean;
 export declare function unlockRun(repoRoot: string): {
     held: false;