tickmarkr 1.97.0 → 2.1.0

package/dist/drivers/types.d.ts

@@ -1,3 +1,4 @@
+import type { JournalEvent } from "../run/journal.js";
 export interface Slot {
     id: string;
     name: string;
@@ -75,6 +76,7 @@ export interface ExecutorDriver {
     nudge?(slot: Slot, message: string): Promise<boolean>;
     notify(msg: string, opts?: NotifyOpts): Promise<void>;
     close(slot: Slot): Promise<void>;
+    narrateWith?(narrate: (event: JournalEvent) => void): void;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;
     narrator?: (cwd: string, command: string, runId?: string) => Promise<Slot>;
     reconcile?: (desired: Set<string>, runId: string, opts?: {

package/dist/gates/acceptance.js

@@ -179,20 +179,30 @@ function tail(out, n = 8) {
     return "\n" + t.split("\n").slice(-n).join("\n");
 }
 /**
- * OBS-540: classify only bytes produced by the deterministic oracle process. A nonzero command with
- * an infra-only output shape returned no product verdict, so it remains fail-closed but cannot be
- * billed as a diff failure. Judge reasons never reach this helper: the judge path starts after the
- * deterministic loop and a parsed refusal is an evaluated quality verdict whatever its prose says.
+ * OBS-540/551: classify only execution evidence produced by the deterministic oracle process. That
+ * includes its output, exit status and runner-reported test count — never judge-authored prose. A
+ * nonzero command with an infra-only output shape, one of the enumerated signal exits, or a zero-run
+ * report without a failure identity returned no product verdict, so it remains fail-closed but cannot
+ * be billed as a diff failure. A parsed judge refusal is an evaluated quality verdict whatever its
+ * prose says. As in baseline classification, a named regression remains a verdict even if teardown
+ * later exits through a signal.
  */
 function oracleExecutionFailure(label, code, stdout, stderr) {
     const output = [stderr, stdout].filter((part) => part.length > 0).join("\n");
     const classification = classifyFailureOutput(output);
-    if (classification === "infra") {
+    const signalName = code === 143 ? "SIGTERM" : code === 137 ? "SIGKILL" : undefined;
+    const signalKilled = signalName !== undefined && classification !== "regression";
+    const signalEvidence = signalKilled
+        ? `signal-shaped exit ${code} (${signalName}); `
+        : "";
+    const zeroRun = testsRan(output) === 0 && classification !== "regression";
+    const zeroRunEvidence = zeroRun ? "the runner reported zero tests run and no failure identity; " : "";
+    if (classification === "infra" || signalKilled || zeroRun) {
         return {
             gate: "acceptance",
             pass: false,
-            details: `oracle failed: ${label} (exit ${code}) — infrastructure blocked execution before a verdict; this oracle verified nothing${tail(output)}`,
-            meta: { cause: "oracle-execution", classification, infra: true, retryable: false },
+            details: `oracle failed: ${label} (exit ${code}) — ${signalEvidence || zeroRunEvidence}infrastructure blocked execution before a verdict; this oracle verified nothing${tail(output)}`,
+            meta: { cause: "oracle-execution", classification: "infra", infra: true, retryable: false },
         };
     }
     return {

package/dist/gates/llm.d.ts

@@ -33,6 +33,25 @@ export interface GateVia {
     nameFor: (role: "judge" | "review", adapter: string) => string;
     labelFor: (role: "judge" | "review") => string;
 }
+export declare const GATE_INACTIVITY_WINDOW_MS: number;
+/** Test seam — shrink only the calibrated inactivity window; production always reads 12 minutes. */
+export declare function setGateInactivityWindowMsForTests(ms: number): void;
+export declare function resetGateInactivityWindowMsForTests(): void;
+export interface GateCpuAccountant {
+    start(): Promise<void>;
+    read(): {
+        cpu: {
+            ms: number;
+            resolutionMs: number;
+        } | undefined;
+        gaps: number;
+    };
+    stop(): Promise<void>;
+}
+export type GateCpuAccountantFactory = (marker: string, cwd: string) => GateCpuAccountant;
+/** Test seam for deterministic measurable/activity/gap samples without platform-specific ps output. */
+export declare function setGateCpuAccountantFactoryForTests(factory: GateCpuAccountantFactory): void;
+export declare function resetGateCpuAccountantFactoryForTests(): void;
 export declare function captureLlmOutput<T>(run: () => Promise<T>): Promise<{
     value: T;
     outputs: string[];

package/dist/gates/llm.js

@@ -6,6 +6,7 @@ import { join } from "node:path";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { sh } from "../run/git.js";
+import { harvestCpuFlatWindowMs, normalizeStallSnapshot, WorkerTreeCpuAccountant, } from "../run/stall.js";
 export const GATE_PANE_SEP = " · ";
 // v1.64 gate-integrity (repo-scan Tier A·1): the concrete completion-faking shortcuts every
 // judge/review verdict must hunt for. Shared verbatim by the acceptance judge and review prompts.
@@ -94,6 +95,30 @@ export function rolePaneNameFromPrompt(prompt, fallback) {
     return fallback;
 }
 const llmOutputCapture = new AsyncLocalStorage();
+// v2.0 T1 (OBS-555): the empirical healthy-duration p95 is 10.6 minutes. The smallest whole
+// minute above it plus the specified one-minute margin is twelve minutes. This default remains
+// strictly below BOTH unchanged 900_000ms production dispatch timeouts: JUDGE_TIMEOUT_MS in
+// acceptance.ts and reviewGate's literal timeout in review.ts. Scope's 300_000ms call is not a
+// verdict gate and retains its existing one-wait behavior.
+export const GATE_INACTIVITY_WINDOW_MS = 12 * 60_000;
+const GATE_WAIT_SLICE_MS = 30_000;
+let gateInactivityWindowMs = GATE_INACTIVITY_WINDOW_MS;
+/** Test seam — shrink only the calibrated inactivity window; production always reads 12 minutes. */
+export function setGateInactivityWindowMsForTests(ms) {
+    gateInactivityWindowMs = ms;
+}
+export function resetGateInactivityWindowMsForTests() {
+    gateInactivityWindowMs = GATE_INACTIVITY_WINDOW_MS;
+}
+const productionGateCpuAccountant = (marker, cwd) => new WorkerTreeCpuAccountant(marker, cwd);
+let gateCpuAccountantFactory = productionGateCpuAccountant;
+/** Test seam for deterministic measurable/activity/gap samples without platform-specific ps output. */
+export function setGateCpuAccountantFactoryForTests(factory) {
+    gateCpuAccountantFactory = factory;
+}
+export function resetGateCpuAccountantFactoryForTests() {
+    gateCpuAccountantFactory = productionGateCpuAccountant;
+}
 // OBS-132: acceptance.ts owns verdict parsing and is deliberately byte-untouched. This async-scoped
 // recorder lets run-gates observe the exact output that acceptance parsed without changing runLlm's
 // return value or leaking concurrent tasks into one another. Callers retain output only when the
@@ -119,6 +144,8 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
 // as a visible named agent (herdr pane), with the quote-split completion wrapper.
 export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
+    let slot;
+    let accountant;
     try {
         const pf = join(dir, "prompt.md");
         writeFileSync(pf, prompt);
@@ -131,19 +158,90 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
             adapter.headlessCommand(pf, model),
             gateExitTrailer(nonce),
         ].join("\n"));
-        const slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
+        slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
         via.onSlot?.(slot);
         await via.driver.run(slot, paneDispatchCommand(scriptPath));
         // nonce-suffixed exit only: a displayed bare "TICKMARKR_EXIT:" or another call's marker must not
         // false-complete — same guard the worker path uses (daemon.ts:330-331).
-        await via.driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, timeoutMs, { regex: true });
-        const out = await via.driver.read(slot, 400);
-        if (!via.keep)
-            await via.driver.close(slot);
+        const exitPattern = `TICKMARKR_EXIT_${nonce}:\\d`;
+        let out;
+        const gatePrompt = prompt.startsWith("TICKMARKR-JUDGE") || prompt.startsWith("TICKMARKR-REVIEW");
+        if (!gatePrompt) {
+            await via.driver.waitOutput(slot, exitPattern, timeoutMs, { regex: true });
+            out = await via.driver.read(slot, 400);
+        }
+        else {
+            // Review and judge waits are sliced so the two-leg inactivity policy can observe the pane and
+            // the exact dispatch script's process tree between waits. The accountant retains short-lived
+            // descendants with the same semantics as daemon workers; llm.ts depends only on stall.ts.
+            accountant = gateCpuAccountantFactory(scriptPath, cwd);
+            await accountant.start();
+            const startedAt = Date.now();
+            out = await via.driver.read(slot, 400);
+            let priorSnapshot = normalizeStallSnapshot(out);
+            const anchoredAt = Date.now();
+            let quietSince = anchoredAt;
+            const initialCpu = accountant.read();
+            let priorCpuMs = initialCpu.cpu?.ms;
+            let priorGaps = initialCpu.gaps;
+            let cpuFlatSince = initialCpu.cpu === undefined ? undefined : anchoredAt;
+            while (Date.now() - startedAt < timeoutMs) {
+                const remaining = timeoutMs - (Date.now() - startedAt);
+                // The adaptive test-window arm keeps a seam-adjusted case sliced too; production stays 30s.
+                const sliceMs = Math.max(1, Math.min(GATE_WAIT_SLICE_MS, Math.ceil(gateInactivityWindowMs / 4), remaining));
+                const matched = await via.driver.waitOutput(slot, exitPattern, sliceMs, { regex: true });
+                const raw = await via.driver.read(slot, 400);
+                out = raw;
+                // waitOutput is the driver's authoritative marker match. The raw check covers drivers whose
+                // wait timed out at the same boundary the marker landed; either way a trailer completes
+                // normally and is never mistaken for inactivity.
+                if (matched || new RegExp(exitPattern).test(raw))
+                    break;
+                const now = Date.now();
+                const snapshot = normalizeStallSnapshot(raw);
+                if (snapshot !== priorSnapshot) {
+                    priorSnapshot = snapshot;
+                    quietSince = now;
+                }
+                const observation = accountant.read();
+                const cpu = observation.cpu;
+                if (observation.gaps !== priorGaps || cpu === undefined) {
+                    // Missing evidence is a hold-open signal, never guessed inactivity. A later measurable
+                    // sample starts a fresh complete window rather than inheriting quiet time across the gap.
+                    priorGaps = observation.gaps;
+                    priorCpuMs = undefined;
+                    cpuFlatSince = undefined;
+                    quietSince = now;
+                    continue;
+                }
+                if (priorCpuMs === undefined || cpu.ms !== priorCpuMs) {
+                    // Any process-tree CPU movement holds the call open and re-arms both clocks. Equality only
+                    // becomes "flat" after the existing resolution-aware quantum window has elapsed.
+                    priorCpuMs = cpu.ms;
+                    cpuFlatSince = now;
+                    quietSince = now;
+                    continue;
+                }
+                const cpuFlatFor = now - (cpuFlatSince ?? now);
+                const snapshotQuietFor = now - quietSince;
+                if (cpuFlatFor >= harvestCpuFlatWindowMs(cpu.resolutionMs)
+                    && snapshotQuietFor >= gateInactivityWindowMs) {
+                    break;
+                }
+            }
+        }
         return dewrapPaneVerdict(out, nonce);
     }
     finally {
-        rmSync(dir, { recursive: true, force: true });
+        try {
+            await accountant?.stop();
+            if (slot && !via.keep)
+                await via.driver.close(slot);
+        }
+        finally {
+            // Unconditional and synchronous: a stop/close failure must not leak this call's prompt and script.
+            rmSync(dir, { recursive: true, force: true });
+        }
     }
 }
 // OBS-155: a TUI renders the verdict as a bullet and HARD-wraps it at pane width with a 2-space

package/dist/gates/run-gates.d.ts

@@ -4,6 +4,23 @@ import { type GateName, type Task } from "../graph/schema.js";
 import { type Baseline } from "./baseline.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
+export type LoadProvider = () => number;
+/** Test seam — inject deterministic load samples; production always reads os.loadavg. */
+export declare function setLoadProviderForTests(provider: LoadProvider): void;
+export declare function resetLoadProviderForTests(): void;
+/**
+ * One gate's own measurement, taken WHERE THE GATE RUNS. `durationMs` sums that gate's execution
+ * intervals and nothing between them, so the composite `test` gate (a selected screen, then other
+ * gates, then the full suite) reports the two suites' cost rather than the span containing them —
+ * and no consumer has to re-derive a duration by subtracting journal timestamps, which measures the
+ * queue as well as the work. The load samples bracket the FIRST interval's start and the LAST
+ * interval's end: start is what a scheduler would have decided on, end is the state it left behind.
+ */
+export interface GateTelemetry {
+    durationMs: number;
+    load1Start: number;
+    load1End: number;
+}
 export type GateEvent = {
     phase: "start";
     gate: GateName;
@@ -31,6 +48,7 @@ export interface GateContext {
     artifactDir?: string;
     pipeline?: "v185" | "legacy";
     selectTests?: boolean;
+    collateral?: ReadonlyArray<string>;
     onGate?: (e: GateEvent) => void | Promise<void>;
 }
 /**

package/dist/gates/run-gates.js

@@ -1,5 +1,6 @@
-import { readFileSync } from "node:fs";
-import { posix } from "node:path";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { loadavg, tmpdir } from "node:os";
+import { join, posix } from "node:path";
 import { channelKey, shq } from "../adapters/types.js";
 import { TIER_RANK } from "../config/config.js";
 import { getAdapter } from "../adapters/registry.js";
@@ -14,6 +15,85 @@ import { reviewGate } from "./review.js";
 import { scopeGate } from "./scope.js";
 import { shGit } from "../run/git.js";
 import { withJudgeInvocationEvidence } from "../run/journal.js";
+const productionLoadProvider = () => loadavg()[0] ?? 0;
+let loadProvider = productionLoadProvider;
+/** Test seam — inject deterministic load samples; production always reads os.loadavg. */
+export function setLoadProviderForTests(provider) {
+    loadProvider = provider;
+}
+export function resetLoadProviderForTests() {
+    loadProvider = productionLoadProvider;
+}
+/**
+ * Instrument the adapter command itself, which is the first adapter-owned operation runLlm performs.
+ * acceptanceGate/reviewGate deliberately retain ownership of deterministic oracles, policy checks,
+ * diff reads and prompt construction; none of that preprocessing belongs to an LLM invocation span.
+ *
+ * Both stamps are written by the same shell immediately around the adapter command. That excludes
+ * pane-slot acquisition as well as runLlm's scratch cleanup and verdict parsing, without changing
+ * llm.ts's output contract. The subshell keeps an adapter command's `exit` from bypassing the end
+ * stamp, and the original exit status is preserved.
+ */
+function instrumentLlmAdapter(adapter, clocks) {
+    return new Proxy(adapter, {
+        get(target, property) {
+            if (property === "headlessCommand") {
+                return (promptFile, model) => {
+                    const command = target.headlessCommand(promptFile, model);
+                    const dir = mkdtempSync(join(tmpdir(), "tickmarkr-gate-invocation-"));
+                    const startedAtPath = join(dir, "started-at");
+                    const completedAtPath = join(dir, "completed-at");
+                    clocks.push({
+                        channel: channelKey({ adapter: target.id, model }),
+                        preparedAt: Date.now(),
+                        startedAtPath,
+                        completedAtPath,
+                        dir,
+                    });
+                    const stamp = (path) => `${shq(process.execPath)} -e ${shq('require("node:fs").writeFileSync(process.argv[1], String(Date.now()))')} ${shq(path)}`;
+                    // End with a status-bearing subshell, not `exit`: pane mode appends its nonce-bound
+                    // completion trailer on the next script line and must remain able to run it.
+                    return `${stamp(startedAtPath)}; ( ${command} ); __tickmarkr_invocation_status=$?; ${stamp(completedAtPath)}; (exit $__tickmarkr_invocation_status)`;
+                };
+            }
+            const value = Reflect.get(target, property, target);
+            // Real adapters may use private fields; bind their methods to the target rather than the Proxy.
+            return typeof value === "function" ? value.bind(target) : value;
+        },
+    });
+}
+function finishLlmDispatches(clocks) {
+    return clocks.map((clock) => {
+        let startedAt = clock.preparedAt;
+        let completedAt = Date.now();
+        try {
+            const stampedStart = Number(readFileSync(clock.startedAtPath, "utf8"));
+            const stamped = Number(readFileSync(clock.completedAtPath, "utf8"));
+            if (Number.isFinite(stampedStart))
+                startedAt = stampedStart;
+            if (Number.isFinite(stamped) && stamped >= startedAt)
+                completedAt = stamped;
+        }
+        catch {
+            // A killed command may never reach its stamp; the gate return is the honest upper boundary.
+        }
+        finally {
+            rmSync(clock.dir, { recursive: true, force: true });
+        }
+        return { channel: clock.channel, durationMs: completedAt - startedAt };
+    });
+}
+async function captureLlmDispatches(adapters, run) {
+    const clocks = [];
+    try {
+        const captured = await captureLlmOutput(() => run(adapters.map((a) => instrumentLlmAdapter(a, clocks))));
+        return { ...captured, invocations: finishLlmDispatches(clocks) };
+    }
+    catch (error) {
+        finishLlmDispatches(clocks);
+        throw error;
+    }
+}
 const TEST_FILE_RE = /(?:^|\/)[^/]*\.(?:test|spec)\.[cm]?[jt]sx?$/;
 // relative specifiers only — `from "./x.js"`, `import("./x.js")`, `require("./x.js")`
 const IMPORT_RE = /(?:\bfrom\s*|\bimport\s*\(\s*|\brequire\s*\(\s*)["'](\.[^"']*)["']/g;
@@ -124,12 +204,56 @@ export async function runGates(task, ctx) {
     // exactly one `test` gate-result ever leaves a round, always carrying which suite spoke for it.
     // (A RED screen IS the verdict: the round ends there, so it is recorded immediately.)
     let heldTest;
+    // v2.0 T2 (OBS-554): this round's per-gate measurement. Every interval a gate actually spends
+    // executing is added HERE, at the call site that runs it, so a gate that runs twice (the test
+    // gate's screen and its full suite) sums to its own cost and never to the span between them.
+    const spans = new Map();
+    // The test gate's two halves, kept apart as well as summed: `durationMs` alone cannot say whether
+    // a slow round was a slow subset or a slow full suite, and the parked scheduler's threshold is
+    // defined over the full-suite cost.
+    let selectedDurationMs;
+    let fullDurationMs;
+    const measure = async (gate, run) => {
+        const at = Date.now();
+        const load1Start = loadProvider();
+        try {
+            return await run();
+        }
+        finally {
+            const prior = spans.get(gate);
+            spans.set(gate, {
+                durationMs: (prior?.durationMs ?? 0) + (Date.now() - at),
+                load1Start: prior?.load1Start ?? load1Start,
+                load1End: loadProvider(),
+            });
+        }
+    };
+    // The measurement is attached at the ONE seam every result leaves this function through, so a
+    // path that forgets to measure is visibly missing its telemetry rather than carrying a fabricated
+    // zero. The daemon lifts these off `meta` onto the gate-result row (src/run/daemon.ts).
+    const withTelemetry = (result) => {
+        const span = spans.get(result.gate);
+        if (!span)
+            return result;
+        return {
+            ...result,
+            meta: {
+                ...result.meta,
+                ...span,
+                ...(result.gate === "test" && selectedDurationMs !== undefined ? { selectedDurationMs } : {}),
+                ...(result.gate === "test" && fullDurationMs !== undefined ? { fullDurationMs } : {}),
+            },
+        };
+    };
     const sequence = GATE_NAMES.filter((g) => enabled(g));
     const total = sequence.length;
     const indexOf = (gate) => sequence.indexOf(gate) + 1;
+    // The stamp lands here, on the ONE object that is both pushed and published, so the round's record
+    // and its event stream carry byte-identical results — an invariant the fixtures pin.
     const record = async (result) => {
-        results.push(result);
-        await ctx.onGate?.({ phase: "end", gate: result.gate, result });
+        const stamped = withTelemetry(result);
+        results.push(stamped);
+        await ctx.onGate?.({ phase: "end", gate: stamped.gate, result: stamped });
     };
     const emitStart = async (gate, parentAt) => {
         await ctx.onGate?.({ phase: "start", gate, index: indexOf(gate), total, ...(parentAt === undefined ? {} : { parentAt }) });
@@ -141,7 +265,7 @@ export async function runGates(task, ctx) {
         if (heldTest) {
             const held = heldTest;
             heldTest = undefined;
-            await ctx.onGate?.({ phase: "end", gate: "test", result: held });
+            await ctx.onGate?.({ phase: "end", gate: "test", result: held }); // stamped when it was held
         }
         const sorted = [...results].sort((a, b) => GATE_NAMES.indexOf(a.gate) - GATE_NAMES.indexOf(b.gate));
         // v1.87 T5: no round returns a MERGEABLE GREEN on a dirty tree. The battery is not the only gate
@@ -155,7 +279,7 @@ export async function runGates(task, ctx) {
         if (last && sorted.every((r) => r.pass || r.meta?.skipped === true)) {
             const dirt = await dirtyWorktree();
             if (dirt) {
-                const refusal = dirtyRoundRefusal(last.gate, dirt);
+                const refusal = withTelemetry(dirtyRoundRefusal(last.gate, dirt));
                 results[results.indexOf(last)] = refusal;
                 sorted[sorted.length - 1] = refusal;
                 await ctx.onGate?.({ phase: "end", gate: refusal.gate, result: refusal });
@@ -221,7 +345,14 @@ export async function runGates(task, ctx) {
             // ponytail: compareToBaseline batches build/test/lint — their starts are emitted at iteration,
             // not at true execution start. They are collectively sub-second (measured), so the debounce
             // suppresses them anyway; split compareToBaseline only if a tool gate ever gets slow.
+            // ponytail: legacy runs build/test/lint in ONE compareToBaseline call, so there is one interval
+            // to measure and each of its gates carries it. Split it only if this branch ever stops batching.
+            const batchAt = Date.now();
+            const batchLoadStart = loadProvider();
             const toolResults = await compareToBaseline(ctx.worktree, commands, ctx.baseline, toolGates);
+            const batch = { durationMs: Date.now() - batchAt, load1Start: batchLoadStart, load1End: loadProvider() };
+            for (const g of toolGates)
+                spans.set(g, batch);
             // The same refusal AFTER the commands, because a green command can dirty the tree the check
             // above just proved clean. Batched, legacy cannot say WHICH command did it, so the refusal
             // lands on the last gate that had one — the round dies there either way. A red battery is
@@ -238,7 +369,10 @@ export async function runGates(task, ctx) {
         // the full vitest suite before anyone reads its verdict.
         for (const g of toolGates) {
             await emitStart(g);
-            const [r] = await compareToBaseline(ctx.worktree, commands, ctx.baseline, [g]);
+            const [r] = await measure(g, () => compareToBaseline(ctx.worktree, commands, ctx.baseline, [g]));
+            // the screen's interval IS the test gate's first interval, so the split needs no second clock
+            if (g === "test" && selected)
+                selectedDurationMs = spans.get("test").durationMs;
             // The pre-battery check proves the tree clean ONCE; a command that exits 0 having rewritten a
             // tracked file makes it dirty again, and every gate after it — including the next shell gate,
             // which would then run against bytes HEAD does not hold — inherits that. So re-check after each
@@ -257,8 +391,8 @@ export async function runGates(task, ctx) {
                 if (!screened.pass)
                     await record(screened);
                 else {
-                    heldTest = screened;
-                    results.push(screened);
+                    heldTest = withTelemetry(screened);
+                    results.push(heldTest);
                 }
             }
             else {
@@ -292,10 +426,10 @@ export async function runGates(task, ctx) {
      */
     const allowDeviations = [...(ctx.cfg.scope?.allowDeviations ?? [])];
     Object.freeze(allowDeviations);
-    const scopeResult = () => scopeGate(ctx.worktree, ctx.baseRef, task.files, ctx.result, allowDeviations);
+    const scopeResult = () => scopeGate(ctx.worktree, ctx.baseRef, task.files, ctx.result, allowDeviations, ctx.collateral ? { taskId: task.id, predicted: ctx.collateral } : undefined);
     const runGate = async (gate, compute) => {
         await emitStart(gate);
-        await record(await compute());
+        await record(await measure(gate, compute));
     };
     /**
      * T4 (OBS-265): the deterministic git checks run BEFORE the battery, as a screen — they answer
@@ -319,7 +453,7 @@ export async function runGates(task, ctx) {
         for (const [gate, compute] of [["evidence", evidenceResult], ["scope", scopeResult]]) {
             if (!enabled(gate))
                 continue;
-            screened.push(await compute());
+            screened.push(await measure(gate, compute));
             if (screened[screened.length - 1].pass)
                 continue;
             for (const r of screened) {
@@ -354,20 +488,30 @@ export async function runGates(task, ctx) {
         // v1.19 (T2): testCmd threads the detected test runner to the gate so named-test oracles run
         // deterministically (filtered via -t) before any LLM judge dispatch.
         const invocations = [];
+        // v2.0 T2 (OBS-554): one entry per JUDGE DISPATCH — primary and the GATE-09 retry alike. The gate's
+        // own durationMs is the pair's envelope and cannot answer what the parked ceiling recalibration
+        // asks ("how long does ONE healthy judge invocation take?"), so the invocations are kept apart.
+        // Separate from `invocations` above deliberately: that array is transcript evidence and records
+        // one entry per CAPTURED OUTPUT, so a dispatch that produced none contributes nothing to it.
+        const invocationSpans = [];
         const invokeJudge = async (adapter, model, via) => {
-            const started = Date.now();
-            const captured = await captureLlmOutput(() => acceptanceGate(task, ctx.worktree, ctx.baseRef, { adapter, model }, via, { testCmd: ctx.commands.test, diffCap: ctx.cfg.gates.diffCap }));
-            const channel = channelKey({ adapter: adapter.id, model });
+            const captured = await captureLlmDispatches([adapter], ([instrumented]) => acceptanceGate(task, ctx.worktree, ctx.baseRef, { adapter: instrumented, model }, via, { testCmd: ctx.commands.test, diffCap: ctx.cfg.gates.diffCap }));
+            // The instrumented adapter is reached only by runLlm. Deterministic oracles and diff-cap exits
+            // never call headlessCommand, so they produce no clock and cannot manufacture an invocation.
+            invocationSpans.push(...captured.invocations);
             const unparseable = captured.value.meta?.unparseable === true;
             // acceptanceGate has exactly one runLlm call. Keep the map shape so a future deterministic early
             // return (zero outputs) stays telemetry-free instead of manufacturing a judge invocation.
-            for (const output of captured.outputs) {
+            for (const [index, output] of captured.outputs.entries()) {
+                const span = captured.invocations[index];
+                if (!span)
+                    continue;
                 invocations.push({
                     taskId: task.id,
-                    channel,
+                    channel: span.channel,
                     outcome: unparseable ? "failed" : "done",
                     judgeOutcome: unparseable ? "unparseable" : "parseable",
-                    durationMs: Date.now() - started,
+                    durationMs: span.durationMs,
                     ...(unparseable ? { transcript: output } : {}),
                 });
             }
@@ -412,11 +556,26 @@ export async function runGates(task, ctx) {
             a = await invokeJudge(retryAdapter, retry.model, retryJvia);
             a = { ...a, meta: { ...a.meta, judgeRetry: { flaked: flakedKey, retried: channelKey({ adapter: retry.adapter, model: retry.model }) } } };
         }
-        return { result: a, invocations };
+        // No dispatch, no key: a deterministic-oracle round writes no `invocations` field rather than an
+        // empty array a reader could mistake for "measured, and it cost nothing".
+        return { result: invocationSpans.length ? { ...a, meta: { ...a.meta, invocations: invocationSpans } } : a, invocations };
     };
     // cross-vendor review
     const runReview = async () => {
-        let rv = await reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, ctx.adapters, ctx.cfg, ctx.via, ctx.excludeReviewers, ctx.artifactDir);
+        // v2.0 T2: per-dispatch spans, exactly as the judge keeps them. A round that re-asks a second
+        // seat spends two invocations, and one blended span cannot tell a slow reviewer from two.
+        // A pick that found NO eligible seat dispatched nothing, so it contributes no invocation.
+        const invocations = [];
+        // Dispatch is PROVEN, never inferred: captureLlmOutput records one output per runLlm return, so an
+        // empty capture means reviewGate returned before asking anyone — a policy skip, a pre-dispatch diff
+        // cap, or no eligible seat. Reading `noEligibleReviewer` alone missed the first two and invented
+        // an "unknown" span for each.
+        const dispatch = async (run) => {
+            const captured = await captureLlmDispatches(ctx.adapters, run);
+            invocations.push(...captured.invocations);
+            return captured.value;
+        };
+        let rv = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, ctx.via, ctx.excludeReviewers, ctx.artifactDir));
         // OBS-193: an unparseable review verdict retries the REVIEW exactly once on a different reviewer —
         // never the worker (GATE-09's judge-retry shape: straight-line single `if`, meta-only detection,
         // the flaked verdict never enters results). The exclusion rides reviewGate's own excludeReviewers
@@ -427,13 +586,13 @@ export async function runGates(task, ctx) {
             const retryVia = ctx.via
                 ? { ...ctx.via, nameFor: (role, adapter) => ctx.via.nameFor(role, adapter) + "-r1" }
                 : undefined;
-            const second = await reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, ctx.adapters, ctx.cfg, retryVia, [...(ctx.excludeReviewers ?? []), flaked], ctx.artifactDir);
+            const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, [...(ctx.excludeReviewers ?? []), flaked], ctx.artifactDir));
             if (second.meta?.noEligibleReviewer !== true) {
                 const retried = typeof second.meta?.reviewer === "string" ? second.meta.reviewer : "none";
                 rv = { ...second, meta: { ...second.meta, reviewRetry: { flaked, retried } } };
             }
         }
-        return rv;
+        return invocations.length ? { ...rv, meta: { ...rv.meta, invocations } } : rv;
     };
     // v1.87 T5: the refusal is the FIRST thing a round does, whatever that round is configured to run.
     // Guarding only the configured build/test/lint commands left the hole this repairs: the battery is
@@ -442,8 +601,14 @@ export async function runGates(task, ctx) {
     // oracles judged uncommitted state, on a commit whose diff nobody had run. One check at the top, and
     // no shell-executing gate path is reachable on a dirty tree. It lands on the first gate of this
     // round's sequence: the round dies there, exactly as it does on a red command.
+    // The check runs BEFORE any gate, so on a clean tree it belongs to no gate: charging every round's
+    // first gate for it would inflate the one measurement the parked recalibrations key on. It becomes
+    // that gate's interval only on the path where it IS what the gate did — the refusal below.
+    const entryAt = Date.now();
+    const entryLoad = loadProvider();
     const entryDirt = sequence.length ? await dirtyWorktree() : undefined;
     if (entryDirt) {
+        spans.set(sequence[0], { durationMs: Date.now() - entryAt, load1Start: entryLoad, load1End: loadProvider() });
         await emitStart(sequence[0]);
         await record(dirtyRefusal(sequence[0], entryDirt));
         return done();
@@ -481,8 +646,8 @@ export async function runGates(task, ctx) {
             await emitStart("acceptance", parentAt);
         if (enabled("review"))
             await emitStart("review", parentAt);
-        const judging = enabled("acceptance") ? runAcceptance() : undefined;
-        const reviewing = enabled("review") ? runReview() : undefined;
+        const judging = enabled("acceptance") ? measure("acceptance", runAcceptance) : undefined;
+        const reviewing = enabled("review") ? measure("review", runReview) : undefined;
         // Attach BOTH publication handlers before awaiting either. Dispatch concurrency alone is not
         // enough: an acceptance-first await withholds a completed review behind a slow/hung judge and a
         // process death can lose that already-earned verdict. The returned result is still sorted into
@@ -497,14 +662,14 @@ export async function runGates(task, ctx) {
         // Legacy serial walk — frozen, and reachable only from the fixtures that pin it.
         if (enabled("acceptance")) {
             await emitStart("acceptance");
-            const judged = await runAcceptance();
+            const judged = await measure("acceptance", runAcceptance);
             await withJudgeInvocationEvidence(judged.invocations, () => record(judged.result));
             if (failed())
                 return done();
         }
         if (enabled("review")) {
             await emitStart("review");
-            await record(await runReview());
+            await record(await measure("review", runReview));
         }
         return done();
     }
@@ -518,11 +683,12 @@ export async function runGates(task, ctx) {
         // This is the last shell command a round can run — the judge's named-test oracle (acceptance.ts)
         // may have run one before it, and every gate between the battery and here reads commits only, so
         // a clean tree HERE is what makes "the gated commit is the tested tree" true at merge time.
-        const [full] = await compareToBaseline(ctx.worktree, ctx.commands, ctx.baseline, ["test"]);
+        const [full] = await measure("test", () => compareToBaseline(ctx.worktree, ctx.commands, ctx.baseline, ["test"]));
+        fullDurationMs = spans.get("test").durationMs - (selectedDurationMs ?? 0);
         const dirt = full.pass ? await dirtyWorktree() : undefined;
-        const merged = dirt
+        const merged = withTelemetry(dirt
             ? dirtyRefusal("test", dirt, ctx.commands.test)
-            : { ...full, meta: { ...full.meta, fullSuite: true, selectedTests: selected } };
+            : { ...full, meta: { ...full.meta, fullSuite: true, selectedTests: selected } });
         results[results.findIndex((r) => r.gate === "test")] = merged;
         heldTest = undefined;
         await ctx.onGate?.({ phase: "end", gate: "test", result: merged });

package/dist/gates/scope.d.ts

@@ -6,4 +6,12 @@ export declare function dispositionOffenders(offenders: string[], allowDeviation
     hard: string[];
     allowed: string[];
 };
-export declare function scopeGate(worktree: string, integrationTip: string, files: string[], result: WorkerResult, allowDeviations?: string[]): Promise<GateResult>;
+/**
+ * OBS-547: `collateral` is this task's slice of the run's ONE full prediction map (computed at run
+ * start, uncapped — src/compile/collateral.ts). Absent ⇒ no classification, today's behaviour; the
+ * gate never computes a map of its own, so what it classifies on is always what the run predicted.
+ */
+export declare function scopeGate(worktree: string, integrationTip: string, files: string[], result: WorkerResult, allowDeviations?: string[], collateral?: {
+    taskId: string;
+    predicted: ReadonlyArray<string>;
+}): Promise<GateResult>;