tickmarkr 2.1.2 → 2.1.4

package/dist/run/daemon.js

@@ -19,16 +19,15 @@ import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHa
 import { GATE_NAMES } from "../graph/schema.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { runEnvironment } from "./environment.js";
-import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, runWithForkBudget, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, runWithForkBudget, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingReviewFindings, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
 import { nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
 import { harvestCpuFlatWindowMs, NUDGEABLE_ADAPTERS, PANE_READ_ROWS, StallProgressTracker, stallSnapshotBannerRows, WorkerTreeCpuAccountant, } from "./stall.js";
-import { armSupervision } from "./supervision.js";
 // Compatibility exports for the daemon liveness tests and existing consumers. The implementation
 // lives in stall.ts so gate dispatch can depend on it without importing the daemon.
 export { harvestCpuFlatWindowMs, resetHarvestCpuFlatMsForTests, setHarvestCpuFlatMsForTests, workerTreeCpuMs, } from "./stall.js";
@@ -721,13 +720,9 @@ export async function runDaemon(repoRoot, opts = {}) {
     // subprocess, so the optional-chain open below is a no-op there). Cosmetic-only: any failure is
     // swallowed (never affects the run); the operator closes a surviving watch pane.
     const lock = acquireRunLock(repoRoot, runId);
-    // T16: the orchestrator seat IS this daemon, so this is where the tier gets armed — the writer half
-    // T3 shipped had no caller outside its own tests, which made the reader honest and useless: it read
-    // ABSENT for the entire life of every run. Armed immediately after the lock (the first instant this
-    // process owns the run) and held to the last, so the beat's span is the run's span. armSupervision
-    // never throws, so an unwritable beat can never take a run down; it is deregistered in BOTH exits
-    // below, because the signal reaper exits the process before the finally can run.
-    const supervision = opts.supervise === false ? undefined : armSupervision(repoRoot, "orchestrator");
+    // D10: the lock is this daemon's liveness record and already carries its pid; status prints that
+    // identity beside the supervision row. The `orchestrator` tier belongs exclusively to the seated
+    // supervisor, so a run never beats or stands down that seat's record on the daemon's behalf.
     // v1.54 T2: declared before the try so the finally can always deregister (a throw before
     // registration leaves it undefined — the guard below covers that path).
     let onTermination;
@@ -855,7 +850,6 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                             catch { /* cosmetic — visibility is never a gate */ }
                         }
-                        supervision?.disarm(); // T16: same reason as the lock — this seat stood down, it did not die
                         releaseRunLock(repoRoot); // the process dies at exit() below — the finally never runs on this path
                     }
                     abortRun(new Error(`terminated by ${sig}`));
@@ -1145,6 +1139,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     await park(t, `humanGate: "${t.title}" requires approval before dispatch`, "human-gate", null, 0, startMs);
                     return;
                 }
+                // The driver owns how a checkout is created, but runDaemon owns the destructive transition:
+                // every task-checkout recreation passes through this wrapper before any driver can remove the
+                // old path. A preservation failure throws and therefore leaves the old checkout in place. The
+                // row is deliberately written before the later worktree-recreation row so the journal cannot
+                // describe only the commits it carried while omitting uncommitted work the removal destroyed.
+                const recreateTaskWorktree = async (taskBranch, taskBase, priorWt) => {
+                    const ref = await preserveWorktree(priorWt);
+                    if (ref)
+                        journal.append("worktree-preserved", t.id, { ref });
+                    return driver.worktree(repoRoot, taskBranch, taskBase);
+                };
                 const r = route(t, cfg, channels, profile, undefined, demotedChannels);
                 for (const lint of r.lints)
                     journal.append("routing-lint", t.id, { lint });
@@ -1457,7 +1462,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const priorTaskTip = await gitHead(priorWt);
                     const priorTaskSubject = await gateCommitSubject(taskBase, priorTaskTip, priorWt);
                     const commitsToCarry = await commitsAheadOf(taskBase, priorWt);
-                    const wt = await driver.worktree(repoRoot, taskBranch, taskBase);
+                    const wt = await recreateTaskWorktree(taskBranch, taskBase, priorWt);
                     const carriedCommits = await cherryPickCommits(wt, commitsToCarry);
                     // Reuse is about the tree the gates will actually inspect. The integration tip may have moved
                     // while the daemon was down, so compare after recreating the task on today's taskBase rather
@@ -1753,6 +1758,22 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const brief = journaledRows.join("\n\n");
                         feedback = feedback ? `${brief}\n\n${feedback}` : brief;
                     }
+                    // T6: both carries above are ATTEMPT-scoped — the funded repair is spent at the next
+                    // worker-launch (and budgeted at two), and the journaled brief is reset there too, so it hands
+                    // this dispatch only the LAST attempt's bytes. An unresolved review finding is a property of the
+                    // TASK: the moment one attempt fails for an unrelated reason — a red build, a refused tree, or a
+                    // death that journals no gate row at all — the finding is in neither carry and the next worker
+                    // re-derives the task from the spec and lands on the same gap the reviewer already anchored.
+                    // Re-derived from the journal on EVERY dispatch and retired only by a review that passes on this
+                    // task (journal.ts `outstandingReviewFindings`). Appended row-wise, because this round's own
+                    // feedback or a repair brief may already quote a finding and repeating it helps no worker.
+                    const outstandingFindings = outstandingReviewFindings(journaledSoFar, t.id);
+                    const unquoted = outstandingFindings.filter((f) => !feedback.includes(f.note));
+                    if (unquoted.length > 0) {
+                        const brief = ["## Outstanding review findings — a review has NOT passed on these yet",
+                            ...unquoted.map((f) => `- ${f.path}: ${f.note}`)].join("\n");
+                        feedback = feedback ? `${feedback}\n\n${brief}` : brief;
+                    }
                     retryMode = repairFindings
                         ? "repair"
                         : priorSession
@@ -1775,21 +1796,29 @@ export async function runDaemon(repoRoot, opts = {}) {
                     lastContextTokens = undefined;
                     graph = setStatus(graph, t.id, "running");
                     saveGraph(repoRoot, graph);
-                    journal.append("task-dispatch", t.id, { assignment, attempt, provenance: dispatchProvenance(r.provenance), retryMode });
+                    // T6: a dispatch that carries an outstanding finding says so, and names it. Without this the
+                    // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
+                    // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
+                    journal.append("task-dispatch", t.id, {
+                        assignment, attempt, provenance: dispatchProvenance(r.provenance), retryMode,
+                        ...(outstandingFindings.length > 0 ? { carriedFindings: outstandingFindings } : {}),
+                    });
                     journal.phaseStart(t.id, "worker", { attempt, assignment });
                     const taskBase = await integrationHead(intWt); // deps are merged → visible to this task
                     const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
                     const priorWt = worktreePath(repoRoot, taskBranch);
-                    const commitsToCarry = existsSync(priorWt) ? await commitsAheadOf(taskBase, priorWt) : [];
-                    const wt = await driver.worktree(repoRoot, taskBranch, taskBase);
+                    const recreating = existsSync(priorWt);
+                    const commitsToCarry = recreating ? await commitsAheadOf(taskBase, priorWt) : [];
+                    const wt = await recreateTaskWorktree(taskBranch, taskBase, priorWt);
                     // OBS-58: quota-failover and every retry recreate the task worktree from the integration tip —
                     // cherry-pick prior attempts' landed commits forward so a failover dispatch cannot silently
                     // orphan work a consult already verified as landed.
                     let carriedCommits = [];
                     if (commitsToCarry.length > 0) {
                         carriedCommits = await cherryPickCommits(wt, commitsToCarry);
-                        journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                     }
+                    if (recreating)
+                        journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                     // T2 review (material): harvest eligibility is "does this WORKTREE carry unverified work",
                     // measured against taskBase — the same base the fast-kill's delta probe and the gates
                     // themselves use. It was measured against this attempt's post-carry HEAD, which excluded
@@ -2892,6 +2921,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                         if (results.some((g) => g.gate === "test" && !g.pass))
                             testGateFailed = true;
                         if (results.every(gateSatisfied)) {
+                            // T6: every gate — the review included — is satisfied on this commit, so the failure brief
+                            // this loop is still holding describes nothing outstanding. It is dropped HERE, before the
+                            // merge, because a conflict below sends the task around the attempt loop again: a brief kept
+                            // across that retry hands the next worker findings a later review has since passed on, while
+                            // `carriedFindings` — re-derived from the journal, which retired them — is correctly empty,
+                            // leaving that dispatch's row indistinguishable from an amnesiac one. Rebuilt exactly as the
+                            // gate-fail brief is, so prior-RUN evidence (retired by its own rule, not by this reviewer)
+                            // survives and only this run's settled findings go.
+                            feedback = withCarriedEvidence("");
                             const m = await mergeSerial(taskBranch, t, gated);
                             if (m.tipMoved) {
                                 journal.append("tip-moved", t.id, m.tipMoved);
@@ -3188,9 +3226,6 @@ export async function runDaemon(repoRoot, opts = {}) {
             process.removeListener("SIGINT", onTermination);
             process.removeListener("SIGTERM", onTermination);
         }
-        // T16: every other exit — normal end, throw, termination unwind. disarm() is idempotent, so the
-        // signal path having already stood the tier down changes nothing here.
-        supervision?.disarm();
         try {
             releaseRunLock(repoRoot);
         }

package/dist/run/git.d.ts

@@ -1,3 +1,4 @@
+import { spawn } from "node:child_process";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
 export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
@@ -42,6 +43,10 @@ export interface ShResult {
     timedOut?: boolean;
     durationMs?: number;
 }
+export declare const setSpawnForTests: (fn: typeof spawn) => void;
+export declare const resetSpawnForTests: () => void;
+export declare const SPAWN_ATTEMPT_LIMIT = 4;
+export declare const SPAWN_RETRY_BACKOFF_MS = 50;
 export declare function sh(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
 export declare function shGit(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
@@ -58,6 +63,21 @@ export declare function cleanupRunWorktrees(repo: string, branch: string, opts:
     removeTaskIds: string[];
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;
+/**
+ * Preserve the bytes an existing checkout holds before recreation removes it.
+ *
+ * `git stash create` cannot do this job: its apparent `-u` argument is accepted as a message and
+ * untracked files never enter the stash object. Build the snapshot through a disposable index
+ * instead. The index starts at HEAD (so no unrelated residue from the checkout's real index enters
+ * the tree), stages the complete working tree including ordinary untracked paths, and lives outside
+ * the repository so it cannot stage itself. None of these plumbing commands writes the checkout or
+ * its real index.
+ *
+ * The returned ref is the durable recovery handle. A clean checkout returns undefined and creates
+ * neither a commit nor a ref, keeping meaningful deaths visible rather than minting one ref per
+ * ordinary dispatch.
+ */
+export declare function preserveWorktree(cwd: string): Promise<string | undefined>;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
 export declare function linkNodeModules(repo: string, dir: string, { force }?: {
     force?: boolean | undefined;

package/dist/run/git.js

@@ -1,8 +1,9 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { availableParallelism } from "node:os";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { availableParallelism, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { StringDecoder } from "node:string_decoder";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
@@ -64,6 +65,31 @@ export const runWithForkBudget = (concurrency, fn) => forkBudget.run(String(deri
 export const resolvedForkCap = () => forkBudget.getStore() ?? DEFAULT_FORK_CAP;
 /** The shipped shell ceiling: the fallback every caller gets when nothing measured a better one. */
 export const DEFAULT_SHELL_TIMEOUT_MS = 600000;
+/**
+ * OBS-688: every gate, every baseline capture and every tip verification reaches the machine through
+ * this one seam, and the seam took its spawn from the standard library directly — so the one failure
+ * it must handle, the kernel REFUSING the fork, was unreachable from a fixture and could only be
+ * described. It is injectable here for exactly that reason; production always holds `spawn` itself.
+ * Undefined-until-set, never captured at module load: the standard library binding stays read at
+ * CALL time, exactly as before this seam existed, so a suite that mocks `node:child_process` without
+ * a `spawn` export still imports this module (tests/adapters/pi-auth.test.ts does).
+ */
+let spawnChild;
+export const setSpawnForTests = (fn) => { spawnChild = fn; };
+export const resetSpawnForTests = () => { spawnChild = undefined; };
+/**
+ * A refusal is NOT evidence about the work: the command never started, so nothing ran, and a retry
+ * cannot repeat a side effect. That argument is the whole safety case for retrying here, and it
+ * holds for exactly one closed case — the kernel refused the fork for a temporary resource shortage
+ * (EAGAIN: the fork table is full, which a gate burst does to a box twice in one night). Every
+ * other spawn error is a standing fact about the machine — a missing interpreter above all — and
+ * retrying it buys nothing while delaying every genuine failure by the whole backoff, so it returns
+ * on the first read. The retry is also gated on the child having produced NO byte and never having
+ * emitted `spawn`: past either, a command has run and re-running it is a side effect, never a retry.
+ */
+const RETRYABLE_SPAWN_CODE = "EAGAIN";
+export const SPAWN_ATTEMPT_LIMIT = 4;
+export const SPAWN_RETRY_BACKOFF_MS = 50;
 // stdin "ignore": same class as HARD-05 / SubprocessDriver — never leave an open pipe a child can block on
 // (pi -p / codex exec wait for stdin EOF). timedOut distinguishes SIGKILL-timeout from a real nonzero exit.
 function shell(cmd, cwd, timeoutMs, login) {
@@ -77,19 +103,23 @@ function shell(cmd, cwd, timeoutMs, login) {
     // OBS-110: apply the run's own fork cap only when the operator has not already set one.
     if (!(FORK_CAP_ENV in env))
         env[FORK_CAP_ENV] = resolvedForkCap();
-    return new Promise((resolve) => {
+    const attempt = () => new Promise((resolve) => {
         const startedAt = Date.now();
         // detached: bash gets its own process group so a timeout can kill the whole tree —
         // SIGKILLing bash alone orphans grandchildren (codex/pi) that hold the stdio pipes
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
-        const p = spawn("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
+        const p = (spawnChild ?? spawn)("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
         let stdout = "", stderr = "";
-        let timedOut = false, done = false;
+        const stdoutDecoder = new StringDecoder("utf8");
+        const stderrDecoder = new StringDecoder("utf8");
+        let timedOut = false, done = false, started = false, outputSeen = false;
         const finish = (code, err) => {
             if (done)
                 return;
             done = true;
             clearTimeout(timer);
+            stdout += stdoutDecoder.end();
+            stderr += stderrDecoder.end();
             resolve({ code, stdout, stderr: err ?? stderr, timedOut, durationMs: Date.now() - startedAt });
         };
         const timer = setTimeout(() => {
@@ -101,14 +131,50 @@ function shell(cmd, cwd, timeoutMs, login) {
                 p.kill("SIGKILL");
             }
         }, timeoutMs);
-        p.stdout.on("data", (d) => (stdout += d));
-        p.stderr.on("data", (d) => (stderr += d));
-        p.on("error", (e) => finish(127, String(e)));
+        p.on("spawn", () => { started = true; }); // the command exists from here on — never retryable past it
+        // OBS-716: one stateful decoder per stream carries an incomplete UTF-8 sequence into that
+        // stream's next pipe chunk; decoding each chunk through string concatenation corrupts bytes at
+        // kernel-chosen boundaries. A deterministic fixture proves this decoder correct rather than
+        // proving every caller byte-safe: real chunk boundaries are the kernel's to choose, so timing
+        // still decides whether a chunk-local decoder exposes the defect in any particular run.
+        p.stdout.on("data", (d) => {
+            if (d.length > 0)
+                outputSeen = true;
+            stdout += stdoutDecoder.write(d);
+        });
+        p.stderr.on("data", (d) => {
+            if (d.length > 0)
+                outputSeen = true;
+            stderr += stderrDecoder.write(d);
+        });
+        p.on("error", (e) => {
+            if (!done && !started && !outputSeen && e.code === RETRYABLE_SPAWN_CODE) {
+                done = true;
+                clearTimeout(timer);
+                resolve({ refused: e });
+                return;
+            }
+            finish(127, String(e));
+        });
         p.on("close", (code) => finish(code ?? 1));
         // "close" waits for stdio to drain; a surviving pipe-holder must not outlive the timeout
         p.on("exit", (code) => { if (timedOut)
             finish(code ?? 1); });
     });
+    return (async () => {
+        const startedAt = Date.now();
+        for (let n = 1;; n++) {
+            const r = await attempt();
+            if (!("refused" in r))
+                return r;
+            // Bounded, and the bound is what makes a persisting shortage a REPORTED failure rather than a
+            // wedged daemon: past it the caller gets the refusal's own text under exit 127, as before.
+            if (n >= SPAWN_ATTEMPT_LIMIT) {
+                return { code: 127, stdout: "", stderr: String(r.refused), durationMs: Date.now() - startedAt };
+            }
+            await new Promise((wake) => setTimeout(wake, SPAWN_RETRY_BACKOFF_MS * n));
+        }
+    })();
 }
 export function sh(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
     return shell(cmd, cwd, timeoutMs, true);
@@ -212,6 +278,46 @@ const resolveTaskBranch = async (repo, branch) => {
     const integration = await resolveIntegrationBranch(repo, branch.slice(0, split));
     return `${integration}${branch.slice(split)}`;
 };
+/**
+ * Preserve the bytes an existing checkout holds before recreation removes it.
+ *
+ * `git stash create` cannot do this job: its apparent `-u` argument is accepted as a message and
+ * untracked files never enter the stash object. Build the snapshot through a disposable index
+ * instead. The index starts at HEAD (so no unrelated residue from the checkout's real index enters
+ * the tree), stages the complete working tree including ordinary untracked paths, and lives outside
+ * the repository so it cannot stage itself. None of these plumbing commands writes the checkout or
+ * its real index.
+ *
+ * The returned ref is the durable recovery handle. A clean checkout returns undefined and creates
+ * neither a commit nor a ref, keeping meaningful deaths visible rather than minting one ref per
+ * ordinary dispatch.
+ */
+export async function preserveWorktree(cwd) {
+    if (!existsSync(cwd))
+        return undefined;
+    const scratch = mkdtempSync(join(tmpdir(), "tickmarkr-preserve-index-"));
+    const index = join(scratch, "index");
+    const withIndex = (command) => `GIT_INDEX_FILE=${shq(index)} ${command}`;
+    try {
+        await shGitOk(withIndex("git read-tree HEAD"), cwd);
+        await shGitOk(withIndex("git add -A -- ."), cwd);
+        const tree = (await shGitOk(withIndex("git write-tree"), cwd)).trim();
+        const headTree = (await shGitOk("git rev-parse 'HEAD^{tree}'", cwd)).trim();
+        if (tree === headTree)
+            return undefined;
+        // Do not depend on consumer-level identity configuration: this is an engine recovery object,
+        // not an authored project commit. Its HEAD parent makes the preserved tree directly inspectable.
+        const identity = "GIT_AUTHOR_NAME=tickmarkr GIT_AUTHOR_EMAIL=tickmarkr@localhost "
+            + "GIT_COMMITTER_NAME=tickmarkr GIT_COMMITTER_EMAIL=tickmarkr@localhost";
+        const commit = (await shGitOk(`${identity} git commit-tree ${shq(tree)} -p HEAD -m ${shq("tickmarkr: preserve uncommitted worktree")}`, cwd)).trim();
+        const ref = `refs/tickmarkr/preserved/${commit}`;
+        await shGitOk(`git update-ref ${shq(ref)} ${shq(commit)}`, cwd);
+        return ref;
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
 export async function createWorktree(repo, branch, baseRef) {
     branch = await resolveTaskBranch(repo, branch);
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));

package/dist/run/journal.d.ts

@@ -104,6 +104,30 @@ export declare function repairsSinceApproval(events: JournalEvent[], taskId: str
  * retires the findings it settled — the uphold case re-derives its own brief separately).
  */
 export declare function journaledFailureBrief(events: JournalEvent[], taskId: string): string[];
+/**
+ * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
+ * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
+ * an operator approval settles it), and it therefore travels on EVERY dispatch until then.
+ *
+ * The two carries beside this one are attempt-scoped by construction and both lose it. The funded
+ * repair (`pendingRepairFindings`) is spent at the next `worker-launch` and is budgeted at two per
+ * engagement; `journaledFailureBrief` is reset at that same launch, so it hands the next brief only
+ * the LAST attempt's bytes. The moment one attempt fails for an unrelated reason — a red build, a
+ * refused tree, or a death that produces no verdict at all and journals no gate row whatsoever — the
+ * outstanding finding is in neither carry, and the run re-derives the task from the spec and lands on
+ * the same gap the reviewer already anchored.
+ *
+ * Retirement is closed and narrow: a review that PASSED, or the one approval that accepts the review
+ * gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"` — the operator taking the diff the
+ * reviewer rejected). Every other approval RETAINS. `--uphold` funds an attempt to FIX the findings;
+ * `--recheck` and an attempt-cap release fund another dispatch and say nothing about the reviewer's
+ * objection; a plain human-gate approval predates any review; a gate-satisfied release naming some
+ * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
+ * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
+ * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
+ * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ */
+export declare function outstandingReviewFindings(events: JournalEvent[], taskId: string): StructuredFinding[];
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export declare function pendingRepairFindings(events: JournalEvent[], taskId: string): string | undefined;
 /**

package/dist/run/journal.js

@@ -87,6 +87,13 @@ export function upheldFeedbackByTask(events) {
             && typeof e.data.details === "string") {
             lastReviewFail.set(e.taskId, e.data.details);
         }
+        else if (e.event === "gate-result" && e.data.gate === "review" && e.data.pass === true
+            && e.data.skipped !== true) {
+            // A later review pass settles the upheld finding. Retire both the active brief and the failed
+            // verdict it came from so a still-later approval cannot resurrect already-settled feedback.
+            upheld.delete(e.taskId);
+            lastReviewFail.delete(e.taskId);
+        }
         else if (e.event === "task-approved") {
             // any later approval supersedes: a plain accept-the-diff approval retires the uphold brief.
             if (e.data.release === REVIEW_UPHELD_RELEASE) {
@@ -480,6 +487,49 @@ export function journaledFailureBrief(events, taskId) {
     }
     return rows;
 }
+/**
+ * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
+ * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
+ * an operator approval settles it), and it therefore travels on EVERY dispatch until then.
+ *
+ * The two carries beside this one are attempt-scoped by construction and both lose it. The funded
+ * repair (`pendingRepairFindings`) is spent at the next `worker-launch` and is budgeted at two per
+ * engagement; `journaledFailureBrief` is reset at that same launch, so it hands the next brief only
+ * the LAST attempt's bytes. The moment one attempt fails for an unrelated reason — a red build, a
+ * refused tree, or a death that produces no verdict at all and journals no gate row whatsoever — the
+ * outstanding finding is in neither carry, and the run re-derives the task from the spec and lands on
+ * the same gap the reviewer already anchored.
+ *
+ * Retirement is closed and narrow: a review that PASSED, or the one approval that accepts the review
+ * gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"` — the operator taking the diff the
+ * reviewer rejected). Every other approval RETAINS. `--uphold` funds an attempt to FIX the findings;
+ * `--recheck` and an attempt-cap release fund another dispatch and say nothing about the reviewer's
+ * objection; a plain human-gate approval predates any review; a gate-satisfied release naming some
+ * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
+ * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
+ * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
+ * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ */
+export function outstandingReviewFindings(events, taskId) {
+    const open = new Map();
+    for (const e of events) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "task-approved") {
+            if (e.data.release === GATE_SATISFIED_RELEASE && e.data.gate === "review")
+                open.clear();
+            continue;
+        }
+        if (e.event !== "gate-result" || e.data.gate !== "review" || e.data.skipped === true)
+            continue;
+        if (e.data.pass !== false)
+            open.clear(); // a later review PASSED on this task: nothing is outstanding
+        else
+            for (const finding of findingRows(e, "review"))
+                open.set(finding.fingerprint, finding);
+    }
+    return [...open.values()];
+}
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export function pendingRepairFindings(events, taskId) {
     const e = decisionForNextDispatch(events, taskId, "repair-attempt");
@@ -1055,12 +1105,16 @@ export class Journal {
     }
     replayResumeState() {
         const m = new Map();
+        const events = this.read();
+        // Keep the legacy resume-state field aligned with the journal-authoritative prompt-time fold.
+        // In particular, a review pass after an uphold must erase the fallback daemon.ts may consult.
+        const activeUpheldFeedback = upheldFeedbackByTask(events);
         const pendingReroute = new Set(); // reroute verdicts not yet cleared by a later dispatch
         // OBS-547: what the last dispatch ADDED, so a scope-authoring event can take it back. An
         // unchargeable dispatch must replay as if it never happened — no attempt counted, no channel burned.
         const lastDispatch = new Map();
         const lastReviewFail = new Map(); // OBS-189: newest failed review details per task
-        for (const e of this.read()) {
+        for (const e of events) {
             if (!e.taskId)
                 continue;
             if (e.event === "gate-result" && e.data.gate === "review" && e.data.pass === false
@@ -1160,6 +1214,13 @@ export class Journal {
                 st.lastAssignment = undefined;
             }
         }
+        for (const [taskId, st] of m) {
+            const feedback = activeUpheldFeedback.get(taskId);
+            if (feedback)
+                st.upheldFeedback = feedback;
+            else
+                delete st.upheldFeedback;
+        }
         return m;
     }
     // OBS-130: gate satisfaction is authority, not an inferred daemon state. Only an explicit

package/dist/run/lock.d.ts

@@ -10,6 +10,7 @@ export interface Inspection {
     ino: number;
 }
 export declare function shouldRefuse(i: Pick<Inspection, "garbage" | "dead">): boolean;
+export declare function isPidLive(pid: number): boolean;
 export declare function acquireRunLock(repoRoot: string, runId: string): {
     reclaimed?: {
         pid: number;

package/dist/run/lock.js

@@ -45,6 +45,23 @@ process.once("exit", () => { if (heldPath)
 export function shouldRefuse(i) {
     return i.garbage || !i.dead;
 }
+// LOCK-04, PID-SCOPED: the same decision table, in the shape a caller holding only a pid can consume.
+// Every other liveness export here takes a repository root, so a reader with a pid off a journal row
+// had no seam to reach and wrote the four lines itself — twice. One copy was faithful; the other
+// treated ANY thrown error as death, so a daemon owned by another user (EPERM) read dead there and
+// alive here. A rule that forbids a second `process.kill(pid, 0)` without exporting a usable
+// predicate produces exactly those copies, so this is the predicate. no throw ⇒ ALIVE; ESRCH ⇒ the
+// only proof-positive death; ANY other errno (EPERM = alive-but-not-ours, EINVAL, …) ⇒ ALIVE,
+// because none of them is evidence of death and this table fails closed toward alive.
+export function isPidLive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (k) {
+        return k.code !== "ESRCH";
+    }
+}
 // statSync throws ENOENT when no lock exists — callers treat that as "not held".
 function inspect(p) {
     const st = statSync(p); // single stat: both the heartbeat mtime and the reclaim-guard inode
@@ -53,16 +70,8 @@ function inspect(p) {
     const parsed = PayloadSchema.safeParse(readPayload(p));
     const garbage = !parsed.success; // LOCK-01: its own state — shouldRefuse refuses it unconditionally; only `tickmarkr unlock` removes it
     const pid = parsed.success ? parsed.data.pid : undefined;
-    let dead = pid === undefined; // harmless fallback for the garbage row — garbage short-circuits shouldRefuse before this is read
-    if (pid !== undefined) {
-        try {
-            process.kill(pid, 0);
-            dead = false;
-        } // no throw ⇒ ALIVE
-        catch (k) {
-            dead = k.code === "ESRCH";
-        } // ESRCH ⇒ dead; EPERM ⇒ ALIVE
-    }
+    // harmless fallback for the garbage row — garbage short-circuits shouldRefuse before this is read
+    const dead = pid === undefined ? true : !isPidLive(pid);
     return { pid, runId: parsed.success ? parsed.data.runId : undefined, garbage, dead, expired, mtimeMs, ino: st.ino };
 }
 function readPayload(p) {
@@ -222,9 +231,10 @@ export async function acquireApprovalSerialization(repoRoot, runId) {
     }
 }
 // LOCK-04: the owner the decision table sees, read-only, for callers that need the pid as well as
-// the answer. inspect() owns pid-liveness (ESRCH dead / EPERM alive / garbage fail-closed); a second
-// `process.kill(pid, 0)` anywhere else would be a second copy of that rule, free to drift. undefined
-// ⇒ no lock at all — never conflate that with a lock whose recorded owner is dead.
+// the answer. inspect() owns pid-liveness (ESRCH dead / EPERM alive / garbage fail-closed) and reads
+// it from isPidLive above; a second `process.kill(pid, 0)` anywhere else would be a second copy of
+// that rule, free to drift — a caller holding only a pid consumes isPidLive, never its own probe.
+// undefined ⇒ no lock at all — never conflate that with a lock whose recorded owner is dead.
 export function runLockOwner(repoRoot) {
     let insp;
     try {

package/dist/run/supervision.d.ts

@@ -3,24 +3,30 @@ export declare const SUPERVISION_BEAT_MS = 10000;
 /** Ceiling before a beat reads STALE: SIX beats, lock.ts's ratio — five may be missed before alarm. */
 export declare const SUPERVISION_STALE_MS: number;
 export declare const SUPERVISION_FUTURE_GRACE_MS = 1000;
-export declare const SUPERVISION_TIERS: readonly ["orchestrator", "overseer", "watch"];
+export declare const SUPERVISION_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch"];
 export type SupervisionTier = (typeof SUPERVISION_TIERS)[number];
+export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context"];
+export type SeatTier = (typeof SUPERVISION_SEAT_TIERS)[number];
+/** Does this tier's record have to name the seat it speaks for? */
+export declare const isSeatTier: (tier: string) => tier is SeatTier;
 export type SupervisionState = "ABSENT" | "STALE" | "ARMED" | "UNREADABLE" | "DISARMED";
 export interface TierLiveness {
     tier: SupervisionTier;
     state: SupervisionState;
     /** Absent for ABSENT, UNREADABLE and DISARMED — no beat to age. Always present for STALE and ARMED. */
     beatAgeMs?: number;
+    /** The seat the record names, when it names one. Always present on a seat tier that is not ABSENT. */
+    seat?: string;
 }
 export declare const supervisionBeatPath: (repoRoot: string, tier: SupervisionTier) => string;
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export declare const supervisionStandDownPath: (repoRoot: string, tier: SupervisionTier) => string;
-export declare function beatSupervision(repoRoot: string, tier: SupervisionTier): void;
+export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string): void;
 /** Handle a watcher holds for as long as it is supervising; disarm stands it down and is idempotent. */
 export interface ArmedSupervision {
     disarm: () => void;
 }
-export declare function armSupervision(repoRoot: string, tier: SupervisionTier, beatMs?: number): ArmedSupervision;
+export declare function armSupervision(repoRoot: string, tier: SupervisionTier, beatMs?: number, seat?: string): ArmedSupervision;
 export declare function readTierLiveness(repoRoot: string, tier: SupervisionTier, now?: number): TierLiveness;
 export declare function supervisionStatus(repoRoot: string, tier: SupervisionTier, now?: number): TierLiveness;
 /** Every KNOWN tier, always — a tier omitted from this list would read as one that is fine. */