tickmarkr 2.1.3 → 2.1.5

package/dist/cli/commands/status.d.ts

@@ -8,6 +8,9 @@ export type StatusOpts = {
     readWorkerOutput?: (taskId: string, attempt: number, runId: string) => Promise<string | undefined>;
     webhookUrl?: string;
     postWebhook?: DecisionWebhookPost;
+    /** How often the live board rewrites its own `watch` beat. Fixtures choose it so a death drill can
+     *  watch the record STOP inside a test's patience; unset means SUPERVISION_BEAT_MS. */
+    supervisionBeatMs?: number;
 };
 export declare const GATE_KEYS: {
     readonly build: "B";

package/dist/cli/commands/status.js

@@ -12,7 +12,7 @@ import { isPidLive } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
 import { normalizeStallSnapshot } from "../../run/stall.js";
-import { readSupervision, supervisionText } from "../../run/supervision.js";
+import { armSupervision, readSupervision, supervisionText } from "../../run/supervision.js";
 import { deriveRunCockpitData, } from "../../tui/cockpit/derive.js";
 import { COCKPIT_COLUMN_FLOOR } from "../../tui/cockpit/layout.js";
 import { cellWidth, fitCells, wrapCells } from "../../tui/cockpit/width.js";
@@ -1370,6 +1370,20 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
         }
         return fresh;
     };
+    // SUP-06: the live board IS the `watch` tier, so it is the only process that can beat it — which is
+    // why that tier could only ever print ABSENT about itself while every other seat had a beater. A word
+    // one tier can only ever say in one of its five states trains every reader to skip it.
+    //
+    // Armed ONLY when UNBOUNDED. A bounded render is a READER, and the purity fence (D-02: a bounded
+    // --watch leaves .tickmarkr/ byte-identical) is exactly the test that catches a reader beating on a
+    // watcher's behalf, which would report every dead tier healthy. Armed BEFORE the first frame, so the
+    // board's own first print already names its tier armed rather than one interval later.
+    //
+    // The handle is HELD and stood down in the finally. Discarding it is not a smaller version of this —
+    // it INVERTS it: armSupervision's interval outlives the board in any host that outlives one board, so
+    // a dead board keeps writing and reads ARMED. That is the over-claiming direction, the one an operator
+    // acts on, and the one this instrument exists to close.
+    const armed = bounded ? undefined : armSupervision(cwd, "watch", opts.supervisionBeatMs);
     let titleSaved = false;
     const restoreTitle = () => {
         if (!titleSaved)
@@ -1427,6 +1441,14 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
         }
     }
     finally {
+        // Stops the interval as well as recording the hand-off: a board that returns must not leave a
+        // timer beating for it. A board that is KILLED never reaches here, its beat ages out, and the
+        // tier reads STALE — armed-then-lost, which is the truth about a killed board.
+        // Boards OVERLAP — a second pane is one keystroke away — and the stand-down marker speaks for the
+        // whole tier, so this hand-off is recorded only when no other board is still present (see
+        // armSupervision's presence files). Otherwise the first pane closed would render the second
+        // pane's own tier down while it is drawing frames.
+        armed?.disarm();
         if (titleSaved) {
             process.removeListener("exit", restoreTitle);
             restoreTitle();

package/dist/compile/collateral.d.ts

@@ -30,6 +30,22 @@ export declare function classifyScopeOffenders(taskId: string, hard: ReadonlyArr
  * Each line names the task id and at least one missing collateral test path.
  */
 export declare function collateralLints(tasks: ReadonlyArray<Pick<Task, "id" | "files">>, repoRoot: string): string[];
+/**
+ * Does every mention of `target` have an explicit, target-local READ relation?
+ *
+ * A `context:` entry grants READ authority and nothing else, so both blocking paths have to ask this
+ * before honouring one. Fail-closed by construction: every occurrence must match one of the narrow
+ * read forms below. Absence from a write-verb list is never evidence. Thus `ownedTable returns two`
+ * and the unlisted `ownedTable sorts the rows it already publishes` are refused, while an unrelated
+ * write in `the consumer adds a cache while reading ownedTable` does not revoke ownedTable's read
+ * authority. A target mentioned twice, once for reading and once ambiguously, is refused.
+ *
+ * This is intentionally a lexical representation rather than prose understanding. Keyed on NAMES:
+ * only the literal target is classified, so a dependency described conceptually stays invisible and
+ * an unfamiliar read phrasing stays refused. That closes the false-positive direction only; widen
+ * the affirmative grammar only with a control that goes red first.
+ */
+export declare function criterionReadsOnly(text: string, target: string): boolean;
 export declare function newDirectoryLints(tasks: ReadonlyArray<Pick<Task, "id" | "files">>, repoRoot: string): string[];
 /**
  * OBS-76 class: sweep src/ for out-of-scope source files that reference a symbol the acceptance
@@ -104,7 +120,7 @@ export declare function goalDensityErrors(tasks: ReadonlyArray<Pick<Task, "id" |
  * must be COMPLETE: any code path that cannot be read is its own error — the rule fails closed
  * rather than trust a partial scan.
  */
-export declare function symbolOwnershipErrors(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>, repoRoot: string): string[];
+export declare function symbolOwnershipErrors(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance"> & Partial<Pick<Task, "context">>>, repoRoot: string): string[];
 /**
  * The participation half of the config — everything the review-policy rules read. `byShape` rides
  * along because `gates.byShape.<shape>.review: false` is a second, NON-monotone participation switch:
@@ -128,6 +144,11 @@ export declare function reviewParticipationErrors(tasks: ReadonlyArray<Pick<Task
  * symbol-ownership lint and the participation config, and defaults to the invocation directory —
  * correct for the CLI/daemon, which compile from inside the target repo.
  *
+ * The read declaration (`context:`) rides on this parameter, on the task objects themselves — the
+ * aggregator never infers it from the repo, the config, or a sibling task. It is OPTIONAL: a caller
+ * whose task objects carry no `context` gets byte-identical verdicts to the ones it got before the
+ * field existed, because an absent declaration grants no authority at all.
+ *
  * KNOWN GAP (R2 review, T6/T7 scope): the compile seam in src/compile/index.ts
  * (`enforceTaskUnitContract`) does not thread `compileSource`'s `root` argument into this call, so a
  * PROGRAMMATIC compile whose target repo differs from process.cwd() resolves the wrong root and can
@@ -138,4 +159,4 @@ export declare function reviewParticipationErrors(tasks: ReadonlyArray<Pick<Task
  * critical path itself (src/gates/review.ts), so a lint this seam misses costs a late verdict rather
  * than an unreviewed one. The compile lint is the early warning; the gate is the fail-closed backstop.
  */
-export declare function taskUnitContractErrors(tasks: ReadonlyArray<Pick<Task, "id" | "goal" | "files" | "deps" | "acceptance" | "shape">>, repoRoot?: string, review?: ReviewParticipation): string[];
+export declare function taskUnitContractErrors(tasks: ReadonlyArray<Pick<Task, "id" | "goal" | "files" | "deps" | "acceptance" | "shape"> & Partial<Pick<Task, "context">>>, repoRoot?: string, review?: ReviewParticipation): string[];

package/dist/compile/collateral.js

@@ -171,15 +171,95 @@ export function collateralLints(tasks, repoRoot) {
 // v1.53 T4 (OBS-76): needles are code-shaped tokens only (camelCase / snake_case) — plain prose
 // words never match, so prose-only criteria yield zero needles instead of alarm-fatigue noise.
 // ponytail: token heuristic, not AST symbol resolution — promote after a version of precision data.
-function criteriaSymbols(acceptance) {
-    const out = new Set();
+function criteriaSymbolTexts(acceptance) {
+    const out = new Map();
     for (const item of acceptance) {
-        for (const tok of renderAcceptanceItem(item).match(/\b[A-Za-z_][A-Za-z0-9_]*\b/g) ?? []) {
-            if (tok.includes("_") || /[a-z][A-Z]/.test(tok))
-                out.add(tok);
+        const text = renderAcceptanceItem(item);
+        for (const tok of text.match(/\b[A-Za-z_][A-Za-z0-9_]*\b/g) ?? []) {
+            if (!tok.includes("_") && !/[a-z][A-Z]/.test(tok))
+                continue;
+            const texts = out.get(tok) ?? [];
+            if (!texts.includes(text))
+                texts.push(text);
+            out.set(tok, texts);
         }
     }
-    return [...out].sort();
+    return out;
+}
+function criteriaSymbols(acceptance) {
+    return [...criteriaSymbolTexts(acceptance).keys()].sort();
+}
+// These are affirmative READ relations, not a list of things that are not writes. The distinction
+// is the fail-closed boundary: an unknown predicate never earns context[] authority. A target is
+// readable when it is the object of an explicit observation (`reading ownedTable`) or the subject
+// of an explicitly pre-existing state (`ownedTable already publishes`). An unqualified declarative
+// predicate (`ownedTable returns two rows`) is deliberately absent because it can demand a change.
+const DIRECT_READ_BEFORE = /\b(?:consult|consults|consulting|inspect|inspects|inspecting|read|reads|reading|reference|references|referencing)\s+(?:(?:the|an?)\s+)?(?:(?:current|existing|unchanged)\s+)?$/i;
+const PREEXISTING_STATE_AFTER = /^\s*(?:(?:and|or)\s+\S+\s+)*(?:(?:,\s*)?which\s+)?(?:already|currently)\s+(?:carries|carry|contains?|declares?|defines?|exposes?|holds?|owns?|provides?|publish|publishes|returns?|supplies|supply|yields?)\b/i;
+const PASSIVE_READ_AFTER = /^\s+(?:is|remains)\s+(?:read|referenced|unchanged|untouched|as[- ]is)\b/i;
+// Once a target-local read has been established, a same-clause continuation can revoke it. These
+// vetoes are structural rather than an attempted exhaustive list of write verbs: an action followed
+// by `it` / `them` / `the same ...` is target-directed but ambiguous, and a coordinated passive
+// participle inherits the target as its subject. Both therefore fail closed. The scan stops at an
+// actual sentence/clause boundary; a dot inside a later path is not one.
+const TARGET_ANAPHOR_AFTER_COORDINATOR = /\b(?:and|or|then|before|after|while)\b[^,;.!?\n]{0,80}\b(?:it|them|those|the\s+same(?:\s+[A-Za-z][A-Za-z0-9_-]*)?)\b/i;
+const TARGET_PASSIVE_AFTER_SUBJECT_READ = /\b(?:and|or|then|before|after)\s+(?:then\s+)?(?:(?:is|gets?|becomes?|being)\s+)?[A-Za-z]+(?:ed|en)\b/i;
+function sameClauseAfterTarget(after) {
+    const boundary = after.search(/[;!?\n]|\.(?=\s|$)/);
+    return boundary === -1 ? after : after.slice(0, boundary);
+}
+function targetOccurrences(text, target) {
+    if (!target)
+        return [];
+    const out = [];
+    const wordAtStart = /[A-Za-z0-9_]/.test(target[0]);
+    const wordAtEnd = /[A-Za-z0-9_]/.test(target[target.length - 1]);
+    for (let at = text.indexOf(target); at !== -1; at = text.indexOf(target, at + target.length)) {
+        const before = text[at - 1];
+        const after = text[at + target.length];
+        if (wordAtStart && before !== undefined && /[A-Za-z0-9_]/.test(before))
+            continue;
+        if (wordAtEnd && after !== undefined && /[A-Za-z0-9_]/.test(after))
+            continue;
+        out.push(at);
+    }
+    return out;
+}
+/**
+ * Does every mention of `target` have an explicit, target-local READ relation?
+ *
+ * A `context:` entry grants READ authority and nothing else, so both blocking paths have to ask this
+ * before honouring one. Fail-closed by construction: every occurrence must match one of the narrow
+ * read forms below. Absence from a write-verb list is never evidence. Thus `ownedTable returns two`
+ * and the unlisted `ownedTable sorts the rows it already publishes` are refused, while an unrelated
+ * write in `the consumer adds a cache while reading ownedTable` does not revoke ownedTable's read
+ * authority. A target mentioned twice, once for reading and once ambiguously, is refused.
+ *
+ * This is intentionally a lexical representation rather than prose understanding. Keyed on NAMES:
+ * only the literal target is classified, so a dependency described conceptually stays invisible and
+ * an unfamiliar read phrasing stays refused. That closes the false-positive direction only; widen
+ * the affirmative grammar only with a control that goes red first.
+ */
+export function criterionReadsOnly(text, target) {
+    const occurrences = targetOccurrences(text, target);
+    return occurrences.length > 0 && occurrences.every((at) => {
+        // Backticks quote the target, not the relation, so discard only the adjacent delimiters.
+        const before = text.slice(Math.max(0, at - 96), at).replace(/`$/, "");
+        const after = text.slice(at + target.length).replace(/^`/, "");
+        const preexisting = PREEXISTING_STATE_AFTER.exec(after);
+        const passive = PASSIVE_READ_AFTER.exec(after);
+        if (!DIRECT_READ_BEFORE.test(before) && !preexisting && !passive)
+            return false;
+        const clause = sameClauseAfterTarget(after);
+        if (TARGET_ANAPHOR_AFTER_COORDINATOR.test(clause))
+            return false;
+        // A subject-position read (`target is read` / `target already publishes`) leaves the target as
+        // the inherited subject of a coordinated passive: `... and then rewritten by the consumer` is
+        // a change demand, not a read. Object-position reads need the anaphor veto above instead.
+        const subjectRead = preexisting ?? passive;
+        return !subjectRead
+            || !TARGET_PASSIVE_AFTER_SUBJECT_READ.test(clause.slice(subjectRead[0].length));
+    });
 }
 const ARCH_PAGES = ["docs/codebase/ARCHITECTURE.md", "docs/codebase/STRUCTURE.md"];
 function topLevelSrcDir(file) {
@@ -519,8 +599,8 @@ function walkAllCode(repoRoot) {
  */
 export function symbolOwnershipErrors(tasks, repoRoot) {
     const perTask = tasks
-        .map((t) => ({ t, symbols: criteriaSymbols(t.acceptance ?? []) }))
-        .filter((x) => x.symbols.length);
+        .map((t) => ({ t, bySymbol: criteriaSymbolTexts(t.acceptance ?? []) }))
+        .filter((x) => x.bySymbol.size);
     if (!perTask.length)
         return [];
     const { files: codeFiles, unreadable } = walkAllCode(repoRoot);
@@ -531,7 +611,7 @@ export function symbolOwnershipErrors(tasks, repoRoot) {
     for (const u of unreadable)
         errors.push(incomplete(u));
     // resolve each symbol to its definition site(s) once, shared across tasks
-    const allSymbols = [...new Set(perTask.flatMap((x) => x.symbols))];
+    const allSymbols = [...new Set(perTask.flatMap((x) => [...x.bySymbol.keys()]))];
     const res = new Map(allSymbols.map((s) => [s, definitionRe(s)]));
     const sites = new Map(allSymbols.map((s) => [s, []]));
     for (const cf of codeFiles) {
@@ -548,16 +628,46 @@ export function symbolOwnershipErrors(tasks, repoRoot) {
                 sites.get(sym).push(cf);
         }
     }
-    for (const { t, symbols } of perTask) {
+    for (const { t, bySymbol } of perTask) {
         // OBS-22: scopeGate accepts picomatch globs; ownership must agree.
         const scoped = filesGlob(t.files.map((f) => f.replace(/^\.\//, "")));
-        for (const sym of symbols) {
+        // THE RULE AT THIS SITE: a `context:`
+        // entry declares a path the worker may READ, so it answers "can the worker satisfy a criterion
+        // that only reads this symbol" (yes) and never "may the worker change it" (no — that authority
+        // comes from files[] alone). Hence the exemption is conditional on the criteria that actually
+        // name the symbol, and it is asked of the SYMBOL, not of the sentence: `criterionReadsOnly` fails
+        // closed, so a criterion demanding the symbol CHANGE — and any phrasing that does not prove it
+        // reads the symbol — is still refused, and still told to widen files[] where the change is what
+        // it asks for. An unrelated in-scope write does not change that per-symbol answer. Keyed on NAMES:
+        // only a path literally written in context[] is seen here, so a
+        // read dependency an author described in prose remains invisible to this lint. That closes the
+        // false-positive direction only — nothing here narrows what the rule refuses.
+        const declaredContext = (t.context ?? []).map((f) => f.replace(/^\.\//, ""));
+        const readable = declaredContext.length ? filesGlob(declaredContext) : () => false;
+        for (const [sym, texts] of bySymbol) {
             const defs = sites.get(sym) ?? [];
             if (defs.length !== 1)
                 continue; // unknown or ambiguous — silent by ruling
             const site = defs[0];
             if (scoped(site))
                 continue; // defined inside the task's own write surface
+            const writes = !texts.every((text) => criterionReadsOnly(text, sym));
+            if (readable(site) && !writes)
+                continue; // read authority is declared and read authority is all it needs
+            if (readable(site)) {
+                errors.push(`${t.id}: criterion identifier "${sym}" is defined only in ${site}, which is declared in `
+                    + `context[] but not in files[] — a context: entry grants READ authority only, and this `
+                    + `criterion requires changing "${sym}"; add ${site} to files[] or reword the criterion to `
+                    + `require only reading it (OBS-248).`);
+                continue;
+            }
+            if (!writes) {
+                errors.push(`${t.id}: criterion identifier "${sym}" is defined only in ${site}, which is in neither `
+                    + `files[] nor context[] — the criterion only reads "${sym}", so declare ${site} in `
+                    + `context[]; widening files[] would grant write authority this criterion never asks for `
+                    + `(OBS-248).`);
+                continue;
+            }
             errors.push(`${t.id}: criterion identifier "${sym}" is defined only in ${site}, which is not in files[] — `
                 + `add ${site} to files[] or reword the criterion; a worker scoped to files[] cannot satisfy a `
                 + `criterion whose enabling symbol lives outside it (OBS-248).`);
@@ -630,6 +740,11 @@ function activeReviewParticipation(repoRoot) {
  * symbol-ownership lint and the participation config, and defaults to the invocation directory —
  * correct for the CLI/daemon, which compile from inside the target repo.
  *
+ * The read declaration (`context:`) rides on this parameter, on the task objects themselves — the
+ * aggregator never infers it from the repo, the config, or a sibling task. It is OPTIONAL: a caller
+ * whose task objects carry no `context` gets byte-identical verdicts to the ones it got before the
+ * field existed, because an absent declaration grants no authority at all.
+ *
  * KNOWN GAP (R2 review, T6/T7 scope): the compile seam in src/compile/index.ts
  * (`enforceTaskUnitContract`) does not thread `compileSource`'s `root` argument into this call, so a
  * PROGRAMMATIC compile whose target repo differs from process.cwd() resolves the wrong root and can

package/dist/compile/gsd.js

@@ -106,6 +106,22 @@ function extractWriteDirectives(body, storedPath) {
     return writes;
 }
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function summaryCompletionStatus(planFile) {
+    const summaryFile = join(dirname(planFile), `${basename(planFile).replace(/-PLAN\.md$/, "")}-SUMMARY.md`);
+    if (!existsSync(summaryFile))
+        return undefined;
+    try {
+        const content = readFileSync(summaryFile, "utf8");
+        const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
+        if (!fmMatch)
+            return undefined;
+        const fm = parseYaml(fmMatch[1]);
+        return isPlainObject(fm) ? fm.status : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 // schema-legal, branch-safe id segment: dots etc. → dashes; no "--" runs (task-branch separator)
 // or trailing dash — the id schema rejects both
 const sanitize = (s) => s
@@ -170,7 +186,11 @@ function compileOne(file, storedPath) {
         .filter((p) => !p.includes("$") && !p.startsWith("~") && !p.startsWith("/") && !p.split("/").includes(".."));
     const taskCount = [...body.matchAll(/<task[\s>]/g)].length;
     const humanGate = fm.autonomous === false || /<task type="checkpoint:/.test(body);
-    const done = existsSync(join(dirname(file), `${basename(file).replace(/-PLAN\.md$/, "")}-SUMMARY.md`));
+    const summaryStatus = summaryCompletionStatus(file);
+    // GSD source rule (`/gsd:quick status`): a SUMMARY is complete only when its frontmatter says
+    // `status: complete`; when `status` is absent it reports `INCOMPLETE`. The compiler must preserve
+    // that distinction because an artifact can record a reviewed failure rather than completion.
+    const done = summaryStatus === "complete";
     const files = strings(fm.files_modified).map((f) => f.replace(/^\.\//, ""));
     assertWriteScope(file, `P${key}`, files, extractWriteDirectives(body, storedPath));
     // fail closed (D-03): a silently dropped floor/pin routes the task cheap instead of erroring

package/dist/compile/native.js

@@ -4,6 +4,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import picomatch from "picomatch";
 import { GATE_NAMES, GRAPH_ROUTING_MODES, ORACLES, renderAcceptanceItem, SHAPES, TIERS, validateGraph, } from "../graph/schema.js";
+import { criterionReadsOnly } from "./collateral.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
 // OBS-170/OBS-184: `context:` is a promise to the worker, and nothing ever checked it could be kept.
 // Workers run in `git worktree add <baseRef>` (run/git.ts:169-176), which materialises the base
@@ -169,20 +170,51 @@ function renderedObservables(text) {
 function criterionScopeFinding(task, text, criterion, id, tests) {
     if (task.files.length === 0)
         return undefined; // empty files[] is deliberately unrestricted
-    const inScope = filesGlob(task.files.map((entry) => entry.replace(/^\.\//, ""))); // Q120s shared matcher
+    const strip = (entry) => entry.replace(/^\.\//, ""); // Q120s shared matcher below
+    const inFiles = filesGlob(task.files.map(strip));
+    const context = (task.context ?? []).map(strip);
+    const inContext = context.length ? filesGlob(context) : () => false;
+    // THE RULE AT THIS SITE: `files:` clears a named path outright, because it is write authority and
+    // write authority covers reading too. `context:` clears one ONLY for a criterion that reads it and
+    // does not change it — a read declaration is not a second write surface, and unioning it in unconditionally
+    // would promote read authority to write authority for exactly the criterion that asks for the
+    // change. The question is asked per PATH — each occurrence of each declared path must carry its own
+    // affirmative read relation. A write elsewhere in the criterion therefore cannot revoke a named
+    // dependency's read exemption, and a read elsewhere cannot confer one on a path being changed. It
+    // is the same target-specific question the symbol-ownership rule asks (collateral.ts), and it fails
+    // closed: any phrasing that does not prove the criterion reads the path is refused, as it was before
+    // this check consulted the declaration at all. Keyed on NAMES: only a path literally written in files[]
+    // or context[] is matched, so a dependency the author described conceptually and never wrote out
+    // stays invisible to this check. That closes the false-positive direction only — a path in neither
+    // declaration is refused exactly as before.
+    const declared = (path) => inFiles(path) || (inContext(path) && criterionReadsOnly(text, path));
     const named = namedCriterionPaths(text, tests);
     const { exact, denominators } = renderedObservables(text);
     const asserting = tests.filter((test) => exact.some((token) => test.text.includes(token))
         || denominators.some((denominator) => new RegExp(`(?:^|\\D)\\d+/${denominator}(?:\\D|$)`).test(test.text))).map((test) => test.path);
-    const missing = [...new Set([...named, ...asserting])].filter((path) => !inScope(path));
+    const missing = [...new Set([...named, ...asserting])].filter((path) => !declared(path));
     if (missing.length === 0)
         return undefined;
+    // The remedy names the authority the criterion actually needs. A criterion that only READS the
+    // producer is repaired by context[]; instructing its author to widen files[] is the product
+    // emitting the unsafe workaround itself. Only a criterion that requires CHANGING the producer is
+    // told to widen the write surface.
+    const readMissing = missing.filter((path) => criterionReadsOnly(text, path));
+    const writeMissing = missing.filter((path) => !criterionReadsOnly(text, path));
+    const remedy = [
+        readMissing.length === 0 ? "" : `the criterion only reads ${readMissing.length === 1 ? "it" : "them"} `
+            + `(${readMissing.join(", ")}), so add ${readMissing.length === 1 ? "it" : "them"} to context[] — `
+            + `files[] would grant write authority this criterion never asks for`,
+        writeMissing.length === 0 ? "" : `the criterion requires changing ${writeMissing.length === 1 ? "it" : "them"} `
+            + `(or does not establish a read-only relation) (${writeMissing.join(", ")}), so add `
+            + `${writeMissing.length === 1 ? "it" : "them"} to files[]`,
+    ].filter(Boolean).join("; ");
     return {
         code: "criterion-scope",
         fixtureId: id,
         taskId: task.id,
         criterion,
-        detail: `criterion names asserting file${missing.length === 1 ? "" : "s"} outside expanded files[]: ${missing.join(", ")}`,
+        detail: `criterion names asserting file${missing.length === 1 ? "" : "s"} outside expanded files[] and context[]: ${missing.join(", ")} — ${remedy}`,
     };
 }
 function exportedIdentifier(root, files, identifier) {

package/dist/gates/baseline.d.ts

@@ -1,7 +1,20 @@
 import type { TickmarkrConfig } from "../config/config.js";
 import type { AcceptanceItem } from "../graph/schema.js";
-import { type ShResult } from "../run/git.js";
+import { type RunCapacity, type ShResult } from "../run/git.js";
 import type { GateResult } from "./types.js";
+/**
+ * T7: the capacity a gate's own command ran under rides the RESULT, beside the verdict it explains,
+ * rather than inside `meta` — `meta` is a machine-readable extras bag several callers compare
+ * wholesale, and identity that a later session keys reuse on does not belong in a bag. Declared here,
+ * at the one producer, because only a battery gate has a command whose child received a fork cap:
+ * every other gate leaves the field absent, which is the honest reading of "this gate divided
+ * nothing". The daemon lifts it verbatim onto the journal's gate row (src/run/daemon.ts).
+ */
+declare module "./types.js" {
+    interface GateResult {
+        capacity?: RunCapacity;
+    }
+}
 export interface BaselineCommand {
     /**
      * Absent when the capture returned no verdict — see `infra`. A pre-v1.90 baseline can also lack it
@@ -21,8 +34,15 @@ export interface BaselineCommand {
     /** The ceiling that measurement implies, persisted so every later battery uses the same number. */
     ceilingMs?: number;
     /**
-     * OBS-534 (T2): the capture was SIGKILLed at its ceiling. It never finished asking the question, so
-     * the entry carries a CAUSE and no verdict: no exit code, no fingerprints, nothing forgivable.
+     * T7: the capacity this command's capture child ran under — the fork cap it received and the cores
+     * that cap was divided from. Absent in every pre-T7 baseline, which is exactly what makes those
+     * entries keep their current forgiveness; a MALFORMED one fails closed instead (git.ts readCapacity).
+     */
+    capacity?: RunCapacity;
+    /**
+     * The capture did not return a trustworthy verdict: it was SIGKILLed at its ceiling, or its output
+     * proves the machine was exhausted while it ran. The entry therefore carries a CAUSE and no
+     * verdict: no exit code, no fingerprints, nothing forgivable.
      */
     infra?: true;
 }

package/dist/gates/baseline.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { DEFAULT_SHELL_TIMEOUT_MS, sh } from "../run/git.js";
+import { DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 // incident #2 (run-20260709-104447): a vitest ✓ PASS line with "error" in the test NAME, wrapped in ANSI
 // codes that varied between baseline and worktree runs, was reported as a "new failure". Strip ANSI first;
 // a pass-marker line is never a failure. [\d;#] covers raw ANSI and digit-normalized ANSI ("\x1b[#m") from
@@ -118,6 +118,10 @@ const VOCAB_RE = /\b(?:error|fail(?:ed|ure|ing)?)\b/i;
 // this runner-output classifier rather than applied to any judge-authored reason text. A real test
 // failure still dominates below because one regression-shaped line makes the whole output regression.
 const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable|Token not found in system keyring|Process from config\.webServer was not able to start/i;
+// Capture invalidation is deliberately narrower than the gate's infrastructure vocabulary above:
+// keyring/config-webServer startup failures remain gate concerns, while this policy is specifically
+// for evidence that the capture ran while the machine was resource-starved.
+const CAPTURE_EXHAUSTION_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable/i;
 // A named error CLASS ("AssertionError", "TypeError", "MyDomainError") — never bare "Error", which
 // is what an errno report itself is headed with (`Error: spawn EAGAIN`). The prefix is required.
 const ERROR_CLASS_RE = /\b[A-Za-z][A-Za-z0-9]*Error\b/;
@@ -133,6 +137,18 @@ export function classifyFailureOutput(output) {
         return "regression";
     return lines.some(isInfraLine) ? "infra" : undefined;
 }
+/**
+ * Capture validity asks a different question from gate classification. At a gate, one genuine
+ * regression line must outrank adjacent errno evidence so a real defect is never laundered as infra.
+ * At capture, any such evidence invalidates the whole measurement: once the machine was exhausted,
+ * no failure in that incomplete environment can safely become pre-existing forgiveness. Keep this
+ * separate from `classifyFailureOutput` so changing capture policy cannot move gate verdicts.
+ */
+const captureHasInvalidatingInfra = (output) => output
+    .split("\n")
+    .map((l) => l.replace(ANSI_RE, ""))
+    .filter((l) => !PASS_LINE_RE.test(l))
+    .some((l) => CAPTURE_EXHAUSTION_RE.test(l));
 const normalizeLine = (l) => l.replace(/\d+/g, "#").replace(/\s+/g, " ").trim();
 // Vitest's default reporter names file durations as
 // `✓ |project| tests/example.test.ts (12 tests) 1.23s` (❯ for a red file). The runner may be
@@ -370,6 +386,15 @@ export function ceilingKillResult(gate, r, ceilingMs) {
  * shell asks it to finish faster than the thing it is measuring.
  */
 export const CAPTURE_CEILING_MS = 1_800_000;
+const invalidCaptureEntry = (durationMs) => ({
+    infra: true,
+    fingerprints: [],
+    durationMs,
+    fileDurationSumMs: null,
+    impliedParallelism: null,
+    longestFile: null,
+    ceilingMs: effectiveCeilingMs({ durationMs }),
+});
 export async function captureBaseline(cwd, commands) {
     const base = { commands: {} };
     for (const [name, cmd] of Object.entries(commands)) {
@@ -396,18 +421,22 @@ export async function captureBaseline(cwd, commands) {
             console.error(`tickmarkr: baseline capture for "${name}" was killed at its ${CAPTURE_CEILING_MS}ms ceiling — `
                 + `it recorded NO fingerprints, so nothing is forgiven and every gate will treat a pre-existing `
                 + `failure as a fresh one. Raise the ceiling or shorten the command.`);
-            base.commands[name] = {
-                infra: true,
-                fingerprints: [],
-                durationMs,
-                fileDurationSumMs: null,
-                impliedParallelism: null,
-                longestFile: null,
-                ceilingMs: effectiveCeilingMs({ durationMs }),
-            };
+            base.commands[name] = invalidCaptureEntry(durationMs);
             continue;
         }
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
+        // Run 2137: the child exited and printed ordinary FAIL/AssertionError lines, so the gate-side
+        // discriminator correctly called the mixed output a regression. But the same output also said
+        // `spawn EAGAIN`: the machine had run out of processes while the pristine-tree measurement was
+        // being taken. A capture cannot know which red lines predated that shortage and which it caused,
+        // so none may become a fingerprint every later task gets to forgive.
+        if (captureHasInvalidatingInfra(raw)) {
+            console.error(`tickmarkr: baseline capture for "${name}" completed with process/resource-exhaustion evidence — `
+                + `it recorded NO exit-code verdict and NO fingerprints, so nothing is forgiven for this command; `
+                + `the measurement cannot distinguish a pre-existing failure from one caused by exhaustion.`);
+            base.commands[name] = invalidCaptureEntry(durationMs);
+            continue;
+        }
         base.commands[name] = {
             exitCode: r.code,
             // a command that exits 0 has no failures to fingerprint — recording any would be a lie the
@@ -417,6 +446,9 @@ export async function captureBaseline(cwd, commands) {
             durationMs,
             ...fileTiming(raw, durationMs),
             ceilingMs: effectiveCeilingMs({ durationMs }),
+            // T7: the world this measurement was taken in, so a later reader can ask whether its own world
+            // is the same one. Recorded from THIS command's own shell result, never re-derived here.
+            ...(r.capacity ? { capacity: r.capacity } : {}),
         };
     }
     const names = Object.keys(commands);
@@ -487,17 +519,28 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         const entry = baseline.commands[name];
         const ceilingMs = effectiveCeilingMs(entry);
         const r = await sh(cmd, cwd, ceilingMs);
+        // T7: every verdict below carries the capacity ITS OWN command ran under, taken off the shell
+        // result rather than re-derived after the fact. The skip row above ran no command and therefore
+        // states no capacity — a row that never divided the machine must not claim that it did.
+        const record = (g) => {
+            results.push(r.capacity ? { ...g, capacity: r.capacity } : g);
+        };
+        // …and whether the entry that would forgive this command was measured in the same world. A
+        // baseline captured under a different fork cap forgives nothing: its fingerprints describe a
+        // machine divided by a different number. Absent capacity (every pre-T7 baseline) still forgives
+        // exactly as it does today; a malformed one fails closed (git.ts sameCapacity).
+        const comparable = sameCapacity(entry?.capacity, r.capacity);
         // Q24: the kill is read BEFORE the exit code is interpreted at all. A SIGKILLed battery has
         // whatever partial output it had flushed — typically no failure shape — so every path below
         // would otherwise turn a timeout into a claim about the work: "no recognizable failure lines"
         // when the baseline was green, or a forgiven pre-existing red when it was not. Neither is true.
         const killed = ceilingKillResult(name, r, ceilingMs);
         if (killed) {
-            results.push(killed);
+            record(killed);
             continue;
         }
         if (r.code === 0) {
-            results.push({ gate: name, pass: true, details: "exit 0" });
+            record({ gate: name, pass: true, details: "exit 0" });
             continue;
         }
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
@@ -508,7 +551,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // exactly where it belongs: on failures the runner actually reported and the baseline already had.
         const classification = classifyFailureOutput(raw);
         if (classification === "infra") {
-            results.push({
+            record({
                 gate: name,
                 pass: false,
                 details: `exit ${r.code} on infrastructure alone — the runner never completed a suite, so this gate verified nothing:\n${unrecognizedEvidence(raw) || raw.trim().split("\n").slice(0, 10).join("\n")}`,
@@ -534,7 +577,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
                 ? `the baseline capture for this command was killed at its ceiling and recorded no verdict, so nothing here is forgivable — it now exits ${r.code} with no recognizable failure lines — failing closed`
                 : `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`;
             const evidence = unrecognizedEvidence(raw);
-            results.push({
+            record({
                 gate: name,
                 pass: false,
                 details: evidence ? `${closed}\nunrecognized output:\n${evidence}` : closed,
@@ -545,10 +588,26 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         if (failing.length) {
             const headlined = headlineDetails(raw, failing);
             const meta = { ...headlined.meta, ...(classification ? { classification } : {}) };
-            results.push({ gate: name, pass: false, details: headlined.details, ...(Object.keys(meta).length ? { meta } : {}) });
+            record({ gate: name, pass: false, details: headlined.details, ...(Object.keys(meta).length ? { meta } : {}) });
+            continue;
+        }
+        // T7: everything below this line is forgiveness, and forgiveness is the one verdict that reads a
+        // record from another session. The failures are all baseline-recorded — but recorded under a
+        // capacity this command did not run under, so they are not evidence that these failures
+        // pre-existed the diff. A red does not become a green on fingerprints from a world it was not
+        // measured in; the operator gets both worlds named.
+        if (!comparable) {
+            record({
+                gate: name,
+                pass: false,
+                details: `exit ${r.code}; every failure is recorded in the baseline, but that capture ran under `
+                    + `${describeCapacity(entry?.capacity)} and this command ran under ${describeCapacity(r.capacity)} — `
+                    + `forgiveness across a changed capacity is not evidence, so this fails closed`,
+                meta: { capacityMismatch: true, ...(classification ? { classification } : {}) },
+            });
             continue;
         }
-        results.push({
+        record({
             gate: name,
             pass: true,
             details: `exit ${r.code} but only pre-existing failures (forgiven)${unreadable ? " — no failure shape recognized in this output, so a new failure from this runner is invisible to the baseline gate" : ""}`,

package/dist/gates/llm.d.ts

@@ -25,6 +25,7 @@ export interface LlmVia {
     label?: string;
     keep?: boolean;
     onSlot?: (slot: Slot) => void;
+    onInactivity?: () => void;
 }
 export interface GateVia {
     driver: ExecutorDriver;

package/dist/gates/llm.js

@@ -226,6 +226,7 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
                 const snapshotQuietFor = now - quietSince;
                 if (cpuFlatFor >= harvestCpuFlatWindowMs(cpu.resolutionMs)
                     && snapshotQuietFor >= gateInactivityWindowMs) {
+                    via.onInactivity?.();
                     break;
                 }
             }