tickmarkr 2.1.3 → 2.1.5

package/dist/gates/review.d.ts

@@ -1,5 +1,5 @@
 import { type Assignment, type BillingChannel, type WorkerAdapter } from "../adapters/types.js";
-import { type TickmarkrConfig } from "../config/config.js";
+import { type TickmarkrConfig, type Tier } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
@@ -49,6 +49,13 @@ export declare function isDiffCapPark(result: GateResult): boolean;
 export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
-prefer?: string[]): BillingChannel | null;
+prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
+floor?: Tier): BillingChannel | null;
 export type ReviewUnparseableCause = VerdictUnparseableCause;
+/**
+ * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
+ * remains a separate stated input, so whether its touched paths fit the declaration stays a reviewer
+ * judgement rather than a guarantee made by this renderer.
+ */
+export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
 export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string): Promise<GateResult>;

package/dist/gates/review.js

@@ -170,7 +170,8 @@ function reviewPreferIndex(c, prefer) {
     return i === -1 ? prefer.length : i;
 }
 export function pickReviewer(author, channels, exclude = [], // v1.1 failover: reviewer channels that already produced garbage for this task
-prefer = []) {
+prefer = [], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
+floor) {
     // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
     // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
     // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
@@ -182,9 +183,25 @@ prefer = []) {
         // two independent axes: different vendor AND different base-model identity (ADDED TO the vendor
         // rule, never replacing it — a future edit can't silently drop either). The diversity filter runs
         // BEFORE preference ranking: prefer sorts survivors only, so no entry can resurrect an excluded channel.
-        .filter((c) => c.vendor !== authorChannel.vendor && modelId(c.model) !== modelId(author.model) && !exclude.includes(channelKey(c)))
+        .filter((c) => c.vendor !== authorChannel.vendor
+        && modelId(c.model) !== modelId(author.model)
+        && !exclude.includes(channelKey(c))
+        && (floor === undefined || TIER_RANK[c.tier] >= TIER_RANK[floor]))
         .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
 }
+/**
+ * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
+ * remains a separate stated input, so whether its touched paths fit the declaration stays a reviewer
+ * judgement rather than a guarantee made by this renderer.
+ */
+export function renderDeclaredWriteScope(files) {
+    if (files.length === 0) {
+        return "## Declared write scope\nUnrestricted: this task declared no write-scope patterns.";
+    }
+    return `## Declared write scope
+The task DECLARED these write-scope patterns:
+${files.map((path) => `- ${path}`).join("\n")}`;
+}
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers, 
 // OBS-196: run dir for raw-output persistence on an unparseable verdict; absent (older callers,
 // direct tests) skips persistence and changes nothing else.
@@ -257,13 +274,19 @@ artifactDir) {
         policy: "full",
         ...(promotedBy ? { promotedFrom: declaredPolicy, promotedBy } : {}),
     };
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? []);
+    // A reviewer floor is opt-in at the task. Applying cfg.routing.floors here would change the
+    // historical seat for every task that never asked for review-tier coupling.
+    const reviewerFloor = task.routingHints?.floor;
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor);
     if (!reviewer) {
         // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
         // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
+        const reason = reviewerFloor
+            ? `no cross-vendor reviewer available at or above task-declared ${reviewerFloor} floor (diversity rule)`
+            : "no cross-vendor reviewer available (diversity rule)";
         return cfg.review.required
-            ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive", meta: { noEligibleReviewer: true } }
-            : { gate: "review", pass: true, details: "WARNING: no cross-vendor reviewer available — review waived by config", meta: { noEligibleReviewer: true } };
+            ? { gate: "review", pass: false, details: `${reason}; set review.required:false to waive`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } }
+            : { gate: "review", pass: true, details: `WARNING: ${reason} — review waived by config`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } };
     }
     const measuredDiff = await fetchTaskDiff(worktree, baseRef);
     // Keep the reader payload identical to the text charged to the strict cap:
@@ -284,6 +307,8 @@ ${COMPLETION_FAKING_CHECKLIST}
 ## Acceptance criteria
 ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}
 
+${renderDeclaredWriteScope(task.files)}
+
 ## Diff
 \`\`\`diff
 ${diff}
@@ -301,7 +326,15 @@ Respond with ONLY this JSON:
 Approve iff no material finding remains; an empty findings list is a clean approval.
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
-    const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? { driver: via.driver, keep: via.keep, onSlot: via.onSlot, name: via.nameFor("review", reviewer.adapter), label: via.labelFor("review") } : undefined, 
+    let concludedOnInactivity = false;
+    const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? {
+        driver: via.driver,
+        keep: via.keep,
+        onSlot: via.onSlot,
+        name: via.nameFor("review", reviewer.adapter),
+        label: via.labelFor("review"),
+        onInactivity: () => { concludedOnInactivity = true; },
+    } : undefined, 
     // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
     // output until completion — runLlm's 300s default killed reviews mid-flight, returning empty
     // stdout that read as "unparseable" and escalated to re-implementation of green code
@@ -325,14 +358,22 @@ The top-level comments array is optional. Use it only for actionable line-anchor
                 saved = undefined; // persistence is evidence, not a gate input — never fail the gate on it
             }
         }
-        const failure = cause === "malformed-verdict"
-            ? "review output unparseable"
-            : "review dispatch failed — no structurally valid nonce-bound response; output unparseable";
+        const failure = concludedOnInactivity
+            ? "review dispatch concluded on the inactivity policy without a structurally valid nonce-bound response; output unparseable"
+            : cause === "malformed-verdict"
+                ? "review output unparseable"
+                : "review dispatch failed — no structurally valid nonce-bound response; output unparseable";
         return {
             gate: "review",
             pass: false,
             details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; cause: ${cause}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
-            meta: { ...policyMeta, reviewer: channelKey(reviewer), unparseable: true, cause },
+            meta: {
+                ...policyMeta,
+                reviewer: channelKey(reviewer),
+                unparseable: true,
+                cause,
+                ...(concludedOnInactivity ? { classification: "infra", infra: true } : {}),
+            },
         };
     }
     const decided = findings !== null

package/dist/gates/run-gates.js

@@ -589,7 +589,18 @@ export async function runGates(task, ctx) {
             const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, [...(ctx.excludeReviewers ?? []), flaked], ctx.artifactDir));
             if (second.meta?.noEligibleReviewer !== true) {
                 const retried = typeof second.meta?.reviewer === "string" ? second.meta.reviewer : "none";
-                rv = { ...second, meta: { ...second.meta, reviewRetry: { flaked, retried } } };
+                rv = {
+                    ...second,
+                    // `details` is lifted onto the journal's gate-result row; meta.reviewRetry is not. Keep the
+                    // re-route visible in the result text a reader actually opens, including on a red retry.
+                    details: `review re-route: ${flaked} produced no parseable verdict; replaced by ${retried}\n${second.details}`,
+                    meta: { ...second.meta, reviewRetry: { flaked, retried } },
+                };
+            }
+            else if (task.routingHints?.floor) {
+                // Preserve the original no-answer cause when no replacement exists, but name the declared
+                // floor that correctly refused a lower-tier fallback.
+                rv = { ...rv, details: `${rv.details}\nreview re-route refused: ${second.details}` };
             }
         }
         return invocations.length ? { ...rv, meta: { ...rv.meta, invocations } } : rv;

package/dist/run/daemon.d.ts

@@ -18,7 +18,6 @@ export interface RunOptions {
     mode?: RoutingMode;
     narrate?: (event: JournalEvent) => void;
     exit?: (code: number) => void;
-    supervise?: boolean;
 }
 export type ModeSource = "run flag" | "spec" | "repo config" | "global config" | "default";
 export interface ResolvedRunMode {

package/dist/run/daemon.js

@@ -19,16 +19,15 @@ import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHa
 import { GATE_NAMES } from "../graph/schema.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { runEnvironment } from "./environment.js";
-import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, runWithForkBudget, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, sameCapacity, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingReviewFindings, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, renderStructuredReviewFinding, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
 import { nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
 import { harvestCpuFlatWindowMs, NUDGEABLE_ADAPTERS, PANE_READ_ROWS, StallProgressTracker, stallSnapshotBannerRows, WorkerTreeCpuAccountant, } from "./stall.js";
-import { armSupervision } from "./supervision.js";
 // Compatibility exports for the daemon liveness tests and existing consumers. The implementation
 // lives in stall.ts so gate dispatch can depend on it without importing the daemon.
 export { harvestCpuFlatWindowMs, resetHarvestCpuFlatMsForTests, setHarvestCpuFlatMsForTests, workerTreeCpuMs, } from "./stall.js";
@@ -243,6 +242,10 @@ function repairBrief(findings, diff, baseRef) {
 // v1.70 T5: default request-changes rounds a task may draw before it parks. OBS-419 keeps this as the
 // no-ceiling behavior; an operator may narrow only the next engagement on the approval that releases it.
 const REVIEW_ROUND_CAP = 2;
+// T2: one heading per fact. The first is owed a passing review; the second already drew one and was
+// accepted with the reviewer's own rationale, which travels beside (but never changes) its identity.
+const OUTSTANDING_FINDINGS_HEADING = "## Outstanding review findings — a review has NOT passed on these yet";
+const DEFERRED_FINDINGS_HEADING = "## Deferred review findings — a reviewer ACCEPTED these with a rationale and did NOT block on them; do not re-litigate, fix only if your change touches them";
 // OBS-419: the newest approval starts the current engagement, so it is also the sole authority for
 // that engagement's optional ceiling. Stop at the newest approval even when the field is absent: a
 // later ordinary release restores the module default instead of inheriting an older operator limit.
@@ -393,7 +396,7 @@ function lastVerifyCycle(events) {
         if (e.event === "tip-verify-start") {
             const { tip, cmdHash } = e.data;
             cur = typeof tip === "string" && typeof cmdHash === "string"
-                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false }
+                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity] }
                 : undefined;
             afterRunEnd = false;
             continue;
@@ -411,9 +414,14 @@ function lastVerifyCycle(events) {
             continue;
         }
         if (!cur || afterRunEnd || cur.tip !== tip || cur.cmdHash !== cmdHash) {
-            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false };
+            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [] };
         }
         afterRunEnd = false;
+        // T7: EVERY verdict row's own capacity, not just the start row's. The start row is a statement of
+        // intent written before a single command ran; the green this cache would carry forward lives on
+        // these rows, so a row whose capacity differs from the session's — or which is malformed — has to
+        // be able to sink the cycle by itself.
+        cur.capacities.push(e.data.capacity);
         if (e.event === "tip-verify-failed")
             cur.failed = true;
         else {
@@ -441,23 +449,31 @@ function lastVerifyCycle(events) {
 export async function verifyIntegrationTipCached(intWt, commands, journal, opts = {}) {
     const cmdHash = commandsHash(commands);
     const tip = await gitHead(intWt);
+    // T7: the capacity this session's verify children WOULD run under — the third thing a carried
+    // green must match, beside the tip and the command set. A cached verdict is the one place a green
+    // crosses a session boundary with nothing re-run, and a session resumed at a different concurrency
+    // divides the machine by a different number: that green was established in another world, so it is
+    // not carried forward and the commands run again. A pre-T7 cycle records no capacity and keeps
+    // exactly the behaviour it has today.
+    const capacity = resolvedCapacity();
     const porcelain = await shGit("git status --porcelain", intWt);
     const clean = porcelain.code === 0 && porcelain.stdout.trim() === "";
     const last = lastVerifyCycle(journal.read());
     const cached = last !== undefined && !last.failed && !last.forgiven && last.tip === tip && last.cmdHash === cmdHash
-        && Object.keys(commands).every((g) => last.gates.has(g));
+        && Object.keys(commands).every((g) => last.gates.has(g))
+        && last.capacities.every((recorded) => sameCapacity(recorded, capacity));
     // A pair can be verified red and then green without either SHA or command hash changing (for
     // example, an external service or ignored fixture recovers). Delimit attempts explicitly so that
     // the earlier red cannot remain latched into the later complete green cycle.
-    journal.append("tip-verify-start", undefined, { tip, cmdHash, gates: Object.keys(commands), cached: clean && cached });
+    journal.append("tip-verify-start", undefined, { tip, cmdHash, capacity, gates: Object.keys(commands), cached: clean && cached });
     if (clean && cached) {
-        journal.append("tip-verify-cached", undefined, { tip, cmdHash, gates: Object.keys(commands) });
+        journal.append("tip-verify-cached", undefined, { tip, cmdHash, capacity, gates: Object.keys(commands) });
         // The skip must not read as a red. Every surface derives the tip's verdict from this cycle's
         // `tip-verify` events (cockpit derive.ts tipVerificationPassed: a run-end claiming "passed" with
         // ZERO events is fail-closed to FALSE), so a carried-forward green still journals its per-gate
         // pass — `cached: true` keeps it honest about not having re-run the command.
         for (const gate of Object.keys(commands)) {
-            journal.append("tip-verify", undefined, { gate, cmd: commands[gate], pass: true, exitCode: 0, cached: true, tip, cmdHash });
+            journal.append("tip-verify", undefined, { gate, cmd: commands[gate], pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
         }
         return false;
     }
@@ -465,7 +481,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
     for (const r of await verifyIntegrationTip(intWt, commands, journal.dir, opts.baseline)) {
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash });
+            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
@@ -477,6 +493,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
                 lastMergedTask: opts.lastMergedTask,
                 tip,
                 cmdHash,
+                capacity,
             });
             tipFailed = true;
         }
@@ -721,13 +738,9 @@ export async function runDaemon(repoRoot, opts = {}) {
     // subprocess, so the optional-chain open below is a no-op there). Cosmetic-only: any failure is
     // swallowed (never affects the run); the operator closes a surviving watch pane.
     const lock = acquireRunLock(repoRoot, runId);
-    // T16: the orchestrator seat IS this daemon, so this is where the tier gets armed — the writer half
-    // T3 shipped had no caller outside its own tests, which made the reader honest and useless: it read
-    // ABSENT for the entire life of every run. Armed immediately after the lock (the first instant this
-    // process owns the run) and held to the last, so the beat's span is the run's span. armSupervision
-    // never throws, so an unwritable beat can never take a run down; it is deregistered in BOTH exits
-    // below, because the signal reaper exits the process before the finally can run.
-    const supervision = opts.supervise === false ? undefined : armSupervision(repoRoot, "orchestrator");
+    // D10: the lock is this daemon's liveness record and already carries its pid; status prints that
+    // identity beside the supervision row. The `orchestrator` tier belongs exclusively to the seated
+    // supervisor, so a run never beats or stands down that seat's record on the daemon's behalf.
     // v1.54 T2: declared before the try so the finally can always deregister (a throw before
     // registration leaves it undefined — the guard below covers that path).
     let onTermination;
@@ -855,7 +868,6 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                             catch { /* cosmetic — visibility is never a gate */ }
                         }
-                        supervision?.disarm(); // T16: same reason as the lock — this seat stood down, it did not die
                         releaseRunLock(repoRoot); // the process dies at exit() below — the finally never runs on this path
                     }
                     abortRun(new Error(`terminated by ${sig}`));
@@ -904,6 +916,10 @@ export async function runDaemon(repoRoot, opts = {}) {
             const replayedGateResults = resumeLifecycleOpen
                 ? journal.replayCurrentAttemptGateResults()
                 : new Map();
+            // T7: the capacity THIS session resolved — read inside the run's fork budget, so it is the number
+            // every shell this run spawns will divide the machine by. Recorded evidence from another session
+            // is only reusable against this.
+            const sessionCapacity = resolvedCapacity();
             const replayedExclusions = opts.resume ? journal.replayExcludedChannels() : new Set();
             if (opts.resume) {
                 // v1.53 T5: a superseded run is dead — resuming it beside its successor is the exact
@@ -1145,6 +1161,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     await park(t, `humanGate: "${t.title}" requires approval before dispatch`, "human-gate", null, 0, startMs);
                     return;
                 }
+                // The driver owns how a checkout is created, but runDaemon owns the destructive transition:
+                // every task-checkout recreation passes through this wrapper before any driver can remove the
+                // old path. A preservation failure throws and therefore leaves the old checkout in place. The
+                // row is deliberately written before the later worktree-recreation row so the journal cannot
+                // describe only the commits it carried while omitting uncommitted work the removal destroyed.
+                const recreateTaskWorktree = async (taskBranch, taskBase, priorWt) => {
+                    const ref = await preserveWorktree(priorWt);
+                    if (ref)
+                        journal.append("worktree-preserved", t.id, { ref });
+                    return driver.worktree(repoRoot, taskBranch, taskBase);
+                };
                 const r = route(t, cfg, channels, profile, undefined, demotedChannels);
                 for (const lint of r.lints)
                     journal.append("routing-lint", t.id, { lint });
@@ -1216,6 +1243,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                 let gateSubject;
                 const journalGateResult = (g) => {
                     const blocking = gateFailed(g) && (g.gate === "review" || g.gate === "acceptance");
+                    // T2: a review that PASSED while DEFERRING a concern still recorded a defect — the prompt
+                    // promises the deferral is recorded and never dropped, and a details string is not a record a
+                    // later round can match. The blocking projection above is the only writer of structured
+                    // findings today, so on this row it writes nothing and every structured reader goes blind.
+                    // Same shape, same identity, on the passing row: the verdict is untouched (`pass` stays true),
+                    // only the projection widens to the rows the reviewer itself classified as deferred.
+                    const deferred = !blocking && g.gate === "review" && g.pass === true
+                        ? deferredReviewFindings(g.details)
+                        : [];
                     // R3 (OBS-186): a gate that DECLINED has no verdict to state, and this row is the ONE seam every
                     // fold outside this file shares. Writing `pass: false` for a decline is what turned a skip into
                     // a failure at all of them at once — the engagement round budget (reviewRoundsSinceApproval,
@@ -1260,6 +1296,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ...(blocking ? {
                             taskContentDigest: contentDigest,
                             findings: structuredFindings(g.gate, g.details),
+                        } : deferred.length > 0 ? {
+                            taskContentDigest: contentDigest,
+                            findings: deferred,
                         } : {}),
                         // v2.0 T2 (OBS-554): the gate's OWN measurement, lifted verbatim from the meta run-gates
                         // stamped WHERE THE GATE RAN. Nothing here re-derives a duration by subtracting journal
@@ -1270,6 +1309,27 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // every recalibration this telemetry funds, a gap is honest and a zero is a lie. The
                         // seven-gate closed set is asserted end-to-end in tests/run/gate-telemetry.test.ts.
                         ...gateMeasurement(g.meta),
+                        // T7: the capacity the gate's own command child ran under, lifted verbatim from the result
+                        // the battery produced — read where the shell built that child's environment, never
+                        // re-derived from the run's own budget, which would answer a different number than the
+                        // operator's export did. It is this row's only COMPARABLE identity: the two load samples
+                        // beside it are endpoint reads of a gate whose interior neither of them saw, so no reader
+                        // compares them, and matching capacity never claims the machine was calm. A gate that ran
+                        // no command carries nothing — it divided nothing.
+                        //
+                        // `dirtiedBy` is the one hole in that lift: run-gates REPLACES a green battery verdict with
+                        // a refusal when the command left the worktree dirty (run-gates.ts, three sites: the legacy
+                        // batch, the per-command loop and the merge-candidate full suite), and the refusal is a
+                        // fresh verdict object carrying nothing off the result it replaced. That command's child DID
+                        // run, so its row still owes the world it ran in. `sessionCapacity` is that world and not a
+                        // re-derivation of it: it applies the same precedence `shell` does — an operator export
+                        // first — and was read inside the same fork budget every gate child of this run is spawned
+                        // under, so it is by construction the number that child received. The flag is set only where
+                        // a command of THIS gate ran and dirtied the tree, so the round-entry refusal (no command
+                        // ran) and the round-end withdrawal (lands on a gate that runs no command) still carry
+                        // nothing.
+                        ...(g.capacity ? { capacity: g.capacity }
+                            : g.meta?.dirtiedBy === g.gate ? { capacity: sessionCapacity } : {}),
                     });
                 };
                 // R3 (OBS-186): judge ‖ review are launched together and publish in COMPLETION order
@@ -1457,7 +1517,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const priorTaskTip = await gitHead(priorWt);
                     const priorTaskSubject = await gateCommitSubject(taskBase, priorTaskTip, priorWt);
                     const commitsToCarry = await commitsAheadOf(taskBase, priorWt);
-                    const wt = await driver.worktree(repoRoot, taskBranch, taskBase);
+                    const wt = await recreateTaskWorktree(taskBranch, taskBase, priorWt);
                     const carriedCommits = await cherryPickCommits(wt, commitsToCarry);
                     // Reuse is about the tree the gates will actually inspect. The integration tip may have moved
                     // while the daemon was down, so compare after recreating the task on today's taskBase rather
@@ -1550,7 +1610,21 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const canonicalCurrentCommit = currentTaskSubject === replayedGates.commit;
                         const recreatedLegacyCommit = priorTaskTip === replayedGates.commit
                             && priorTaskSubject === currentTaskSubject;
-                        let reusable = exactCurrentCommit || canonicalCurrentCommit || recreatedLegacyCommit;
+                        // T7: the commit says the gates would inspect the same TREE; it says nothing about the
+                        // machine they measured it on. A resume is a new session and may have resolved a different
+                        // concurrency, so the rows behind a replayed green must also have been measured under the
+                        // capacity this session resolved — otherwise a contiguous green prefix spans two worlds.
+                        // Rows from before this stamp carry no capacity and replay exactly as they do today.
+                        const replayedCapacities = priorEvents
+                            .filter((e) => e.event === "gate-result" && e.taskId === t.id && e.data.commit === replayedGates.commit)
+                            .map((e) => e.data.capacity);
+                        const sameWorld = replayedCapacities.every((recorded) => sameCapacity(recorded, sessionCapacity));
+                        if (!sameWorld) {
+                            journal.append("gate-replay-capacity-changed", t.id, {
+                                commit: replayedGates.commit, recorded: replayedCapacities, resolved: sessionCapacity,
+                            });
+                        }
+                        let reusable = sameWorld && (exactCurrentCommit || canonicalCurrentCommit || recreatedLegacyCommit);
                         const reused = [];
                         const declaredGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
                         for (const gate of declaredGates) {
@@ -1753,6 +1827,49 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const brief = journaledRows.join("\n\n");
                         feedback = feedback ? `${brief}\n\n${feedback}` : brief;
                     }
+                    // T6: both carries above are ATTEMPT-scoped — the funded repair is spent at the next
+                    // worker-launch (and budgeted at two), and the journaled brief is reset there too, so it hands
+                    // this dispatch only the LAST attempt's bytes. An unresolved review finding is a property of the
+                    // TASK: the moment one attempt fails for an unrelated reason — a red build, a refused tree, or a
+                    // death that journals no gate row at all — the finding is in neither carry and the next worker
+                    // re-derives the task from the spec and lands on the same gap the reviewer already anchored.
+                    // Re-derived from the journal on EVERY dispatch and retired only by a review that passes on this
+                    // task (journal.ts `outstandingReviewFindings`). Appended row-wise, because this round's own
+                    // feedback or a repair brief may already quote a finding and repeating it helps no worker.
+                    const outstandingFindings = outstandingReviewFindings(journaledSoFar, t.id);
+                    // T2: the two are different facts about the work and no one heading is true of both. A finding
+                    // the reviewer DEFERRED was accepted with a rationale by a review that did not block on it; a
+                    // blocking one is still waiting for a review to pass. Filing the deferral under the blocking
+                    // heading tells the next worker a passing review is owed on a concern that already drew one —
+                    // the exact falsehood this carry exists to remove, restated in the brief that carries it.
+                    //
+                    // The de-dup below is BLOCKING-ONLY on purpose. A review round's raw bytes quote every finding
+                    // it recorded, deferrals included, and those bytes ride into the very next dispatch under the
+                    // repair brief's "fix ONLY what these findings name" — so on the ordinary immediate retry the
+                    // deferral is already stated, and stated AS BLOCKING. Suppressing its heading there because it
+                    // is "already quoted" leaves exactly the falsehood. A quoted BLOCKING finding is quoted
+                    // truthfully, so that one still de-dups; a deferral is instead CUT from the raw bytes and
+                    // restated once, under the only heading true of it.
+                    const deferredRows = outstandingFindings.filter(isDeferredFinding);
+                    const withoutDeferrals = (text) => deferredRows.reduce((brief, finding) => brief.replaceAll(renderStructuredReviewFinding(finding), ""), text).replace(/\n{3,}/g, "\n\n").trim();
+                    feedback = withoutDeferrals(feedback);
+                    if (repairFindings !== undefined)
+                        repairFindings = withoutDeferrals(repairFindings);
+                    const briefs = [
+                        [OUTSTANDING_FINDINGS_HEADING, outstandingFindings.filter((f) => !isDeferredFinding(f) && !feedback.includes(f.note))],
+                        [DEFERRED_FINDINGS_HEADING, deferredRows],
+                    ];
+                    for (const [heading, rows] of briefs) {
+                        if (rows.length === 0)
+                            continue;
+                        const brief = [heading, ...rows.map((f) => {
+                                const rationale = f.rationale === undefined
+                                    ? ""
+                                    : `\n  Rationale: ${f.rationale}`;
+                                return `- ${f.path}: ${f.note}${rationale}`;
+                            })].join("\n");
+                        feedback = feedback ? `${feedback}\n\n${brief}` : brief;
+                    }
                     retryMode = repairFindings
                         ? "repair"
                         : priorSession
@@ -1775,21 +1892,29 @@ export async function runDaemon(repoRoot, opts = {}) {
                     lastContextTokens = undefined;
                     graph = setStatus(graph, t.id, "running");
                     saveGraph(repoRoot, graph);
-                    journal.append("task-dispatch", t.id, { assignment, attempt, provenance: dispatchProvenance(r.provenance), retryMode });
+                    // T6: a dispatch that carries an outstanding finding says so, and names it. Without this the
+                    // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
+                    // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
+                    journal.append("task-dispatch", t.id, {
+                        assignment, attempt, provenance: dispatchProvenance(r.provenance), retryMode,
+                        ...(outstandingFindings.length > 0 ? { carriedFindings: outstandingFindings } : {}),
+                    });
                     journal.phaseStart(t.id, "worker", { attempt, assignment });
                     const taskBase = await integrationHead(intWt); // deps are merged → visible to this task
                     const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
                     const priorWt = worktreePath(repoRoot, taskBranch);
-                    const commitsToCarry = existsSync(priorWt) ? await commitsAheadOf(taskBase, priorWt) : [];
-                    const wt = await driver.worktree(repoRoot, taskBranch, taskBase);
+                    const recreating = existsSync(priorWt);
+                    const commitsToCarry = recreating ? await commitsAheadOf(taskBase, priorWt) : [];
+                    const wt = await recreateTaskWorktree(taskBranch, taskBase, priorWt);
                     // OBS-58: quota-failover and every retry recreate the task worktree from the integration tip —
                     // cherry-pick prior attempts' landed commits forward so a failover dispatch cannot silently
                     // orphan work a consult already verified as landed.
                     let carriedCommits = [];
                     if (commitsToCarry.length > 0) {
                         carriedCommits = await cherryPickCommits(wt, commitsToCarry);
-                        journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                     }
+                    if (recreating)
+                        journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                     // T2 review (material): harvest eligibility is "does this WORKTREE carry unverified work",
                     // measured against taskBase — the same base the fast-kill's delta probe and the gates
                     // themselves use. It was measured against this attempt's post-carry HEAD, which excluded
@@ -2892,6 +3017,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                         if (results.some((g) => g.gate === "test" && !g.pass))
                             testGateFailed = true;
                         if (results.every(gateSatisfied)) {
+                            // T6: every gate — the review included — is satisfied on this commit, so the failure brief
+                            // this loop is still holding describes nothing outstanding. It is dropped HERE, before the
+                            // merge, because a conflict below sends the task around the attempt loop again: a brief kept
+                            // across that retry hands the next worker findings a later review has since passed on, while
+                            // `carriedFindings` — re-derived from the journal, which retired them — is correctly empty,
+                            // leaving that dispatch's row indistinguishable from an amnesiac one. Rebuilt exactly as the
+                            // gate-fail brief is, so prior-RUN evidence (retired by its own rule, not by this reviewer)
+                            // survives and only this run's settled findings go.
+                            feedback = withCarriedEvidence("");
                             const m = await mergeSerial(taskBranch, t, gated);
                             if (m.tipMoved) {
                                 journal.append("tip-moved", t.id, m.tipMoved);
@@ -3188,9 +3322,6 @@ export async function runDaemon(repoRoot, opts = {}) {
             process.removeListener("SIGINT", onTermination);
             process.removeListener("SIGTERM", onTermination);
         }
-        // T16: every other exit — normal end, throw, termination unwind. disarm() is idempotent, so the
-        // signal path having already stood the tier down changes nothing here.
-        supervision?.disarm();
         try {
             releaseRunLock(repoRoot);
         }

package/dist/run/git.d.ts

@@ -34,6 +34,54 @@ export declare const deriveForkCap: (concurrency: number, cores?: number) => num
 export declare const runWithForkBudget: <T>(concurrency: number, fn: () => Promise<T>) => Promise<T>;
 /** The cap owned by the run on this async context; the standalone default outside one. */
 export declare const resolvedForkCap: () => string;
+/**
+ * T7: the CAPACITY a suite verdict was measured under — the fork cap the command's child actually
+ * received, and the core count that cap was divided from. Two verdicts are comparable only when both
+ * numbers match: a run resumed at a different concurrency divides the same machine by a different
+ * number, so a green measured in that other world is not evidence about this one.
+ *
+ * This pair is the WHOLE comparable identity, and the load averages a gate row already carries beside
+ * it are deliberately NOT part of it — no reader below ever feeds a load sample into the comparison.
+ * The capacity is deterministic and resolved here, where the child's environment is built. The load
+ * endpoints are neither: they are two samples taken at a gate's boundaries, and a gate's INTERIOR is
+ * invisible to them — on this milestone's own run a gate's interior reached well over twice what
+ * either of its own endpoints saw. So matching capacity establishes only that two measurements
+ * divided the same machine by the same number. It says nothing about whether the machine was calm.
+ */
+export interface RunCapacity {
+    forkCap: number;
+    cores: number;
+}
+export type CapacityRead = {
+    state: "present";
+    capacity: RunCapacity;
+} | {
+    state: "absent";
+} | {
+    state: "malformed";
+};
+/**
+ * Three states, never two. A record carrying NO capacity is an older record from before this stamp
+ * existed: it keeps exactly the verdict it has today. A record carrying a capacity it cannot state —
+ * half the pair, an empty container, a zero, a negative, an unparseable value — is a NEWER record
+ * that is malformed, and reading it as an older one is how a fail-closed guard stops firing silently.
+ */
+export declare function readCapacity(value: unknown): CapacityRead;
+/**
+ * May a verdict recorded under `recorded` be reused — forgiven, cached, replayed — by a session
+ * running under `current`? Absent → yes, unchanged. Present and identical → yes. Malformed, a
+ * different capacity, or a current capacity the caller could not state → no.
+ */
+export declare function sameCapacity(recorded: unknown, current: RunCapacity | undefined): boolean;
+export declare const describeCapacity: (value: unknown) => string;
+/**
+ * The capacity a child spawned on THIS async context would receive: the same precedence `shell`
+ * applies below — an operator export of the cap wins over the run's own derived value — beside the
+ * cores it was divided from. A caller holding a command's own result reads the capacity off THAT
+ * result (`ShResult.capacity`, stamped where the child's environment was built); this is for the
+ * decisions taken BEFORE any child exists — a cache hit, a reuse predicate.
+ */
+export declare const resolvedCapacity: () => RunCapacity;
 /** The shipped shell ceiling: the fallback every caller gets when nothing measured a better one. */
 export declare const DEFAULT_SHELL_TIMEOUT_MS = 600000;
 export interface ShResult {
@@ -42,6 +90,8 @@ export interface ShResult {
     stderr: string;
     timedOut?: boolean;
     durationMs?: number;
+    /** T7: the capacity THIS child ran under, stamped where its environment was built (see `shell`). */
+    capacity?: RunCapacity;
 }
 export declare const setSpawnForTests: (fn: typeof spawn) => void;
 export declare const resetSpawnForTests: () => void;
@@ -63,6 +113,21 @@ export declare function cleanupRunWorktrees(repo: string, branch: string, opts:
     removeTaskIds: string[];
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;
+/**
+ * Preserve the bytes an existing checkout holds before recreation removes it.
+ *
+ * `git stash create` cannot do this job: its apparent `-u` argument is accepted as a message and
+ * untracked files never enter the stash object. Build the snapshot through a disposable index
+ * instead. The index starts at HEAD (so no unrelated residue from the checkout's real index enters
+ * the tree), stages the complete working tree including ordinary untracked paths, and lives outside
+ * the repository so it cannot stage itself. None of these plumbing commands writes the checkout or
+ * its real index.
+ *
+ * The returned ref is the durable recovery handle. A clean checkout returns undefined and creates
+ * neither a commit nor a ref, keeping meaningful deaths visible rather than minting one ref per
+ * ordinary dispatch.
+ */
+export declare function preserveWorktree(cwd: string): Promise<string | undefined>;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
 export declare function linkNodeModules(repo: string, dir: string, { force }?: {
     force?: boolean | undefined;