tickmarkr 2.1.3 → 2.1.5

package/dist/run/git.js

@@ -1,8 +1,9 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { availableParallelism } from "node:os";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { availableParallelism, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { StringDecoder } from "node:string_decoder";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
@@ -62,6 +63,53 @@ export const deriveForkCap = (concurrency, cores = availableParallelism()) => Ma
 export const runWithForkBudget = (concurrency, fn) => forkBudget.run(String(deriveForkCap(concurrency)), fn);
 /** The cap owned by the run on this async context; the standalone default outside one. */
 export const resolvedForkCap = () => forkBudget.getStore() ?? DEFAULT_FORK_CAP;
+const positiveInt = (v) => typeof v === "number" && Number.isInteger(v) && v > 0;
+/**
+ * Three states, never two. A record carrying NO capacity is an older record from before this stamp
+ * existed: it keeps exactly the verdict it has today. A record carrying a capacity it cannot state —
+ * half the pair, an empty container, a zero, a negative, an unparseable value — is a NEWER record
+ * that is malformed, and reading it as an older one is how a fail-closed guard stops firing silently.
+ */
+export function readCapacity(value) {
+    if (value === undefined)
+        return { state: "absent" };
+    if (value === null || typeof value !== "object")
+        return { state: "malformed" };
+    const { forkCap, cores } = value;
+    return positiveInt(forkCap) && positiveInt(cores)
+        ? { state: "present", capacity: { forkCap, cores } }
+        : { state: "malformed" };
+}
+/**
+ * May a verdict recorded under `recorded` be reused — forgiven, cached, replayed — by a session
+ * running under `current`? Absent → yes, unchanged. Present and identical → yes. Malformed, a
+ * different capacity, or a current capacity the caller could not state → no.
+ */
+export function sameCapacity(recorded, current) {
+    const read = readCapacity(recorded);
+    if (read.state === "absent")
+        return true;
+    if (read.state === "malformed" || current === undefined)
+        return false;
+    return read.capacity.forkCap === current.forkCap && read.capacity.cores === current.cores;
+}
+export const describeCapacity = (value) => {
+    const read = readCapacity(value);
+    return read.state === "present"
+        ? `fork cap ${read.capacity.forkCap} of ${read.capacity.cores} cores`
+        : read.state === "absent" ? "an unrecorded capacity" : "a malformed capacity";
+};
+/**
+ * The capacity a child spawned on THIS async context would receive: the same precedence `shell`
+ * applies below — an operator export of the cap wins over the run's own derived value — beside the
+ * cores it was divided from. A caller holding a command's own result reads the capacity off THAT
+ * result (`ShResult.capacity`, stamped where the child's environment was built); this is for the
+ * decisions taken BEFORE any child exists — a cache hit, a reuse predicate.
+ */
+export const resolvedCapacity = () => ({
+    forkCap: Number(FORK_CAP_ENV in process.env ? process.env[FORK_CAP_ENV] : resolvedForkCap()),
+    cores: availableParallelism(),
+});
 /** The shipped shell ceiling: the fallback every caller gets when nothing measured a better one. */
 export const DEFAULT_SHELL_TIMEOUT_MS = 600000;
 /**
@@ -102,6 +150,13 @@ function shell(cmd, cwd, timeoutMs, login) {
     // OBS-110: apply the run's own fork cap only when the operator has not already set one.
     if (!(FORK_CAP_ENV in env))
         env[FORK_CAP_ENV] = resolvedForkCap();
+    // T7: the capacity every result of this shell carries, read HERE — off the environment the child
+    // is about to receive, after the precedence above has settled. An operator export is already in
+    // `env`, so what gets recorded is the operator's number, which is the case a release was re-taken
+    // for; re-deriving the run's own budget after the command returned would stamp a cap no child ran
+    // under. `Number` of an unparseable export is NaN, which every reader treats as malformed and
+    // therefore fails closed — the honest direction when the cap in play cannot be stated.
+    const capacity = { forkCap: Number(env[FORK_CAP_ENV]), cores: availableParallelism() };
     const attempt = () => new Promise((resolve) => {
         const startedAt = Date.now();
         // detached: bash gets its own process group so a timeout can kill the whole tree —
@@ -109,13 +164,17 @@ function shell(cmd, cwd, timeoutMs, login) {
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
         const p = (spawnChild ?? spawn)("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
         let stdout = "", stderr = "";
-        let timedOut = false, done = false, started = false;
+        const stdoutDecoder = new StringDecoder("utf8");
+        const stderrDecoder = new StringDecoder("utf8");
+        let timedOut = false, done = false, started = false, outputSeen = false;
         const finish = (code, err) => {
             if (done)
                 return;
             done = true;
             clearTimeout(timer);
-            resolve({ code, stdout, stderr: err ?? stderr, timedOut, durationMs: Date.now() - startedAt });
+            stdout += stdoutDecoder.end();
+            stderr += stderrDecoder.end();
+            resolve({ code, stdout, stderr: err ?? stderr, timedOut, durationMs: Date.now() - startedAt, capacity });
         };
         const timer = setTimeout(() => {
             timedOut = true;
@@ -127,10 +186,23 @@ function shell(cmd, cwd, timeoutMs, login) {
             }
         }, timeoutMs);
         p.on("spawn", () => { started = true; }); // the command exists from here on — never retryable past it
-        p.stdout.on("data", (d) => (stdout += d));
-        p.stderr.on("data", (d) => (stderr += d));
+        // OBS-716: one stateful decoder per stream carries an incomplete UTF-8 sequence into that
+        // stream's next pipe chunk; decoding each chunk through string concatenation corrupts bytes at
+        // kernel-chosen boundaries. A deterministic fixture proves this decoder correct rather than
+        // proving every caller byte-safe: real chunk boundaries are the kernel's to choose, so timing
+        // still decides whether a chunk-local decoder exposes the defect in any particular run.
+        p.stdout.on("data", (d) => {
+            if (d.length > 0)
+                outputSeen = true;
+            stdout += stdoutDecoder.write(d);
+        });
+        p.stderr.on("data", (d) => {
+            if (d.length > 0)
+                outputSeen = true;
+            stderr += stderrDecoder.write(d);
+        });
         p.on("error", (e) => {
-            if (!done && !started && !stdout && !stderr && e.code === RETRYABLE_SPAWN_CODE) {
+            if (!done && !started && !outputSeen && e.code === RETRYABLE_SPAWN_CODE) {
                 done = true;
                 clearTimeout(timer);
                 resolve({ refused: e });
@@ -152,7 +224,7 @@ function shell(cmd, cwd, timeoutMs, login) {
             // Bounded, and the bound is what makes a persisting shortage a REPORTED failure rather than a
             // wedged daemon: past it the caller gets the refusal's own text under exit 127, as before.
             if (n >= SPAWN_ATTEMPT_LIMIT) {
-                return { code: 127, stdout: "", stderr: String(r.refused), durationMs: Date.now() - startedAt };
+                return { code: 127, stdout: "", stderr: String(r.refused), durationMs: Date.now() - startedAt, capacity };
             }
             await new Promise((wake) => setTimeout(wake, SPAWN_RETRY_BACKOFF_MS * n));
         }
@@ -260,6 +332,46 @@ const resolveTaskBranch = async (repo, branch) => {
     const integration = await resolveIntegrationBranch(repo, branch.slice(0, split));
     return `${integration}${branch.slice(split)}`;
 };
+/**
+ * Preserve the bytes an existing checkout holds before recreation removes it.
+ *
+ * `git stash create` cannot do this job: its apparent `-u` argument is accepted as a message and
+ * untracked files never enter the stash object. Build the snapshot through a disposable index
+ * instead. The index starts at HEAD (so no unrelated residue from the checkout's real index enters
+ * the tree), stages the complete working tree including ordinary untracked paths, and lives outside
+ * the repository so it cannot stage itself. None of these plumbing commands writes the checkout or
+ * its real index.
+ *
+ * The returned ref is the durable recovery handle. A clean checkout returns undefined and creates
+ * neither a commit nor a ref, keeping meaningful deaths visible rather than minting one ref per
+ * ordinary dispatch.
+ */
+export async function preserveWorktree(cwd) {
+    if (!existsSync(cwd))
+        return undefined;
+    const scratch = mkdtempSync(join(tmpdir(), "tickmarkr-preserve-index-"));
+    const index = join(scratch, "index");
+    const withIndex = (command) => `GIT_INDEX_FILE=${shq(index)} ${command}`;
+    try {
+        await shGitOk(withIndex("git read-tree HEAD"), cwd);
+        await shGitOk(withIndex("git add -A -- ."), cwd);
+        const tree = (await shGitOk(withIndex("git write-tree"), cwd)).trim();
+        const headTree = (await shGitOk("git rev-parse 'HEAD^{tree}'", cwd)).trim();
+        if (tree === headTree)
+            return undefined;
+        // Do not depend on consumer-level identity configuration: this is an engine recovery object,
+        // not an authored project commit. Its HEAD parent makes the preserved tree directly inspectable.
+        const identity = "GIT_AUTHOR_NAME=tickmarkr GIT_AUTHOR_EMAIL=tickmarkr@localhost "
+            + "GIT_COMMITTER_NAME=tickmarkr GIT_COMMITTER_EMAIL=tickmarkr@localhost";
+        const commit = (await shGitOk(`${identity} git commit-tree ${shq(tree)} -p HEAD -m ${shq("tickmarkr: preserve uncommitted worktree")}`, cwd)).trim();
+        const ref = `refs/tickmarkr/preserved/${commit}`;
+        await shGitOk(`git update-ref ${shq(ref)} ${shq(commit)}`, cwd);
+        return ref;
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
 export async function createWorktree(repo, branch, baseRef) {
     branch = await resolveTaskBranch(repo, branch);
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));

package/dist/run/journal.d.ts

@@ -36,6 +36,7 @@ export interface StructuredFinding {
     path: string;
     symbol: string;
     note: string;
+    rationale?: string;
     fingerprint: string;
 }
 export declare const UNIDENTIFIED = "<unidentified>";
@@ -52,6 +53,15 @@ export declare const UNIDENTIFIED = "<unidentified>";
  * normalized words (see toFinding).
  */
 export declare function structuredFindings(gate: string, details: string, _scopeFiles?: string[]): StructuredFinding[];
+export declare function isDeferredFinding(finding: StructuredFinding): boolean;
+/**
+ * The findings a PASSING review DEFERRED — the rows a blocking-only projection drops on the floor.
+ * A passing review's details are prose; without this the deferral has no identity a later round can
+ * match, and every structured reader of the journal is blind to a defect the reviewer itself named.
+ */
+export declare function deferredReviewFindings(details: string): StructuredFinding[];
+/** The exact review.ts details fragment represented by a structured review finding. */
+export declare function renderStructuredReviewFinding(finding: StructuredFinding): string;
 export interface PriorRunJournal {
     runId: string;
     events: JournalEvent[];
@@ -104,6 +114,43 @@ export declare function repairsSinceApproval(events: JournalEvent[], taskId: str
  * retires the findings it settled — the uphold case re-derives its own brief separately).
  */
 export declare function journaledFailureBrief(events: JournalEvent[], taskId: string): string[];
+/**
+ * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
+ * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
+ * an operator approval settles it), and it therefore travels on EVERY dispatch until then.
+ *
+ * The two carries beside this one are attempt-scoped by construction and both lose it. The funded
+ * repair (`pendingRepairFindings`) is spent at the next `worker-launch` and is budgeted at two per
+ * engagement; `journaledFailureBrief` is reset at that same launch, so it hands the next brief only
+ * the LAST attempt's bytes. The moment one attempt fails for an unrelated reason — a red build, a
+ * refused tree, or a death that produces no verdict at all and journals no gate row whatsoever — the
+ * outstanding finding is in neither carry, and the run re-derives the task from the spec and lands on
+ * the same gap the reviewer already anchored.
+ *
+ * Retirement is closed and narrow: a review that PASSED, or the one approval that accepts the review
+ * gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"` — the operator taking the diff the
+ * reviewer rejected). Every other approval RETAINS. `--uphold` funds an attempt to FIX the findings;
+ * `--recheck` and an attempt-cap release fund another dispatch and say nothing about the reviewer's
+ * objection; a plain human-gate approval predates any review; a gate-satisfied release naming some
+ * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
+ * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
+ * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
+ * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ *
+ * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
+ * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
+ * them. So a pass retires the blocking set and re-seats its own deferrals, and the two retirements
+ * stay distinguishable: the blocking finding is gone, the deferral travels on as accepted work.
+ *
+ * A deferral's bound is the SAME single release as a blocking finding's — the operator accepting the
+ * review gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"`), the one approval in which a
+ * human actually looked at what the reviewer waved through. It is deliberately NOT bounded by a round
+ * count or by a time window: both retire a finding by arithmetic nobody read, which is the silent drop
+ * this fold exists to refuse. Nor can it accumulate — a reviewer restating the same path/note round
+ * after round re-seats ONE fingerprint, and a revised rationale replaces the prior rationale on that
+ * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
+ */
+export declare function outstandingReviewFindings(events: JournalEvent[], taskId: string): StructuredFinding[];
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export declare function pendingRepairFindings(events: JournalEvent[], taskId: string): string | undefined;
 /**

package/dist/run/journal.js

@@ -87,6 +87,13 @@ export function upheldFeedbackByTask(events) {
             && typeof e.data.details === "string") {
             lastReviewFail.set(e.taskId, e.data.details);
         }
+        else if (e.event === "gate-result" && e.data.gate === "review" && e.data.pass === true
+            && e.data.skipped !== true) {
+            // A later review pass settles the upheld finding. Retire both the active brief and the failed
+            // verdict it came from so a still-later approval cannot resurrect already-settled feedback.
+            upheld.delete(e.taskId);
+            lastReviewFail.delete(e.taskId);
+        }
         else if (e.event === "task-approved") {
             // any later approval supersedes: a plain accept-the-diff approval retires the uphold brief.
             if (e.data.release === REVIEW_UPHELD_RELEASE) {
@@ -107,10 +114,11 @@ export function upheldFeedbackByTask(events) {
 // for a resolved one is the silent-lie shape the gates exist to refuse, so the field says so outright.
 export const UNIDENTIFIED = "<unidentified>";
 const ANCHORED_RE = /^- (\S+?):(\d+) — (.*)$/; // "## Anchored review" rows (llm.ts)
-const REVIEW_ROW_RE = /^- \[([^\]]+)\] (.*)$/; // "- [material] …" (review.ts)
+const REVIEW_ROW_START_RE = /^- \[([^\]\r\n]+)\] /gm; // "- [material] …" (review.ts)
 const JUDGE_ROW_RE = /^✗ ([\w.-]+): (.*)$/; // "✗ c1: …" (acceptance.ts) — id, then reason
 const PATH_RE = /\b((?:[\w.@~+-]+\/)+[\w.@~+-]+\.\w{1,6})\b/;
 const LINE_REF_RE = /(:\d+(?::\d+)?\b)|(\bline \d+\b)/gi;
+const REVIEW_RATIONALE_SEPARATOR = " — rationale: ";
 // ponytail: repo-relative tail from the first known top-level directory — enough to make an absolute
 // worktree path and its repo-relative twin the same identity. Widen the marker list if a run ever
 // names findings outside these roots.
@@ -136,10 +144,46 @@ function identifierIn(note) {
 // code identity still has one stable identity of its own: its own words, with the volatile tokens
 // swept out so line/path churn cannot mint a new symbol for the same finding. It is the reviewer's
 // own bytes, never a guess, and it can never fuse two different findings into one.
-function toFinding(cls, note, path, symbol) {
+function toFinding(cls, note, path, symbol, rationale) {
     const p = path || UNIDENTIFIED;
     const s = symbol || normalizeGateFailure(note) || UNIDENTIFIED;
-    return { class: cls, path: p, symbol: s, note, fingerprint: `${cls}|${p}|${s}` };
+    return {
+        class: cls, path: p, symbol: s, note,
+        ...(rationale !== undefined ? { rationale } : {}),
+        fingerprint: `${cls}|${p}|${s}`,
+    };
+}
+/**
+ * Decode review.ts's row rendering without treating physical lines as findings. A review finding's
+ * note and rationale are JSON strings before rendering and may therefore contain newlines; the next
+ * typed row (or the anchored-review block) is the record boundary. The fixed rationale separator is
+ * removed before identity is computed, so changing only why a concern was accepted re-seats it.
+ */
+function reviewDetailFindings(details) {
+    const anchoredAt = details.indexOf("\n\n## Anchored review");
+    let prose = anchoredAt === -1 ? details : details.slice(0, anchoredAt);
+    const inconsistencyAt = prose.search(/\nreview (?:finding|verdict) inconsistent:/);
+    if (inconsistencyAt !== -1)
+        prose = prose.slice(0, inconsistencyAt);
+    const starts = [...prose.matchAll(REVIEW_ROW_START_RE)];
+    return starts.map((start, i) => {
+        const contentStart = start.index + start[0].length;
+        const contentEnd = starts[i + 1]?.index ?? prose.length;
+        let content = prose.slice(contentStart, contentEnd);
+        // The newline before the next typed row is framing, while every earlier newline belongs to the
+        // reviewer's field. At EOF/anchored-review there is no framing newline to remove.
+        if (starts[i + 1] && content.endsWith("\n"))
+            content = content.slice(0, -1);
+        const deferred = String(start[1]).startsWith("deferred/");
+        const separatorAt = deferred ? content.indexOf(REVIEW_RATIONALE_SEPARATOR) : -1;
+        return separatorAt === -1
+            ? { label: start[1], note: content }
+            : {
+                label: start[1],
+                note: content.slice(0, separatorAt),
+                rationale: content.slice(separatorAt + REVIEW_RATIONALE_SEPARATOR.length),
+            };
+    });
 }
 /**
  * Structured findings for a BLOCKING review/judge gate result, parsed from the details the gate
@@ -156,24 +200,22 @@ function toFinding(cls, note, path, symbol) {
 export function structuredFindings(gate, details, _scopeFiles = []) {
     const lines = details.split("\n");
     const rows = [];
-    const push = (cls, note, ownPath, fallbackSymbol = "") => {
+    const push = (cls, note, ownPath, fallbackSymbol = "", rationale) => {
         const own = canonicalPath(ownPath || PATH_RE.exec(note)?.[1] || "");
         const sym = identifierIn(note) || fallbackSymbol;
-        rows.push(toFinding(cls, note, own, sym));
+        rows.push(toFinding(cls, note, own, sym, rationale));
     };
+    if (gate === "review") {
+        for (const finding of reviewDetailFindings(details)) {
+            push(`review:${finding.label}`, finding.note, "", "", finding.rationale);
+        }
+    }
     for (const line of lines) {
         const a = ANCHORED_RE.exec(line);
         if (a) {
             push(`${gate}:anchored`, a[3], a[1]);
             continue;
         }
-        if (gate === "review") {
-            const r = REVIEW_ROW_RE.exec(line);
-            if (r) {
-                push(`review:${r[1]}`, r[2], "");
-                continue;
-            }
-        }
         if (gate === "acceptance") {
             const j = JUDGE_ROW_RE.exec(line);
             // the criterion id IS a stable symbol for an unmet acceptance criterion — the same criterion is
@@ -190,6 +232,29 @@ export function structuredFindings(gate, details, _scopeFiles = []) {
     }
     return rows;
 }
+// v2.1.5 T2: the reviewer's DEFERRAL channel, kept structured. `classifyReviewFindings`
+// (gates/review.ts) renders a deferred finding as `- [deferred/<severity>] <note> — rationale: …`.
+// The parser above preserves multiline fields and separates rationale from identity; an older journal
+// whose row holds only prose still degrades through the same parse rather than to nothing. A deferred
+// finding is a concern the reviewer SAW and chose not to block on; it is not a concern that was fixed.
+const DEFERRED_CLASS_RE = /^review:deferred\b/;
+export function isDeferredFinding(finding) {
+    return DEFERRED_CLASS_RE.test(finding.class);
+}
+/**
+ * The findings a PASSING review DEFERRED — the rows a blocking-only projection drops on the floor.
+ * A passing review's details are prose; without this the deferral has no identity a later round can
+ * match, and every structured reader of the journal is blind to a defect the reviewer itself named.
+ */
+export function deferredReviewFindings(details) {
+    return structuredFindings("review", details).filter(isDeferredFinding);
+}
+/** The exact review.ts details fragment represented by a structured review finding. */
+export function renderStructuredReviewFinding(finding) {
+    const label = finding.class.startsWith("review:") ? finding.class.slice("review:".length) : finding.class;
+    const rationale = finding.rationale === undefined ? "" : `${REVIEW_RATIONALE_SEPARATOR}${finding.rationale}`;
+    return `- [${label}] ${finding.note}${rationale}`;
+}
 const findingRows = (event, gate) => {
     if (Array.isArray(event.data.findings)) {
         const rows = event.data.findings.filter((finding) => {
@@ -198,6 +263,7 @@ const findingRows = (event, gate) => {
             const row = finding;
             return typeof row.class === "string" && typeof row.path === "string"
                 && typeof row.symbol === "string" && typeof row.note === "string"
+                && (row.rationale === undefined || typeof row.rationale === "string")
                 && typeof row.fingerprint === "string";
         });
         if (rows.length > 0)
@@ -480,6 +546,72 @@ export function journaledFailureBrief(events, taskId) {
     }
     return rows;
 }
+/**
+ * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
+ * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
+ * an operator approval settles it), and it therefore travels on EVERY dispatch until then.
+ *
+ * The two carries beside this one are attempt-scoped by construction and both lose it. The funded
+ * repair (`pendingRepairFindings`) is spent at the next `worker-launch` and is budgeted at two per
+ * engagement; `journaledFailureBrief` is reset at that same launch, so it hands the next brief only
+ * the LAST attempt's bytes. The moment one attempt fails for an unrelated reason — a red build, a
+ * refused tree, or a death that produces no verdict at all and journals no gate row whatsoever — the
+ * outstanding finding is in neither carry, and the run re-derives the task from the spec and lands on
+ * the same gap the reviewer already anchored.
+ *
+ * Retirement is closed and narrow: a review that PASSED, or the one approval that accepts the review
+ * gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"` — the operator taking the diff the
+ * reviewer rejected). Every other approval RETAINS. `--uphold` funds an attempt to FIX the findings;
+ * `--recheck` and an attempt-cap release fund another dispatch and say nothing about the reviewer's
+ * objection; a plain human-gate approval predates any review; a gate-satisfied release naming some
+ * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
+ * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
+ * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
+ * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ *
+ * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
+ * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
+ * them. So a pass retires the blocking set and re-seats its own deferrals, and the two retirements
+ * stay distinguishable: the blocking finding is gone, the deferral travels on as accepted work.
+ *
+ * A deferral's bound is the SAME single release as a blocking finding's — the operator accepting the
+ * review gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"`), the one approval in which a
+ * human actually looked at what the reviewer waved through. It is deliberately NOT bounded by a round
+ * count or by a time window: both retire a finding by arithmetic nobody read, which is the silent drop
+ * this fold exists to refuse. Nor can it accumulate — a reviewer restating the same path/note round
+ * after round re-seats ONE fingerprint, and a revised rationale replaces the prior rationale on that
+ * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
+ */
+export function outstandingReviewFindings(events, taskId) {
+    const open = new Map();
+    for (const e of events) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "task-approved") {
+            if (e.data.release === GATE_SATISFIED_RELEASE && e.data.gate === "review")
+                open.clear();
+            continue;
+        }
+        if (e.event !== "gate-result" || e.data.gate !== "review" || e.data.skipped === true)
+            continue;
+        if (e.data.pass !== false) {
+            // a later review PASSED on this task: every finding it BLOCKED on is settled …
+            for (const [key, finding] of open)
+                if (!isDeferredFinding(finding))
+                    open.delete(key);
+            // … and no deferral is, whether or not this pass restated it. A pass is silent about a
+            // deferral it does not mention: the concern is unfixed either way, and the reviewer that
+            // waved it through is not the release that accepts it. Retiring on omission would drop it on
+            // the very next round — the same silent drop by a different door.
+            for (const finding of findingRows(e, "review").filter(isDeferredFinding))
+                open.set(finding.fingerprint, finding);
+        }
+        else
+            for (const finding of findingRows(e, "review"))
+                open.set(finding.fingerprint, finding);
+    }
+    return [...open.values()];
+}
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export function pendingRepairFindings(events, taskId) {
     const e = decisionForNextDispatch(events, taskId, "repair-attempt");
@@ -1055,12 +1187,16 @@ export class Journal {
     }
     replayResumeState() {
         const m = new Map();
+        const events = this.read();
+        // Keep the legacy resume-state field aligned with the journal-authoritative prompt-time fold.
+        // In particular, a review pass after an uphold must erase the fallback daemon.ts may consult.
+        const activeUpheldFeedback = upheldFeedbackByTask(events);
         const pendingReroute = new Set(); // reroute verdicts not yet cleared by a later dispatch
         // OBS-547: what the last dispatch ADDED, so a scope-authoring event can take it back. An
         // unchargeable dispatch must replay as if it never happened — no attempt counted, no channel burned.
         const lastDispatch = new Map();
         const lastReviewFail = new Map(); // OBS-189: newest failed review details per task
-        for (const e of this.read()) {
+        for (const e of events) {
             if (!e.taskId)
                 continue;
             if (e.event === "gate-result" && e.data.gate === "review" && e.data.pass === false
@@ -1160,6 +1296,13 @@ export class Journal {
                 st.lastAssignment = undefined;
             }
         }
+        for (const [taskId, st] of m) {
+            const feedback = activeUpheldFeedback.get(taskId);
+            if (feedback)
+                st.upheldFeedback = feedback;
+            else
+                delete st.upheldFeedback;
+        }
         return m;
     }
     // OBS-130: gate satisfaction is authority, not an inferred daemon state. Only an explicit

package/dist/run/merge.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { ceilingKillResult, classifyFailureOutput, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { tickmarkrDir } from "../graph/graph.js";
-import { gitHead, linkNodeModules, resolveIntegrationBranch, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
 export function integrationBranch(cfg, runId) {
     return `${cfg.integrationBranchPrefix}${runId}`;
 }
@@ -99,7 +99,13 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         // Battery parity on the infra rule too (T9): infrastructure-only output means the runner never
         // completed a suite — nothing was verified, so nothing is forgivable, however familiar its
         // fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
-        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra";
+        // T7: the SECOND reader of a baseline entry, and the same rule as the battery's (baseline.ts).
+        // Evidence crosses a session boundary here — the capture that would forgive this red is very
+        // often the previous session's — so a capture taken under a different resolved capacity forgives
+        // nothing at the tip either. An absent capacity is a pre-T7 baseline and keeps today's verdict.
+        const comparable = sameCapacity(entry?.capacity, r.capacity);
+        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
+            && comparable;
         const pass = r.code === 0 || forgiven;
         if (!pass)
             writeFileSync(artifact, raw);
@@ -111,7 +117,11 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
             fingerprints: r.code !== 0 ? fingerprint(stripped) : [],
             details: r.code === 0 ? "exit 0"
                 : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
-                    : `exit ${r.code}`,
+                    : !comparable && baselineRed && failing.length === 0
+                        ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
+                            + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
+                            + `— forgiveness across a changed capacity is not evidence`
+                        : `exit ${r.code}`,
             ...(forgiven ? { forgiven: true } : {}),
             ...(cause ? { cause } : {}),
             ...(pass ? {} : { artifact }),

package/dist/run/supervision.d.ts

@@ -5,7 +5,7 @@ export declare const SUPERVISION_STALE_MS: number;
 export declare const SUPERVISION_FUTURE_GRACE_MS = 1000;
 export declare const SUPERVISION_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch"];
 export type SupervisionTier = (typeof SUPERVISION_TIERS)[number];
-export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator-context", "overseer-context"];
+export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context"];
 export type SeatTier = (typeof SUPERVISION_SEAT_TIERS)[number];
 /** Does this tier's record have to name the seat it speaks for? */
 export declare const isSeatTier: (tier: string) => tier is SeatTier;