tickmarkr 2.1.4 → 2.1.5

package/dist/gates/review.js

@@ -170,7 +170,8 @@ function reviewPreferIndex(c, prefer) {
     return i === -1 ? prefer.length : i;
 }
 export function pickReviewer(author, channels, exclude = [], // v1.1 failover: reviewer channels that already produced garbage for this task
-prefer = []) {
+prefer = [], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
+floor) {
     // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
     // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
     // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
@@ -182,9 +183,25 @@ prefer = []) {
         // two independent axes: different vendor AND different base-model identity (ADDED TO the vendor
         // rule, never replacing it — a future edit can't silently drop either). The diversity filter runs
         // BEFORE preference ranking: prefer sorts survivors only, so no entry can resurrect an excluded channel.
-        .filter((c) => c.vendor !== authorChannel.vendor && modelId(c.model) !== modelId(author.model) && !exclude.includes(channelKey(c)))
+        .filter((c) => c.vendor !== authorChannel.vendor
+        && modelId(c.model) !== modelId(author.model)
+        && !exclude.includes(channelKey(c))
+        && (floor === undefined || TIER_RANK[c.tier] >= TIER_RANK[floor]))
         .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
 }
+/**
+ * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
+ * remains a separate stated input, so whether its touched paths fit the declaration stays a reviewer
+ * judgement rather than a guarantee made by this renderer.
+ */
+export function renderDeclaredWriteScope(files) {
+    if (files.length === 0) {
+        return "## Declared write scope\nUnrestricted: this task declared no write-scope patterns.";
+    }
+    return `## Declared write scope
+The task DECLARED these write-scope patterns:
+${files.map((path) => `- ${path}`).join("\n")}`;
+}
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers, 
 // OBS-196: run dir for raw-output persistence on an unparseable verdict; absent (older callers,
 // direct tests) skips persistence and changes nothing else.
@@ -257,13 +274,19 @@ artifactDir) {
         policy: "full",
         ...(promotedBy ? { promotedFrom: declaredPolicy, promotedBy } : {}),
     };
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? []);
+    // A reviewer floor is opt-in at the task. Applying cfg.routing.floors here would change the
+    // historical seat for every task that never asked for review-tier coupling.
+    const reviewerFloor = task.routingHints?.floor;
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor);
     if (!reviewer) {
         // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
         // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
+        const reason = reviewerFloor
+            ? `no cross-vendor reviewer available at or above task-declared ${reviewerFloor} floor (diversity rule)`
+            : "no cross-vendor reviewer available (diversity rule)";
         return cfg.review.required
-            ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive", meta: { noEligibleReviewer: true } }
-            : { gate: "review", pass: true, details: "WARNING: no cross-vendor reviewer available — review waived by config", meta: { noEligibleReviewer: true } };
+            ? { gate: "review", pass: false, details: `${reason}; set review.required:false to waive`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } }
+            : { gate: "review", pass: true, details: `WARNING: ${reason} — review waived by config`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } };
     }
     const measuredDiff = await fetchTaskDiff(worktree, baseRef);
     // Keep the reader payload identical to the text charged to the strict cap:
@@ -284,6 +307,8 @@ ${COMPLETION_FAKING_CHECKLIST}
 ## Acceptance criteria
 ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}
 
+${renderDeclaredWriteScope(task.files)}
+
 ## Diff
 \`\`\`diff
 ${diff}
@@ -301,7 +326,15 @@ Respond with ONLY this JSON:
 Approve iff no material finding remains; an empty findings list is a clean approval.
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
-    const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? { driver: via.driver, keep: via.keep, onSlot: via.onSlot, name: via.nameFor("review", reviewer.adapter), label: via.labelFor("review") } : undefined, 
+    let concludedOnInactivity = false;
+    const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? {
+        driver: via.driver,
+        keep: via.keep,
+        onSlot: via.onSlot,
+        name: via.nameFor("review", reviewer.adapter),
+        label: via.labelFor("review"),
+        onInactivity: () => { concludedOnInactivity = true; },
+    } : undefined, 
     // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
     // output until completion — runLlm's 300s default killed reviews mid-flight, returning empty
     // stdout that read as "unparseable" and escalated to re-implementation of green code
@@ -325,14 +358,22 @@ The top-level comments array is optional. Use it only for actionable line-anchor
                 saved = undefined; // persistence is evidence, not a gate input — never fail the gate on it
             }
         }
-        const failure = cause === "malformed-verdict"
-            ? "review output unparseable"
-            : "review dispatch failed — no structurally valid nonce-bound response; output unparseable";
+        const failure = concludedOnInactivity
+            ? "review dispatch concluded on the inactivity policy without a structurally valid nonce-bound response; output unparseable"
+            : cause === "malformed-verdict"
+                ? "review output unparseable"
+                : "review dispatch failed — no structurally valid nonce-bound response; output unparseable";
         return {
             gate: "review",
             pass: false,
             details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; cause: ${cause}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
-            meta: { ...policyMeta, reviewer: channelKey(reviewer), unparseable: true, cause },
+            meta: {
+                ...policyMeta,
+                reviewer: channelKey(reviewer),
+                unparseable: true,
+                cause,
+                ...(concludedOnInactivity ? { classification: "infra", infra: true } : {}),
+            },
         };
     }
     const decided = findings !== null

package/dist/gates/run-gates.js

@@ -589,7 +589,18 @@ export async function runGates(task, ctx) {
             const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, [...(ctx.excludeReviewers ?? []), flaked], ctx.artifactDir));
             if (second.meta?.noEligibleReviewer !== true) {
                 const retried = typeof second.meta?.reviewer === "string" ? second.meta.reviewer : "none";
-                rv = { ...second, meta: { ...second.meta, reviewRetry: { flaked, retried } } };
+                rv = {
+                    ...second,
+                    // `details` is lifted onto the journal's gate-result row; meta.reviewRetry is not. Keep the
+                    // re-route visible in the result text a reader actually opens, including on a red retry.
+                    details: `review re-route: ${flaked} produced no parseable verdict; replaced by ${retried}\n${second.details}`,
+                    meta: { ...second.meta, reviewRetry: { flaked, retried } },
+                };
+            }
+            else if (task.routingHints?.floor) {
+                // Preserve the original no-answer cause when no replacement exists, but name the declared
+                // floor that correctly refused a lower-tier fallback.
+                rv = { ...rv, details: `${rv.details}\nreview re-route refused: ${second.details}` };
             }
         }
         return invocations.length ? { ...rv, meta: { ...rv.meta, invocations } } : rv;

package/dist/run/daemon.js

@@ -19,9 +19,9 @@ import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHa
 import { GATE_NAMES } from "../graph/schema.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { runEnvironment } from "./environment.js";
-import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, runWithForkBudget, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, sameCapacity, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingReviewFindings, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingReviewFindings, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, renderStructuredReviewFinding, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
@@ -242,6 +242,10 @@ function repairBrief(findings, diff, baseRef) {
 // v1.70 T5: default request-changes rounds a task may draw before it parks. OBS-419 keeps this as the
 // no-ceiling behavior; an operator may narrow only the next engagement on the approval that releases it.
 const REVIEW_ROUND_CAP = 2;
+// T2: one heading per fact. The first is owed a passing review; the second already drew one and was
+// accepted with the reviewer's own rationale, which travels beside (but never changes) its identity.
+const OUTSTANDING_FINDINGS_HEADING = "## Outstanding review findings — a review has NOT passed on these yet";
+const DEFERRED_FINDINGS_HEADING = "## Deferred review findings — a reviewer ACCEPTED these with a rationale and did NOT block on them; do not re-litigate, fix only if your change touches them";
 // OBS-419: the newest approval starts the current engagement, so it is also the sole authority for
 // that engagement's optional ceiling. Stop at the newest approval even when the field is absent: a
 // later ordinary release restores the module default instead of inheriting an older operator limit.
@@ -392,7 +396,7 @@ function lastVerifyCycle(events) {
         if (e.event === "tip-verify-start") {
             const { tip, cmdHash } = e.data;
             cur = typeof tip === "string" && typeof cmdHash === "string"
-                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false }
+                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity] }
                 : undefined;
             afterRunEnd = false;
             continue;
@@ -410,9 +414,14 @@ function lastVerifyCycle(events) {
             continue;
         }
         if (!cur || afterRunEnd || cur.tip !== tip || cur.cmdHash !== cmdHash) {
-            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false };
+            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [] };
         }
         afterRunEnd = false;
+        // T7: EVERY verdict row's own capacity, not just the start row's. The start row is a statement of
+        // intent written before a single command ran; the green this cache would carry forward lives on
+        // these rows, so a row whose capacity differs from the session's — or which is malformed — has to
+        // be able to sink the cycle by itself.
+        cur.capacities.push(e.data.capacity);
         if (e.event === "tip-verify-failed")
             cur.failed = true;
         else {
@@ -440,23 +449,31 @@ function lastVerifyCycle(events) {
 export async function verifyIntegrationTipCached(intWt, commands, journal, opts = {}) {
     const cmdHash = commandsHash(commands);
     const tip = await gitHead(intWt);
+    // T7: the capacity this session's verify children WOULD run under — the third thing a carried
+    // green must match, beside the tip and the command set. A cached verdict is the one place a green
+    // crosses a session boundary with nothing re-run, and a session resumed at a different concurrency
+    // divides the machine by a different number: that green was established in another world, so it is
+    // not carried forward and the commands run again. A pre-T7 cycle records no capacity and keeps
+    // exactly the behaviour it has today.
+    const capacity = resolvedCapacity();
     const porcelain = await shGit("git status --porcelain", intWt);
     const clean = porcelain.code === 0 && porcelain.stdout.trim() === "";
     const last = lastVerifyCycle(journal.read());
     const cached = last !== undefined && !last.failed && !last.forgiven && last.tip === tip && last.cmdHash === cmdHash
-        && Object.keys(commands).every((g) => last.gates.has(g));
+        && Object.keys(commands).every((g) => last.gates.has(g))
+        && last.capacities.every((recorded) => sameCapacity(recorded, capacity));
     // A pair can be verified red and then green without either SHA or command hash changing (for
     // example, an external service or ignored fixture recovers). Delimit attempts explicitly so that
     // the earlier red cannot remain latched into the later complete green cycle.
-    journal.append("tip-verify-start", undefined, { tip, cmdHash, gates: Object.keys(commands), cached: clean && cached });
+    journal.append("tip-verify-start", undefined, { tip, cmdHash, capacity, gates: Object.keys(commands), cached: clean && cached });
     if (clean && cached) {
-        journal.append("tip-verify-cached", undefined, { tip, cmdHash, gates: Object.keys(commands) });
+        journal.append("tip-verify-cached", undefined, { tip, cmdHash, capacity, gates: Object.keys(commands) });
         // The skip must not read as a red. Every surface derives the tip's verdict from this cycle's
         // `tip-verify` events (cockpit derive.ts tipVerificationPassed: a run-end claiming "passed" with
         // ZERO events is fail-closed to FALSE), so a carried-forward green still journals its per-gate
         // pass — `cached: true` keeps it honest about not having re-run the command.
         for (const gate of Object.keys(commands)) {
-            journal.append("tip-verify", undefined, { gate, cmd: commands[gate], pass: true, exitCode: 0, cached: true, tip, cmdHash });
+            journal.append("tip-verify", undefined, { gate, cmd: commands[gate], pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
         }
         return false;
     }
@@ -464,7 +481,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
     for (const r of await verifyIntegrationTip(intWt, commands, journal.dir, opts.baseline)) {
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash });
+            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
@@ -476,6 +493,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
                 lastMergedTask: opts.lastMergedTask,
                 tip,
                 cmdHash,
+                capacity,
             });
             tipFailed = true;
         }
@@ -898,6 +916,10 @@ export async function runDaemon(repoRoot, opts = {}) {
             const replayedGateResults = resumeLifecycleOpen
                 ? journal.replayCurrentAttemptGateResults()
                 : new Map();
+            // T7: the capacity THIS session resolved — read inside the run's fork budget, so it is the number
+            // every shell this run spawns will divide the machine by. Recorded evidence from another session
+            // is only reusable against this.
+            const sessionCapacity = resolvedCapacity();
             const replayedExclusions = opts.resume ? journal.replayExcludedChannels() : new Set();
             if (opts.resume) {
                 // v1.53 T5: a superseded run is dead — resuming it beside its successor is the exact
@@ -1221,6 +1243,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                 let gateSubject;
                 const journalGateResult = (g) => {
                     const blocking = gateFailed(g) && (g.gate === "review" || g.gate === "acceptance");
+                    // T2: a review that PASSED while DEFERRING a concern still recorded a defect — the prompt
+                    // promises the deferral is recorded and never dropped, and a details string is not a record a
+                    // later round can match. The blocking projection above is the only writer of structured
+                    // findings today, so on this row it writes nothing and every structured reader goes blind.
+                    // Same shape, same identity, on the passing row: the verdict is untouched (`pass` stays true),
+                    // only the projection widens to the rows the reviewer itself classified as deferred.
+                    const deferred = !blocking && g.gate === "review" && g.pass === true
+                        ? deferredReviewFindings(g.details)
+                        : [];
                     // R3 (OBS-186): a gate that DECLINED has no verdict to state, and this row is the ONE seam every
                     // fold outside this file shares. Writing `pass: false` for a decline is what turned a skip into
                     // a failure at all of them at once — the engagement round budget (reviewRoundsSinceApproval,
@@ -1265,6 +1296,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ...(blocking ? {
                             taskContentDigest: contentDigest,
                             findings: structuredFindings(g.gate, g.details),
+                        } : deferred.length > 0 ? {
+                            taskContentDigest: contentDigest,
+                            findings: deferred,
                         } : {}),
                         // v2.0 T2 (OBS-554): the gate's OWN measurement, lifted verbatim from the meta run-gates
                         // stamped WHERE THE GATE RAN. Nothing here re-derives a duration by subtracting journal
@@ -1275,6 +1309,27 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // every recalibration this telemetry funds, a gap is honest and a zero is a lie. The
                         // seven-gate closed set is asserted end-to-end in tests/run/gate-telemetry.test.ts.
                         ...gateMeasurement(g.meta),
+                        // T7: the capacity the gate's own command child ran under, lifted verbatim from the result
+                        // the battery produced — read where the shell built that child's environment, never
+                        // re-derived from the run's own budget, which would answer a different number than the
+                        // operator's export did. It is this row's only COMPARABLE identity: the two load samples
+                        // beside it are endpoint reads of a gate whose interior neither of them saw, so no reader
+                        // compares them, and matching capacity never claims the machine was calm. A gate that ran
+                        // no command carries nothing — it divided nothing.
+                        //
+                        // `dirtiedBy` is the one hole in that lift: run-gates REPLACES a green battery verdict with
+                        // a refusal when the command left the worktree dirty (run-gates.ts, three sites: the legacy
+                        // batch, the per-command loop and the merge-candidate full suite), and the refusal is a
+                        // fresh verdict object carrying nothing off the result it replaced. That command's child DID
+                        // run, so its row still owes the world it ran in. `sessionCapacity` is that world and not a
+                        // re-derivation of it: it applies the same precedence `shell` does — an operator export
+                        // first — and was read inside the same fork budget every gate child of this run is spawned
+                        // under, so it is by construction the number that child received. The flag is set only where
+                        // a command of THIS gate ran and dirtied the tree, so the round-entry refusal (no command
+                        // ran) and the round-end withdrawal (lands on a gate that runs no command) still carry
+                        // nothing.
+                        ...(g.capacity ? { capacity: g.capacity }
+                            : g.meta?.dirtiedBy === g.gate ? { capacity: sessionCapacity } : {}),
                     });
                 };
                 // R3 (OBS-186): judge ‖ review are launched together and publish in COMPLETION order
@@ -1555,7 +1610,21 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const canonicalCurrentCommit = currentTaskSubject === replayedGates.commit;
                         const recreatedLegacyCommit = priorTaskTip === replayedGates.commit
                             && priorTaskSubject === currentTaskSubject;
-                        let reusable = exactCurrentCommit || canonicalCurrentCommit || recreatedLegacyCommit;
+                        // T7: the commit says the gates would inspect the same TREE; it says nothing about the
+                        // machine they measured it on. A resume is a new session and may have resolved a different
+                        // concurrency, so the rows behind a replayed green must also have been measured under the
+                        // capacity this session resolved — otherwise a contiguous green prefix spans two worlds.
+                        // Rows from before this stamp carry no capacity and replay exactly as they do today.
+                        const replayedCapacities = priorEvents
+                            .filter((e) => e.event === "gate-result" && e.taskId === t.id && e.data.commit === replayedGates.commit)
+                            .map((e) => e.data.capacity);
+                        const sameWorld = replayedCapacities.every((recorded) => sameCapacity(recorded, sessionCapacity));
+                        if (!sameWorld) {
+                            journal.append("gate-replay-capacity-changed", t.id, {
+                                commit: replayedGates.commit, recorded: replayedCapacities, resolved: sessionCapacity,
+                            });
+                        }
+                        let reusable = sameWorld && (exactCurrentCommit || canonicalCurrentCommit || recreatedLegacyCommit);
                         const reused = [];
                         const declaredGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
                         for (const gate of declaredGates) {
@@ -1768,10 +1837,37 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // task (journal.ts `outstandingReviewFindings`). Appended row-wise, because this round's own
                     // feedback or a repair brief may already quote a finding and repeating it helps no worker.
                     const outstandingFindings = outstandingReviewFindings(journaledSoFar, t.id);
-                    const unquoted = outstandingFindings.filter((f) => !feedback.includes(f.note));
-                    if (unquoted.length > 0) {
-                        const brief = ["## Outstanding review findings — a review has NOT passed on these yet",
-                            ...unquoted.map((f) => `- ${f.path}: ${f.note}`)].join("\n");
+                    // T2: the two are different facts about the work and no one heading is true of both. A finding
+                    // the reviewer DEFERRED was accepted with a rationale by a review that did not block on it; a
+                    // blocking one is still waiting for a review to pass. Filing the deferral under the blocking
+                    // heading tells the next worker a passing review is owed on a concern that already drew one —
+                    // the exact falsehood this carry exists to remove, restated in the brief that carries it.
+                    //
+                    // The de-dup below is BLOCKING-ONLY on purpose. A review round's raw bytes quote every finding
+                    // it recorded, deferrals included, and those bytes ride into the very next dispatch under the
+                    // repair brief's "fix ONLY what these findings name" — so on the ordinary immediate retry the
+                    // deferral is already stated, and stated AS BLOCKING. Suppressing its heading there because it
+                    // is "already quoted" leaves exactly the falsehood. A quoted BLOCKING finding is quoted
+                    // truthfully, so that one still de-dups; a deferral is instead CUT from the raw bytes and
+                    // restated once, under the only heading true of it.
+                    const deferredRows = outstandingFindings.filter(isDeferredFinding);
+                    const withoutDeferrals = (text) => deferredRows.reduce((brief, finding) => brief.replaceAll(renderStructuredReviewFinding(finding), ""), text).replace(/\n{3,}/g, "\n\n").trim();
+                    feedback = withoutDeferrals(feedback);
+                    if (repairFindings !== undefined)
+                        repairFindings = withoutDeferrals(repairFindings);
+                    const briefs = [
+                        [OUTSTANDING_FINDINGS_HEADING, outstandingFindings.filter((f) => !isDeferredFinding(f) && !feedback.includes(f.note))],
+                        [DEFERRED_FINDINGS_HEADING, deferredRows],
+                    ];
+                    for (const [heading, rows] of briefs) {
+                        if (rows.length === 0)
+                            continue;
+                        const brief = [heading, ...rows.map((f) => {
+                                const rationale = f.rationale === undefined
+                                    ? ""
+                                    : `\n  Rationale: ${f.rationale}`;
+                                return `- ${f.path}: ${f.note}${rationale}`;
+                            })].join("\n");
                         feedback = feedback ? `${feedback}\n\n${brief}` : brief;
                     }
                     retryMode = repairFindings

package/dist/run/git.d.ts

@@ -34,6 +34,54 @@ export declare const deriveForkCap: (concurrency: number, cores?: number) => num
 export declare const runWithForkBudget: <T>(concurrency: number, fn: () => Promise<T>) => Promise<T>;
 /** The cap owned by the run on this async context; the standalone default outside one. */
 export declare const resolvedForkCap: () => string;
+/**
+ * T7: the CAPACITY a suite verdict was measured under — the fork cap the command's child actually
+ * received, and the core count that cap was divided from. Two verdicts are comparable only when both
+ * numbers match: a run resumed at a different concurrency divides the same machine by a different
+ * number, so a green measured in that other world is not evidence about this one.
+ *
+ * This pair is the WHOLE comparable identity, and the load averages a gate row already carries beside
+ * it are deliberately NOT part of it — no reader below ever feeds a load sample into the comparison.
+ * The capacity is deterministic and resolved here, where the child's environment is built. The load
+ * endpoints are neither: they are two samples taken at a gate's boundaries, and a gate's INTERIOR is
+ * invisible to them — on this milestone's own run a gate's interior reached well over twice what
+ * either of its own endpoints saw. So matching capacity establishes only that two measurements
+ * divided the same machine by the same number. It says nothing about whether the machine was calm.
+ */
+export interface RunCapacity {
+    forkCap: number;
+    cores: number;
+}
+export type CapacityRead = {
+    state: "present";
+    capacity: RunCapacity;
+} | {
+    state: "absent";
+} | {
+    state: "malformed";
+};
+/**
+ * Three states, never two. A record carrying NO capacity is an older record from before this stamp
+ * existed: it keeps exactly the verdict it has today. A record carrying a capacity it cannot state —
+ * half the pair, an empty container, a zero, a negative, an unparseable value — is a NEWER record
+ * that is malformed, and reading it as an older one is how a fail-closed guard stops firing silently.
+ */
+export declare function readCapacity(value: unknown): CapacityRead;
+/**
+ * May a verdict recorded under `recorded` be reused — forgiven, cached, replayed — by a session
+ * running under `current`? Absent → yes, unchanged. Present and identical → yes. Malformed, a
+ * different capacity, or a current capacity the caller could not state → no.
+ */
+export declare function sameCapacity(recorded: unknown, current: RunCapacity | undefined): boolean;
+export declare const describeCapacity: (value: unknown) => string;
+/**
+ * The capacity a child spawned on THIS async context would receive: the same precedence `shell`
+ * applies below — an operator export of the cap wins over the run's own derived value — beside the
+ * cores it was divided from. A caller holding a command's own result reads the capacity off THAT
+ * result (`ShResult.capacity`, stamped where the child's environment was built); this is for the
+ * decisions taken BEFORE any child exists — a cache hit, a reuse predicate.
+ */
+export declare const resolvedCapacity: () => RunCapacity;
 /** The shipped shell ceiling: the fallback every caller gets when nothing measured a better one. */
 export declare const DEFAULT_SHELL_TIMEOUT_MS = 600000;
 export interface ShResult {
@@ -42,6 +90,8 @@ export interface ShResult {
     stderr: string;
     timedOut?: boolean;
     durationMs?: number;
+    /** T7: the capacity THIS child ran under, stamped where its environment was built (see `shell`). */
+    capacity?: RunCapacity;
 }
 export declare const setSpawnForTests: (fn: typeof spawn) => void;
 export declare const resetSpawnForTests: () => void;

package/dist/run/git.js

@@ -63,6 +63,53 @@ export const deriveForkCap = (concurrency, cores = availableParallelism()) => Ma
 export const runWithForkBudget = (concurrency, fn) => forkBudget.run(String(deriveForkCap(concurrency)), fn);
 /** The cap owned by the run on this async context; the standalone default outside one. */
 export const resolvedForkCap = () => forkBudget.getStore() ?? DEFAULT_FORK_CAP;
+const positiveInt = (v) => typeof v === "number" && Number.isInteger(v) && v > 0;
+/**
+ * Three states, never two. A record carrying NO capacity is an older record from before this stamp
+ * existed: it keeps exactly the verdict it has today. A record carrying a capacity it cannot state —
+ * half the pair, an empty container, a zero, a negative, an unparseable value — is a NEWER record
+ * that is malformed, and reading it as an older one is how a fail-closed guard stops firing silently.
+ */
+export function readCapacity(value) {
+    if (value === undefined)
+        return { state: "absent" };
+    if (value === null || typeof value !== "object")
+        return { state: "malformed" };
+    const { forkCap, cores } = value;
+    return positiveInt(forkCap) && positiveInt(cores)
+        ? { state: "present", capacity: { forkCap, cores } }
+        : { state: "malformed" };
+}
+/**
+ * May a verdict recorded under `recorded` be reused — forgiven, cached, replayed — by a session
+ * running under `current`? Absent → yes, unchanged. Present and identical → yes. Malformed, a
+ * different capacity, or a current capacity the caller could not state → no.
+ */
+export function sameCapacity(recorded, current) {
+    const read = readCapacity(recorded);
+    if (read.state === "absent")
+        return true;
+    if (read.state === "malformed" || current === undefined)
+        return false;
+    return read.capacity.forkCap === current.forkCap && read.capacity.cores === current.cores;
+}
+export const describeCapacity = (value) => {
+    const read = readCapacity(value);
+    return read.state === "present"
+        ? `fork cap ${read.capacity.forkCap} of ${read.capacity.cores} cores`
+        : read.state === "absent" ? "an unrecorded capacity" : "a malformed capacity";
+};
+/**
+ * The capacity a child spawned on THIS async context would receive: the same precedence `shell`
+ * applies below — an operator export of the cap wins over the run's own derived value — beside the
+ * cores it was divided from. A caller holding a command's own result reads the capacity off THAT
+ * result (`ShResult.capacity`, stamped where the child's environment was built); this is for the
+ * decisions taken BEFORE any child exists — a cache hit, a reuse predicate.
+ */
+export const resolvedCapacity = () => ({
+    forkCap: Number(FORK_CAP_ENV in process.env ? process.env[FORK_CAP_ENV] : resolvedForkCap()),
+    cores: availableParallelism(),
+});
 /** The shipped shell ceiling: the fallback every caller gets when nothing measured a better one. */
 export const DEFAULT_SHELL_TIMEOUT_MS = 600000;
 /**
@@ -103,6 +150,13 @@ function shell(cmd, cwd, timeoutMs, login) {
     // OBS-110: apply the run's own fork cap only when the operator has not already set one.
     if (!(FORK_CAP_ENV in env))
         env[FORK_CAP_ENV] = resolvedForkCap();
+    // T7: the capacity every result of this shell carries, read HERE — off the environment the child
+    // is about to receive, after the precedence above has settled. An operator export is already in
+    // `env`, so what gets recorded is the operator's number, which is the case a release was re-taken
+    // for; re-deriving the run's own budget after the command returned would stamp a cap no child ran
+    // under. `Number` of an unparseable export is NaN, which every reader treats as malformed and
+    // therefore fails closed — the honest direction when the cap in play cannot be stated.
+    const capacity = { forkCap: Number(env[FORK_CAP_ENV]), cores: availableParallelism() };
     const attempt = () => new Promise((resolve) => {
         const startedAt = Date.now();
         // detached: bash gets its own process group so a timeout can kill the whole tree —
@@ -120,7 +174,7 @@ function shell(cmd, cwd, timeoutMs, login) {
             clearTimeout(timer);
             stdout += stdoutDecoder.end();
             stderr += stderrDecoder.end();
-            resolve({ code, stdout, stderr: err ?? stderr, timedOut, durationMs: Date.now() - startedAt });
+            resolve({ code, stdout, stderr: err ?? stderr, timedOut, durationMs: Date.now() - startedAt, capacity });
         };
         const timer = setTimeout(() => {
             timedOut = true;
@@ -170,7 +224,7 @@ function shell(cmd, cwd, timeoutMs, login) {
             // Bounded, and the bound is what makes a persisting shortage a REPORTED failure rather than a
             // wedged daemon: past it the caller gets the refusal's own text under exit 127, as before.
             if (n >= SPAWN_ATTEMPT_LIMIT) {
-                return { code: 127, stdout: "", stderr: String(r.refused), durationMs: Date.now() - startedAt };
+                return { code: 127, stdout: "", stderr: String(r.refused), durationMs: Date.now() - startedAt, capacity };
             }
             await new Promise((wake) => setTimeout(wake, SPAWN_RETRY_BACKOFF_MS * n));
         }

package/dist/run/journal.d.ts

@@ -36,6 +36,7 @@ export interface StructuredFinding {
     path: string;
     symbol: string;
     note: string;
+    rationale?: string;
     fingerprint: string;
 }
 export declare const UNIDENTIFIED = "<unidentified>";
@@ -52,6 +53,15 @@ export declare const UNIDENTIFIED = "<unidentified>";
  * normalized words (see toFinding).
  */
 export declare function structuredFindings(gate: string, details: string, _scopeFiles?: string[]): StructuredFinding[];
+export declare function isDeferredFinding(finding: StructuredFinding): boolean;
+/**
+ * The findings a PASSING review DEFERRED — the rows a blocking-only projection drops on the floor.
+ * A passing review's details are prose; without this the deferral has no identity a later round can
+ * match, and every structured reader of the journal is blind to a defect the reviewer itself named.
+ */
+export declare function deferredReviewFindings(details: string): StructuredFinding[];
+/** The exact review.ts details fragment represented by a structured review finding. */
+export declare function renderStructuredReviewFinding(finding: StructuredFinding): string;
 export interface PriorRunJournal {
     runId: string;
     events: JournalEvent[];
@@ -126,6 +136,19 @@ export declare function journaledFailureBrief(events: JournalEvent[], taskId: st
  * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
  * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
  * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ *
+ * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
+ * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
+ * them. So a pass retires the blocking set and re-seats its own deferrals, and the two retirements
+ * stay distinguishable: the blocking finding is gone, the deferral travels on as accepted work.
+ *
+ * A deferral's bound is the SAME single release as a blocking finding's — the operator accepting the
+ * review gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"`), the one approval in which a
+ * human actually looked at what the reviewer waved through. It is deliberately NOT bounded by a round
+ * count or by a time window: both retire a finding by arithmetic nobody read, which is the silent drop
+ * this fold exists to refuse. Nor can it accumulate — a reviewer restating the same path/note round
+ * after round re-seats ONE fingerprint, and a revised rationale replaces the prior rationale on that
+ * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
 export declare function outstandingReviewFindings(events: JournalEvent[], taskId: string): StructuredFinding[];
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */