tickmarkr 2.1.4 → 2.1.6

package/dist/gates/baseline.d.ts

@@ -1,7 +1,20 @@
 import type { TickmarkrConfig } from "../config/config.js";
 import type { AcceptanceItem } from "../graph/schema.js";
-import { type ShResult } from "../run/git.js";
+import { type RunCapacity, type ShResult } from "../run/git.js";
 import type { GateResult } from "./types.js";
+/**
+ * T7: the capacity a gate's own command ran under rides the RESULT, beside the verdict it explains,
+ * rather than inside `meta` — `meta` is a machine-readable extras bag several callers compare
+ * wholesale, and identity that a later session keys reuse on does not belong in a bag. Declared here,
+ * at the one producer, because only a battery gate has a command whose child received a fork cap:
+ * every other gate leaves the field absent, which is the honest reading of "this gate divided
+ * nothing". The daemon lifts it verbatim onto the journal's gate row (src/run/daemon.ts).
+ */
+declare module "./types.js" {
+    interface GateResult {
+        capacity?: RunCapacity;
+    }
+}
 export interface BaselineCommand {
     /**
      * Absent when the capture returned no verdict — see `infra`. A pre-v1.90 baseline can also lack it
@@ -21,8 +34,15 @@ export interface BaselineCommand {
     /** The ceiling that measurement implies, persisted so every later battery uses the same number. */
     ceilingMs?: number;
     /**
-     * OBS-534 (T2): the capture was SIGKILLed at its ceiling. It never finished asking the question, so
-     * the entry carries a CAUSE and no verdict: no exit code, no fingerprints, nothing forgivable.
+     * T7: the capacity this command's capture child ran under — the fork cap it received and the cores
+     * that cap was divided from. Absent in every pre-T7 baseline, which is exactly what makes those
+     * entries keep their current forgiveness; a MALFORMED one fails closed instead (git.ts readCapacity).
+     */
+    capacity?: RunCapacity;
+    /**
+     * The capture did not return a trustworthy verdict: it was SIGKILLed at its ceiling, or its output
+     * proves the machine was exhausted while it ran. The entry therefore carries a CAUSE and no
+     * verdict: no exit code, no fingerprints, nothing forgivable.
      */
     infra?: true;
 }

package/dist/gates/baseline.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { DEFAULT_SHELL_TIMEOUT_MS, sh } from "../run/git.js";
+import { DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 // incident #2 (run-20260709-104447): a vitest ✓ PASS line with "error" in the test NAME, wrapped in ANSI
 // codes that varied between baseline and worktree runs, was reported as a "new failure". Strip ANSI first;
 // a pass-marker line is never a failure. [\d;#] covers raw ANSI and digit-normalized ANSI ("\x1b[#m") from
@@ -117,12 +117,22 @@ const VOCAB_RE = /\b(?:error|fail(?:ed|ure|ing)?)\b/i;
 // shapes are emitted by the process that was asked to run the oracle; they are deliberately kept in
 // this runner-output classifier rather than applied to any judge-authored reason text. A real test
 // failure still dominates below because one regression-shaped line makes the whole output regression.
-const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable|Token not found in system keyring|Process from config\.webServer was not able to start/i;
+const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable|Token not found in system keyring|Process from config\.webServer was not able to start|\[birpc\] rpc is closed, cannot call\b/i;
+// Capture invalidation is deliberately narrower than the gate's infrastructure vocabulary above:
+// keyring/config-webServer startup failures remain gate concerns, while this policy is specifically
+// for evidence that the capture ran while the machine was resource-starved.
+const CAPTURE_EXHAUSTION_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable/i;
 // A named error CLASS ("AssertionError", "TypeError", "MyDomainError") — never bare "Error", which
 // is what an errno report itself is headed with (`Error: spawn EAGAIN`). The prefix is required.
 const ERROR_CLASS_RE = /\b[A-Za-z][A-Za-z0-9]*Error\b/;
 const isInfraLine = (l) => INFRA_RE.test(l) && !ERROR_CLASS_RE.test(l) && !namesFailure(l) && !SUMMARY_FAIL_RE.test(l);
 const namesRegression = (l) => (isFailureShaped(l) || ERROR_CLASS_RE.test(l)) && !isInfraLine(l);
+// Infrastructure signatures must enter the fingerprint diff too. Otherwise a signature such as
+// birpc's assertion-free RPC death is classified correctly in the raw output but collapses to the
+// content-free UNRECOGNIZED_FAILURE marker before the fresh-failure path can ask the same classifier.
+// This does not make the vocabulary open-ended: INFRA_RE is still the one closed list, and
+// classifyFailureOutput's ERROR_CLASS_RE/namesFailure vetoes still decide mixed lines.
+const isFingerprintShaped = (l) => isFailureShaped(l) || INFRA_RE.test(l);
 /**
  * What a nonzero runner exit is evidence OF. `undefined` when the output names neither — the
  * unreadable-runner case the existing fail-closed path already owns.
@@ -133,6 +143,18 @@ export function classifyFailureOutput(output) {
         return "regression";
     return lines.some(isInfraLine) ? "infra" : undefined;
 }
+/**
+ * Capture validity asks a different question from gate classification. At a gate, one genuine
+ * regression line must outrank adjacent errno evidence so a real defect is never laundered as infra.
+ * At capture, any such evidence invalidates the whole measurement: once the machine was exhausted,
+ * no failure in that incomplete environment can safely become pre-existing forgiveness. Keep this
+ * separate from `classifyFailureOutput` so changing capture policy cannot move gate verdicts.
+ */
+const captureHasInvalidatingInfra = (output) => output
+    .split("\n")
+    .map((l) => l.replace(ANSI_RE, ""))
+    .filter((l) => !PASS_LINE_RE.test(l))
+    .some((l) => CAPTURE_EXHAUSTION_RE.test(l));
 const normalizeLine = (l) => l.replace(/\d+/g, "#").replace(/\s+/g, " ").trim();
 // Vitest's default reporter names file durations as
 // `✓ |project| tests/example.test.ts (12 tests) 1.23s` (❯ for a red file). The runner may be
@@ -180,10 +202,10 @@ export function fingerprint(output) {
     // prefixed form keeps fingerprinting too (baseline-recorded package-level reds stay forgivable).
     const shaped = [];
     for (const l of lines) {
-        if (isFailureShaped(l))
+        if (isFingerprintShaped(l))
             shaped.push(l);
         const stripped = stripTurboPrefix(l);
-        if (stripped !== undefined && !PASS_LINE_RE.test(stripped) && isFailureShaped(stripped))
+        if (stripped !== undefined && !PASS_LINE_RE.test(stripped) && isFingerprintShaped(stripped))
             shaped.push(stripped);
     }
     if (!shaped.length)
@@ -370,6 +392,15 @@ export function ceilingKillResult(gate, r, ceilingMs) {
  * shell asks it to finish faster than the thing it is measuring.
  */
 export const CAPTURE_CEILING_MS = 1_800_000;
+const invalidCaptureEntry = (durationMs) => ({
+    infra: true,
+    fingerprints: [],
+    durationMs,
+    fileDurationSumMs: null,
+    impliedParallelism: null,
+    longestFile: null,
+    ceilingMs: effectiveCeilingMs({ durationMs }),
+});
 export async function captureBaseline(cwd, commands) {
     const base = { commands: {} };
     for (const [name, cmd] of Object.entries(commands)) {
@@ -396,18 +427,22 @@ export async function captureBaseline(cwd, commands) {
             console.error(`tickmarkr: baseline capture for "${name}" was killed at its ${CAPTURE_CEILING_MS}ms ceiling — `
                 + `it recorded NO fingerprints, so nothing is forgiven and every gate will treat a pre-existing `
                 + `failure as a fresh one. Raise the ceiling or shorten the command.`);
-            base.commands[name] = {
-                infra: true,
-                fingerprints: [],
-                durationMs,
-                fileDurationSumMs: null,
-                impliedParallelism: null,
-                longestFile: null,
-                ceilingMs: effectiveCeilingMs({ durationMs }),
-            };
+            base.commands[name] = invalidCaptureEntry(durationMs);
             continue;
         }
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
+        // Run 2137: the child exited and printed ordinary FAIL/AssertionError lines, so the gate-side
+        // discriminator correctly called the mixed output a regression. But the same output also said
+        // `spawn EAGAIN`: the machine had run out of processes while the pristine-tree measurement was
+        // being taken. A capture cannot know which red lines predated that shortage and which it caused,
+        // so none may become a fingerprint every later task gets to forgive.
+        if (captureHasInvalidatingInfra(raw)) {
+            console.error(`tickmarkr: baseline capture for "${name}" completed with process/resource-exhaustion evidence — `
+                + `it recorded NO exit-code verdict and NO fingerprints, so nothing is forgiven for this command; `
+                + `the measurement cannot distinguish a pre-existing failure from one caused by exhaustion.`);
+            base.commands[name] = invalidCaptureEntry(durationMs);
+            continue;
+        }
         base.commands[name] = {
             exitCode: r.code,
             // a command that exits 0 has no failures to fingerprint — recording any would be a lie the
@@ -417,6 +452,9 @@ export async function captureBaseline(cwd, commands) {
             durationMs,
             ...fileTiming(raw, durationMs),
             ceilingMs: effectiveCeilingMs({ durationMs }),
+            // T7: the world this measurement was taken in, so a later reader can ask whether its own world
+            // is the same one. Recorded from THIS command's own shell result, never re-derived here.
+            ...(r.capacity ? { capacity: r.capacity } : {}),
         };
     }
     const names = Object.keys(commands);
@@ -487,35 +525,31 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         const entry = baseline.commands[name];
         const ceilingMs = effectiveCeilingMs(entry);
         const r = await sh(cmd, cwd, ceilingMs);
+        // T7: every verdict below carries the capacity ITS OWN command ran under, taken off the shell
+        // result rather than re-derived after the fact. The skip row above ran no command and therefore
+        // states no capacity — a row that never divided the machine must not claim that it did.
+        const record = (g) => {
+            results.push(r.capacity ? { ...g, capacity: r.capacity } : g);
+        };
+        // …and whether the entry that would forgive this command was measured in the same world. A
+        // baseline captured under a different fork cap forgives nothing: its fingerprints describe a
+        // machine divided by a different number. Absent capacity (every pre-T7 baseline) still forgives
+        // exactly as it does today; a malformed one fails closed (git.ts sameCapacity).
+        const comparable = sameCapacity(entry?.capacity, r.capacity);
         // Q24: the kill is read BEFORE the exit code is interpreted at all. A SIGKILLed battery has
         // whatever partial output it had flushed — typically no failure shape — so every path below
         // would otherwise turn a timeout into a claim about the work: "no recognizable failure lines"
         // when the baseline was green, or a forgiven pre-existing red when it was not. Neither is true.
         const killed = ceilingKillResult(name, r, ceilingMs);
         if (killed) {
-            results.push(killed);
+            record(killed);
             continue;
         }
         if (r.code === 0) {
-            results.push({ gate: name, pass: true, details: "exit 0" });
+            record({ gate: name, pass: true, details: "exit 0" });
             continue;
         }
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
-        // T9: classify BEFORE the baseline diff, and record it on every nonzero result. An infra-only
-        // exit means the runner never completed a suite, so there is nothing to forgive and nothing
-        // verified — it fails, and `meta.infra` marks it so the merge predicate cannot read it as a
-        // satisfied gate even if some future producer reports it as a pass. Baseline forgiveness stays
-        // exactly where it belongs: on failures the runner actually reported and the baseline already had.
-        const classification = classifyFailureOutput(raw);
-        if (classification === "infra") {
-            results.push({
-                gate: name,
-                pass: false,
-                details: `exit ${r.code} on infrastructure alone — the runner never completed a suite, so this gate verified nothing:\n${unrecognizedEvidence(raw) || raw.trim().split("\n").slice(0, 10).join("\n")}`,
-                meta: { classification, infra: true },
-            });
-            continue;
-        }
         // OBS-278: only a failure SHAPE is a verdict — everything fingerprint() keeps is one, except the
         // unrecognized-output marker, which is evidence for the operator and never grounds to reject.
         // ponytail: ceiling — a runner whose failure output holds no shape above and whose baseline is
@@ -524,6 +558,25 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // that runner's position rule (leading verdict + identifier, or identifier + separator + trailing
         // verdict); loosening back to vocabulary re-opens OBS-278.
         const { failing, unreadable } = freshFailures(entry, raw);
+        // T9: classify the FRESH diff before charging it. The complete runner output can legitimately
+        // contain a baseline-recorded assertion beside a newly introduced infrastructure death; letting
+        // that known assertion outvote the fresh birpc line turns machine failure into a worker defect.
+        // `classifyFailureOutput` remains the single discriminator. When there is no fresh fingerprint,
+        // retain the whole-output read so a repeated infra abort can never be baseline-forgiven as green.
+        const freshClassification = failing.length ? classifyFailureOutput(failing.join("\n")) : undefined;
+        const classification = freshClassification ?? (!failing.length ? classifyFailureOutput(raw) : undefined);
+        if (classification === "infra") {
+            const evidence = failing.length
+                ? failing.slice(0, 10).join("\n")
+                : unrecognizedEvidence(raw) || raw.trim().split("\n").slice(0, 10).join("\n");
+            record({
+                gate: name,
+                pass: false,
+                details: `exit ${r.code}; the fresh failures carry infrastructure evidence alone — the runner never completed a suite, so this gate verified nothing:\n${evidence}`,
+                meta: { classification, infra: true },
+            });
+            continue;
+        }
         // OBS-534 (T2): only a recorded VERDICT can be forgiven. A green baseline has no red to forgive,
         // and neither has a capture that was killed at its ceiling — it recorded a cause instead, so it
         // fails closed on the same branch rather than reading as "only pre-existing failures". Legacy
@@ -534,7 +587,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
                 ? `the baseline capture for this command was killed at its ceiling and recorded no verdict, so nothing here is forgivable — it now exits ${r.code} with no recognizable failure lines — failing closed`
                 : `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`;
             const evidence = unrecognizedEvidence(raw);
-            results.push({
+            record({
                 gate: name,
                 pass: false,
                 details: evidence ? `${closed}\nunrecognized output:\n${evidence}` : closed,
@@ -545,10 +598,26 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         if (failing.length) {
             const headlined = headlineDetails(raw, failing);
             const meta = { ...headlined.meta, ...(classification ? { classification } : {}) };
-            results.push({ gate: name, pass: false, details: headlined.details, ...(Object.keys(meta).length ? { meta } : {}) });
+            record({ gate: name, pass: false, details: headlined.details, ...(Object.keys(meta).length ? { meta } : {}) });
+            continue;
+        }
+        // T7: everything below this line is forgiveness, and forgiveness is the one verdict that reads a
+        // record from another session. The failures are all baseline-recorded — but recorded under a
+        // capacity this command did not run under, so they are not evidence that these failures
+        // pre-existed the diff. A red does not become a green on fingerprints from a world it was not
+        // measured in; the operator gets both worlds named.
+        if (!comparable) {
+            record({
+                gate: name,
+                pass: false,
+                details: `exit ${r.code}; every failure is recorded in the baseline, but that capture ran under `
+                    + `${describeCapacity(entry?.capacity)} and this command ran under ${describeCapacity(r.capacity)} — `
+                    + `forgiveness across a changed capacity is not evidence, so this fails closed`,
+                meta: { capacityMismatch: true, ...(classification ? { classification } : {}) },
+            });
             continue;
         }
-        results.push({
+        record({
             gate: name,
             pass: true,
             details: `exit ${r.code} but only pre-existing failures (forgiven)${unreadable ? " — no failure shape recognized in this output, so a new failure from this runner is invisible to the baseline gate" : ""}`,

package/dist/gates/llm.d.ts

@@ -25,6 +25,7 @@ export interface LlmVia {
     label?: string;
     keep?: boolean;
     onSlot?: (slot: Slot) => void;
+    onInactivity?: () => void;
 }
 export interface GateVia {
     driver: ExecutorDriver;

package/dist/gates/llm.js

@@ -226,6 +226,7 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
                 const snapshotQuietFor = now - quietSince;
                 if (cpuFlatFor >= harvestCpuFlatWindowMs(cpu.resolutionMs)
                     && snapshotQuietFor >= gateInactivityWindowMs) {
+                    via.onInactivity?.();
                     break;
                 }
             }

package/dist/gates/review.d.ts

@@ -1,5 +1,5 @@
 import { type Assignment, type BillingChannel, type WorkerAdapter } from "../adapters/types.js";
-import { type TickmarkrConfig } from "../config/config.js";
+import { type TickmarkrConfig, type Tier } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
@@ -49,6 +49,13 @@ export declare function isDiffCapPark(result: GateResult): boolean;
 export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
-prefer?: string[]): BillingChannel | null;
+prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
+floor?: Tier): BillingChannel | null;
 export type ReviewUnparseableCause = VerdictUnparseableCause;
+/**
+ * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
+ * remains a separate stated input, so whether its touched paths fit the declaration stays a reviewer
+ * judgement rather than a guarantee made by this renderer.
+ */
+export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
 export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string): Promise<GateResult>;

package/dist/gates/review.js

@@ -170,7 +170,8 @@ function reviewPreferIndex(c, prefer) {
     return i === -1 ? prefer.length : i;
 }
 export function pickReviewer(author, channels, exclude = [], // v1.1 failover: reviewer channels that already produced garbage for this task
-prefer = []) {
+prefer = [], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
+floor) {
     // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
     // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
     // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
@@ -182,9 +183,25 @@ prefer = []) {
         // two independent axes: different vendor AND different base-model identity (ADDED TO the vendor
         // rule, never replacing it — a future edit can't silently drop either). The diversity filter runs
         // BEFORE preference ranking: prefer sorts survivors only, so no entry can resurrect an excluded channel.
-        .filter((c) => c.vendor !== authorChannel.vendor && modelId(c.model) !== modelId(author.model) && !exclude.includes(channelKey(c)))
+        .filter((c) => c.vendor !== authorChannel.vendor
+        && modelId(c.model) !== modelId(author.model)
+        && !exclude.includes(channelKey(c))
+        && (floor === undefined || TIER_RANK[c.tier] >= TIER_RANK[floor]))
         .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
 }
+/**
+ * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
+ * remains a separate stated input, so whether its touched paths fit the declaration stays a reviewer
+ * judgement rather than a guarantee made by this renderer.
+ */
+export function renderDeclaredWriteScope(files) {
+    if (files.length === 0) {
+        return "## Declared write scope\nUnrestricted: this task declared no write-scope patterns.";
+    }
+    return `## Declared write scope
+The task DECLARED these write-scope patterns:
+${files.map((path) => `- ${path}`).join("\n")}`;
+}
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers, 
 // OBS-196: run dir for raw-output persistence on an unparseable verdict; absent (older callers,
 // direct tests) skips persistence and changes nothing else.
@@ -257,13 +274,19 @@ artifactDir) {
         policy: "full",
         ...(promotedBy ? { promotedFrom: declaredPolicy, promotedBy } : {}),
     };
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? []);
+    // A reviewer floor is opt-in at the task. Applying cfg.routing.floors here would change the
+    // historical seat for every task that never asked for review-tier coupling.
+    const reviewerFloor = task.routingHints?.floor;
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor);
     if (!reviewer) {
         // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
         // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
+        const reason = reviewerFloor
+            ? `no cross-vendor reviewer available at or above task-declared ${reviewerFloor} floor (diversity rule)`
+            : "no cross-vendor reviewer available (diversity rule)";
         return cfg.review.required
-            ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive", meta: { noEligibleReviewer: true } }
-            : { gate: "review", pass: true, details: "WARNING: no cross-vendor reviewer available — review waived by config", meta: { noEligibleReviewer: true } };
+            ? { gate: "review", pass: false, details: `${reason}; set review.required:false to waive`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } }
+            : { gate: "review", pass: true, details: `WARNING: ${reason} — review waived by config`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } };
     }
     const measuredDiff = await fetchTaskDiff(worktree, baseRef);
     // Keep the reader payload identical to the text charged to the strict cap:
@@ -284,6 +307,8 @@ ${COMPLETION_FAKING_CHECKLIST}
 ## Acceptance criteria
 ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}
 
+${renderDeclaredWriteScope(task.files)}
+
 ## Diff
 \`\`\`diff
 ${diff}
@@ -301,7 +326,15 @@ Respond with ONLY this JSON:
 Approve iff no material finding remains; an empty findings list is a clean approval.
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
-    const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? { driver: via.driver, keep: via.keep, onSlot: via.onSlot, name: via.nameFor("review", reviewer.adapter), label: via.labelFor("review") } : undefined, 
+    let concludedOnInactivity = false;
+    const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? {
+        driver: via.driver,
+        keep: via.keep,
+        onSlot: via.onSlot,
+        name: via.nameFor("review", reviewer.adapter),
+        label: via.labelFor("review"),
+        onInactivity: () => { concludedOnInactivity = true; },
+    } : undefined, 
     // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
     // output until completion — runLlm's 300s default killed reviews mid-flight, returning empty
     // stdout that read as "unparseable" and escalated to re-implementation of green code
@@ -325,14 +358,22 @@ The top-level comments array is optional. Use it only for actionable line-anchor
                 saved = undefined; // persistence is evidence, not a gate input — never fail the gate on it
             }
         }
-        const failure = cause === "malformed-verdict"
-            ? "review output unparseable"
-            : "review dispatch failed — no structurally valid nonce-bound response; output unparseable";
+        const failure = concludedOnInactivity
+            ? "review dispatch concluded on the inactivity policy without a structurally valid nonce-bound response; output unparseable"
+            : cause === "malformed-verdict"
+                ? "review output unparseable"
+                : "review dispatch failed — no structurally valid nonce-bound response; output unparseable";
         return {
             gate: "review",
             pass: false,
             details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; cause: ${cause}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
-            meta: { ...policyMeta, reviewer: channelKey(reviewer), unparseable: true, cause },
+            meta: {
+                ...policyMeta,
+                reviewer: channelKey(reviewer),
+                unparseable: true,
+                cause,
+                ...(concludedOnInactivity ? { classification: "infra", infra: true } : {}),
+            },
         };
     }
     const decided = findings !== null

package/dist/gates/run-gates.js

@@ -589,7 +589,18 @@ export async function runGates(task, ctx) {
             const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, [...(ctx.excludeReviewers ?? []), flaked], ctx.artifactDir));
             if (second.meta?.noEligibleReviewer !== true) {
                 const retried = typeof second.meta?.reviewer === "string" ? second.meta.reviewer : "none";
-                rv = { ...second, meta: { ...second.meta, reviewRetry: { flaked, retried } } };
+                rv = {
+                    ...second,
+                    // `details` is lifted onto the journal's gate-result row; meta.reviewRetry is not. Keep the
+                    // re-route visible in the result text a reader actually opens, including on a red retry.
+                    details: `review re-route: ${flaked} produced no parseable verdict; replaced by ${retried}\n${second.details}`,
+                    meta: { ...second.meta, reviewRetry: { flaked, retried } },
+                };
+            }
+            else if (task.routingHints?.floor) {
+                // Preserve the original no-answer cause when no replacement exists, but name the declared
+                // floor that correctly refused a lower-tier fallback.
+                rv = { ...rv, details: `${rv.details}\nreview re-route refused: ${second.details}` };
             }
         }
         return invocations.length ? { ...rv, meta: { ...rv.meta, invocations } } : rv;