tickmarkr 2.1.4 → 2.1.6

package/dist/run/daemon.js

@@ -19,9 +19,9 @@ import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHa
 import { GATE_NAMES } from "../graph/schema.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { runEnvironment } from "./environment.js";
-import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, runWithForkBudget, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, sameCapacity, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingReviewFindings, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingReviewFindings, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, renderStructuredReviewFinding, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
@@ -242,6 +242,10 @@ function repairBrief(findings, diff, baseRef) {
 // v1.70 T5: default request-changes rounds a task may draw before it parks. OBS-419 keeps this as the
 // no-ceiling behavior; an operator may narrow only the next engagement on the approval that releases it.
 const REVIEW_ROUND_CAP = 2;
+// T2: one heading per fact. The first is owed a passing review; the second already drew one and was
+// accepted with the reviewer's own rationale, which travels beside (but never changes) its identity.
+const OUTSTANDING_FINDINGS_HEADING = "## Outstanding review findings — a review has NOT passed on these yet";
+const DEFERRED_FINDINGS_HEADING = "## Deferred review findings — a reviewer ACCEPTED these with a rationale and did NOT block on them; do not re-litigate, fix only if your change touches them";
 // OBS-419: the newest approval starts the current engagement, so it is also the sole authority for
 // that engagement's optional ceiling. Stop at the newest approval even when the field is absent: a
 // later ordinary release restores the module default instead of inheriting an older operator limit.
@@ -392,7 +396,7 @@ function lastVerifyCycle(events) {
         if (e.event === "tip-verify-start") {
             const { tip, cmdHash } = e.data;
             cur = typeof tip === "string" && typeof cmdHash === "string"
-                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false }
+                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity] }
                 : undefined;
             afterRunEnd = false;
             continue;
@@ -410,9 +414,14 @@ function lastVerifyCycle(events) {
             continue;
         }
         if (!cur || afterRunEnd || cur.tip !== tip || cur.cmdHash !== cmdHash) {
-            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false };
+            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [] };
         }
         afterRunEnd = false;
+        // T7: EVERY verdict row's own capacity, not just the start row's. The start row is a statement of
+        // intent written before a single command ran; the green this cache would carry forward lives on
+        // these rows, so a row whose capacity differs from the session's — or which is malformed — has to
+        // be able to sink the cycle by itself.
+        cur.capacities.push(e.data.capacity);
         if (e.event === "tip-verify-failed")
             cur.failed = true;
         else {
@@ -440,23 +449,31 @@ function lastVerifyCycle(events) {
 export async function verifyIntegrationTipCached(intWt, commands, journal, opts = {}) {
     const cmdHash = commandsHash(commands);
     const tip = await gitHead(intWt);
+    // T7: the capacity this session's verify children WOULD run under — the third thing a carried
+    // green must match, beside the tip and the command set. A cached verdict is the one place a green
+    // crosses a session boundary with nothing re-run, and a session resumed at a different concurrency
+    // divides the machine by a different number: that green was established in another world, so it is
+    // not carried forward and the commands run again. A pre-T7 cycle records no capacity and keeps
+    // exactly the behaviour it has today.
+    const capacity = resolvedCapacity();
     const porcelain = await shGit("git status --porcelain", intWt);
     const clean = porcelain.code === 0 && porcelain.stdout.trim() === "";
     const last = lastVerifyCycle(journal.read());
     const cached = last !== undefined && !last.failed && !last.forgiven && last.tip === tip && last.cmdHash === cmdHash
-        && Object.keys(commands).every((g) => last.gates.has(g));
+        && Object.keys(commands).every((g) => last.gates.has(g))
+        && last.capacities.every((recorded) => sameCapacity(recorded, capacity));
     // A pair can be verified red and then green without either SHA or command hash changing (for
     // example, an external service or ignored fixture recovers). Delimit attempts explicitly so that
     // the earlier red cannot remain latched into the later complete green cycle.
-    journal.append("tip-verify-start", undefined, { tip, cmdHash, gates: Object.keys(commands), cached: clean && cached });
+    journal.append("tip-verify-start", undefined, { tip, cmdHash, capacity, gates: Object.keys(commands), cached: clean && cached });
     if (clean && cached) {
-        journal.append("tip-verify-cached", undefined, { tip, cmdHash, gates: Object.keys(commands) });
+        journal.append("tip-verify-cached", undefined, { tip, cmdHash, capacity, gates: Object.keys(commands) });
         // The skip must not read as a red. Every surface derives the tip's verdict from this cycle's
         // `tip-verify` events (cockpit derive.ts tipVerificationPassed: a run-end claiming "passed" with
         // ZERO events is fail-closed to FALSE), so a carried-forward green still journals its per-gate
         // pass — `cached: true` keeps it honest about not having re-run the command.
         for (const gate of Object.keys(commands)) {
-            journal.append("tip-verify", undefined, { gate, cmd: commands[gate], pass: true, exitCode: 0, cached: true, tip, cmdHash });
+            journal.append("tip-verify", undefined, { gate, cmd: commands[gate], pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
         }
         return false;
     }
@@ -464,7 +481,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
     for (const r of await verifyIntegrationTip(intWt, commands, journal.dir, opts.baseline)) {
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash });
+            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
@@ -476,6 +493,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
                 lastMergedTask: opts.lastMergedTask,
                 tip,
                 cmdHash,
+                capacity,
             });
             tipFailed = true;
         }
@@ -503,6 +521,35 @@ async function gateCommitSubject(base, head, wt) {
         return head; // fail closed to the exact object id if canonicalization fails
     return createHash("sha256").update(history.stdout).digest("hex");
 }
+// A CPU total cannot prove a tree empty: a newly launched live process can still have a measured
+// total of zero at the host's clock resolution. This probe asks the narrower cardinality question
+// OBS-737 needs. A readable process table with no marker root is measured empty; a failed or empty
+// table is unmeasurable. Descendants are closed over PPID because not every child retains the
+// dispatch-script marker in its own argv.
+async function observeWorkerProcessTree(marker, cwd) {
+    const snapshot = await shGit("ps -Awwo pid=,ppid=,command=", cwd, 15_000);
+    if (snapshot.code !== 0)
+        return "unmeasurable";
+    const rows = [];
+    for (const line of snapshot.stdout.split("\n")) {
+        const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+        if (match)
+            rows.push({ pid: match[1], ppid: match[2], command: match[3] });
+    }
+    if (rows.length === 0)
+        return "unmeasurable";
+    const tree = new Set(rows.filter((row) => row.command.includes(marker)).map((row) => row.pid));
+    for (let grew = true; grew;) {
+        grew = false;
+        for (const row of rows) {
+            if (!tree.has(row.pid) && tree.has(row.ppid)) {
+                tree.add(row.pid);
+                grew = true;
+            }
+        }
+    }
+    return tree.size === 0 ? "empty" : "running";
+}
 const OBSERVE_CHUNK_BYTES = 64 * 1024;
 const OBSERVE_BUDGET_BYTES = 256 * 1024 * 1024;
 let observeBudgetBytes = OBSERVE_BUDGET_BYTES;
@@ -587,6 +634,20 @@ async function boundedGitObservation(command, worktree, budget) {
         return undefined;
     return result.stdout;
 }
+// "No worktree delta" means no staged/unstaged/untracked bytes AND no commits beyond the task's
+// dispatch base. Both reads are bounded and preserve the observer's third state: a failed probe is
+// unreadable, never clean.
+async function observeWorktreeDelta(base, worktree) {
+    let budget = observeBudgetBytes;
+    const status = await boundedGitObservation("GIT_OPTIONAL_LOCKS=0 git status --porcelain=v1 -z --untracked-files=all", worktree, budget);
+    if (status === undefined)
+        return "unreadable";
+    budget -= Buffer.byteLength(status);
+    const ahead = await boundedGitObservation(`GIT_OPTIONAL_LOCKS=0 git rev-list --count ${shq(base)}..HEAD`, worktree, budget);
+    if (ahead === undefined || !/^\d+$/.test(ahead.trim()))
+        return "unreadable";
+    return status.length === 0 && ahead.trim() === "0" ? "unchanged" : "changed";
+}
 // The signature has four git-owned inputs: HEAD, staged blob/mode/path identity, porcelain path and
 // state, and the set of worktree paths whose bytes Git cannot supply. Those paths contribute their
 // filesystem identity, mode, symlink text, and content. A failed or over-budget leg is a third
@@ -898,6 +959,10 @@ export async function runDaemon(repoRoot, opts = {}) {
             const replayedGateResults = resumeLifecycleOpen
                 ? journal.replayCurrentAttemptGateResults()
                 : new Map();
+            // T7: the capacity THIS session resolved — read inside the run's fork budget, so it is the number
+            // every shell this run spawns will divide the machine by. Recorded evidence from another session
+            // is only reusable against this.
+            const sessionCapacity = resolvedCapacity();
             const replayedExclusions = opts.resume ? journal.replayExcludedChannels() : new Set();
             if (opts.resume) {
                 // v1.53 T5: a superseded run is dead — resuming it beside its successor is the exact
@@ -1069,10 +1134,10 @@ export async function runDaemon(repoRoot, opts = {}) {
             };
             // gateFails/consults are execTask-scoped counters passed in so a park row is a rich verified-failure
             // observation (e.g. ladder-exhausted + gateFails:4); every task-human row has a closed kind, never prose alone.
-            const park = async (t, reason, kind, assignment, attempts, startMs, gateFails = 0, consults = 0, tokens, metered = 0, retryMode = "fresh") => {
+            const park = async (t, reason, kind, assignment, attempts, startMs, gateFails = 0, consults = 0, tokens, metered = 0, retryMode = "fresh", details = {}) => {
                 graph = setStatus(graph, t.id, "human");
                 saveGraph(repoRoot, graph);
-                journal.append("task-human", t.id, { reason, kind });
+                journal.append("task-human", t.id, { ...details, reason, kind });
                 if (assignment) {
                     // OBS-547: `metered` counts CHARGEABLE metered attempts, so an unchargeable dispatch passes 0 and
                     // the count is omitted rather than written as 0 or as `1` beside `attempts: 0` — a row claiming
@@ -1150,6 +1215,22 @@ export async function runDaemon(repoRoot, opts = {}) {
                         journal.append("worktree-preserved", t.id, { ref });
                     return driver.worktree(repoRoot, taskBranch, taskBase);
                 };
+                // A dead worker with a clean checkout still needs a durable recovery handle: there may be no
+                // pane left to identify even the commit it was dispatched from. preserveWorktree deliberately
+                // creates no ref for ordinary clean recreations, so this exceptional terminal path pins HEAD
+                // explicitly under the same recovery namespace. Reconfirm the delta immediately before the
+                // ref write; a change or unreadable recheck withdraws the park.
+                const preserveDeadWorker = async (worktree, taskBase) => {
+                    const state = await observeWorktreeDelta(taskBase, worktree);
+                    if (state !== "unchanged")
+                        return { state };
+                    const head = await gitHead(worktree);
+                    const ref = `refs/tickmarkr/preserved/${head}`;
+                    const updated = await shGit(`git update-ref ${shq(ref)} ${shq(head)}`, worktree);
+                    if (updated.code !== 0)
+                        throw new Error(`could not preserve dead worker HEAD at ${ref}: ${updated.stderr || updated.stdout}`);
+                    return { state, ref };
+                };
                 const r = route(t, cfg, channels, profile, undefined, demotedChannels);
                 for (const lint of r.lints)
                     journal.append("routing-lint", t.id, { lint });
@@ -1221,6 +1302,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                 let gateSubject;
                 const journalGateResult = (g) => {
                     const blocking = gateFailed(g) && (g.gate === "review" || g.gate === "acceptance");
+                    // T2: a review that PASSED while DEFERRING a concern still recorded a defect — the prompt
+                    // promises the deferral is recorded and never dropped, and a details string is not a record a
+                    // later round can match. The blocking projection above is the only writer of structured
+                    // findings today, so on this row it writes nothing and every structured reader goes blind.
+                    // Same shape, same identity, on the passing row: the verdict is untouched (`pass` stays true),
+                    // only the projection widens to the rows the reviewer itself classified as deferred.
+                    const deferred = !blocking && g.gate === "review" && g.pass === true
+                        ? deferredReviewFindings(g.details)
+                        : [];
                     // R3 (OBS-186): a gate that DECLINED has no verdict to state, and this row is the ONE seam every
                     // fold outside this file shares. Writing `pass: false` for a decline is what turned a skip into
                     // a failure at all of them at once — the engagement round budget (reviewRoundsSinceApproval,
@@ -1265,6 +1355,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ...(blocking ? {
                             taskContentDigest: contentDigest,
                             findings: structuredFindings(g.gate, g.details),
+                        } : deferred.length > 0 ? {
+                            taskContentDigest: contentDigest,
+                            findings: deferred,
                         } : {}),
                         // v2.0 T2 (OBS-554): the gate's OWN measurement, lifted verbatim from the meta run-gates
                         // stamped WHERE THE GATE RAN. Nothing here re-derives a duration by subtracting journal
@@ -1275,6 +1368,27 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // every recalibration this telemetry funds, a gap is honest and a zero is a lie. The
                         // seven-gate closed set is asserted end-to-end in tests/run/gate-telemetry.test.ts.
                         ...gateMeasurement(g.meta),
+                        // T7: the capacity the gate's own command child ran under, lifted verbatim from the result
+                        // the battery produced — read where the shell built that child's environment, never
+                        // re-derived from the run's own budget, which would answer a different number than the
+                        // operator's export did. It is this row's only COMPARABLE identity: the two load samples
+                        // beside it are endpoint reads of a gate whose interior neither of them saw, so no reader
+                        // compares them, and matching capacity never claims the machine was calm. A gate that ran
+                        // no command carries nothing — it divided nothing.
+                        //
+                        // `dirtiedBy` is the one hole in that lift: run-gates REPLACES a green battery verdict with
+                        // a refusal when the command left the worktree dirty (run-gates.ts, three sites: the legacy
+                        // batch, the per-command loop and the merge-candidate full suite), and the refusal is a
+                        // fresh verdict object carrying nothing off the result it replaced. That command's child DID
+                        // run, so its row still owes the world it ran in. `sessionCapacity` is that world and not a
+                        // re-derivation of it: it applies the same precedence `shell` does — an operator export
+                        // first — and was read inside the same fork budget every gate child of this run is spawned
+                        // under, so it is by construction the number that child received. The flag is set only where
+                        // a command of THIS gate ran and dirtied the tree, so the round-entry refusal (no command
+                        // ran) and the round-end withdrawal (lands on a gate that runs no command) still carry
+                        // nothing.
+                        ...(g.capacity ? { capacity: g.capacity }
+                            : g.meta?.dirtiedBy === g.gate ? { capacity: sessionCapacity } : {}),
                     });
                 };
                 // R3 (OBS-186): judge ‖ review are launched together and publish in COMPLETION order
@@ -1555,7 +1669,21 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const canonicalCurrentCommit = currentTaskSubject === replayedGates.commit;
                         const recreatedLegacyCommit = priorTaskTip === replayedGates.commit
                             && priorTaskSubject === currentTaskSubject;
-                        let reusable = exactCurrentCommit || canonicalCurrentCommit || recreatedLegacyCommit;
+                        // T7: the commit says the gates would inspect the same TREE; it says nothing about the
+                        // machine they measured it on. A resume is a new session and may have resolved a different
+                        // concurrency, so the rows behind a replayed green must also have been measured under the
+                        // capacity this session resolved — otherwise a contiguous green prefix spans two worlds.
+                        // Rows from before this stamp carry no capacity and replay exactly as they do today.
+                        const replayedCapacities = priorEvents
+                            .filter((e) => e.event === "gate-result" && e.taskId === t.id && e.data.commit === replayedGates.commit)
+                            .map((e) => e.data.capacity);
+                        const sameWorld = replayedCapacities.every((recorded) => sameCapacity(recorded, sessionCapacity));
+                        if (!sameWorld) {
+                            journal.append("gate-replay-capacity-changed", t.id, {
+                                commit: replayedGates.commit, recorded: replayedCapacities, resolved: sessionCapacity,
+                            });
+                        }
+                        let reusable = sameWorld && (exactCurrentCommit || canonicalCurrentCommit || recreatedLegacyCommit);
                         const reused = [];
                         const declaredGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
                         for (const gate of declaredGates) {
@@ -1768,10 +1896,37 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // task (journal.ts `outstandingReviewFindings`). Appended row-wise, because this round's own
                     // feedback or a repair brief may already quote a finding and repeating it helps no worker.
                     const outstandingFindings = outstandingReviewFindings(journaledSoFar, t.id);
-                    const unquoted = outstandingFindings.filter((f) => !feedback.includes(f.note));
-                    if (unquoted.length > 0) {
-                        const brief = ["## Outstanding review findings — a review has NOT passed on these yet",
-                            ...unquoted.map((f) => `- ${f.path}: ${f.note}`)].join("\n");
+                    // T2: the two are different facts about the work and no one heading is true of both. A finding
+                    // the reviewer DEFERRED was accepted with a rationale by a review that did not block on it; a
+                    // blocking one is still waiting for a review to pass. Filing the deferral under the blocking
+                    // heading tells the next worker a passing review is owed on a concern that already drew one —
+                    // the exact falsehood this carry exists to remove, restated in the brief that carries it.
+                    //
+                    // The de-dup below is BLOCKING-ONLY on purpose. A review round's raw bytes quote every finding
+                    // it recorded, deferrals included, and those bytes ride into the very next dispatch under the
+                    // repair brief's "fix ONLY what these findings name" — so on the ordinary immediate retry the
+                    // deferral is already stated, and stated AS BLOCKING. Suppressing its heading there because it
+                    // is "already quoted" leaves exactly the falsehood. A quoted BLOCKING finding is quoted
+                    // truthfully, so that one still de-dups; a deferral is instead CUT from the raw bytes and
+                    // restated once, under the only heading true of it.
+                    const deferredRows = outstandingFindings.filter(isDeferredFinding);
+                    const withoutDeferrals = (text) => deferredRows.reduce((brief, finding) => brief.replaceAll(renderStructuredReviewFinding(finding), ""), text).replace(/\n{3,}/g, "\n\n").trim();
+                    feedback = withoutDeferrals(feedback);
+                    if (repairFindings !== undefined)
+                        repairFindings = withoutDeferrals(repairFindings);
+                    const briefs = [
+                        [OUTSTANDING_FINDINGS_HEADING, outstandingFindings.filter((f) => !isDeferredFinding(f) && !feedback.includes(f.note))],
+                        [DEFERRED_FINDINGS_HEADING, deferredRows],
+                    ];
+                    for (const [heading, rows] of briefs) {
+                        if (rows.length === 0)
+                            continue;
+                        const brief = [heading, ...rows.map((f) => {
+                                const rationale = f.rationale === undefined
+                                    ? ""
+                                    : `\n  Rationale: ${f.rationale}`;
+                                return `- ${f.path}: ${f.note}${rationale}`;
+                            })].join("\n");
                         feedback = feedback ? `${feedback}\n\n${brief}` : brief;
                     }
                     retryMode = repairFindings
@@ -2088,6 +2243,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // subprocess tree that REACHED its exit marker, not about what the worker claimed.
                     let processExited = false;
                     let earlyLaunchDead = false;
+                    let deadWorkerPark;
                     let settleParsed;
                     let seedResult;
                     // v1.22 T5 / OBS-19: auto-answer a fingerprint-matched trust dialog exactly once per slot.
@@ -2227,6 +2383,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 let quotaStreak = 0;
                                 let rowSaturationHeld = false; // journaled once per attempt when the kill stands down
                                 let cpuHeld = false; // likewise for the CPU leg's stand-down (OBS-548)
+                                let paneReadHeld = false;
+                                let paneStatusHeld = false;
                                 while (Date.now() - lastProgressAt < stallWindowMs) {
                                     const sliceStart = Date.now();
                                     const remaining = stallWindowMs - (sliceStart - lastProgressAt);
@@ -2254,7 +2412,39 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             break;
                                         }
                                     }
-                                    const paneText = await driver.read(slot, PANE_READ_ROWS);
+                                    // A failed pane read is absence of evidence, never evidence of an absent pane. Keep the
+                                    // rolling taskTimeoutMinutes window as the backstop and name the held probe once.
+                                    let paneText;
+                                    try {
+                                        paneText = await driver.read(slot, PANE_READ_ROWS);
+                                    }
+                                    catch (error) {
+                                        // Preserve the pre-existing exception path when the independent status probe still
+                                        // sees a pane. The outer attempt finally owns accountant cleanup on that path. Only
+                                        // an undetectable status makes the read failure relevant to the death detector, and
+                                        // that genuinely unmeasurable pair fails open to the rolling timeout.
+                                        let paneUndetectable = true;
+                                        try {
+                                            paneUndetectable = await driver.status(slot) === "unknown";
+                                        }
+                                        catch {
+                                            // Two unreadable pane probes are still unmeasurable, never proof of death.
+                                        }
+                                        if (!paneUndetectable)
+                                            throw error;
+                                        if (!paneReadHeld) {
+                                            paneReadHeld = true;
+                                            journal.append("worker-dead-held", t.id, {
+                                                slot: slot.name, attempt, reason: "pane-read-unreadable",
+                                                error: error instanceof Error ? error.message : String(error),
+                                            });
+                                        }
+                                        await armCpuLeg(false);
+                                        const spent = Date.now() - sliceStart;
+                                        if (spent < slice)
+                                            await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
+                                        continue;
+                                    }
                                     if (paneText.length > 0)
                                         everHadOutput = true;
                                     // OBS-117 (v1.71 T6): zero raw output by the early-launch deadline is a dead channel now.
@@ -2323,7 +2513,24 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     // gate held. page on "idle" too: herdr's blocked-scrape is strict and proved flaky
                                     // for TUI dialogs (live check: cursor's trust dialog scraped as idle).
                                     // "unknown"/"working" never page.
-                                    const st = await driver.status(slot);
+                                    let st;
+                                    try {
+                                        st = await driver.status(slot);
+                                    }
+                                    catch (error) {
+                                        if (!paneStatusHeld) {
+                                            paneStatusHeld = true;
+                                            journal.append("worker-dead-held", t.id, {
+                                                slot: slot.name, attempt, reason: "pane-status-unreadable",
+                                                error: error instanceof Error ? error.message : String(error),
+                                            });
+                                        }
+                                        await armCpuLeg(false);
+                                        const spent = Date.now() - sliceStart;
+                                        if (spent < slice)
+                                            await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
+                                        continue;
+                                    }
                                     if (st !== lastStatus) {
                                         lastStatus = st;
                                         journal.append("worker-status", t.id, { slot: slot.name, status: st, attempt });
@@ -2363,6 +2570,95 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     // daemon has nothing left to do — the pane falls back under the fast-kill and page
                                     // watchdogs like any other, instead of riding the whole rolling window untended.
                                     const nudgePending = nudgeable && (!nudged || nudgeDeadline !== undefined);
+                                    // OBS-737: disposition for the one fully measured death state. `unknown` alone is not
+                                    // absence (status parsing can fail), and an empty read alone is not absence (a live pane
+                                    // can be quiet); together they are the existing driver-level pane absence witness. The
+                                    // process probe and both worktree observations retain their own third states. Only the
+                                    // explicit conjunction parks; every other state falls through to the unchanged rolling
+                                    // timeout below. Seeded launches are excluded because their process marker is knowingly
+                                    // unmeasurable (armCpuLeg documents that contract above).
+                                    const paneAbsentCandidate = st === "unknown" && paneText.trim().length === 0;
+                                    // A subprocess can exit between waitOutput and read while its stdout is still draining.
+                                    // Confirm emptiness in this same poll before paying for `ps`; then confirm once more
+                                    // after the process probe yielded the event loop. Any bytes or read error withdraw the
+                                    // absence witness, so a fast completed worker cannot be parked in that drain race.
+                                    let paneAbsent = paneAbsentCandidate;
+                                    if (paneAbsent) {
+                                        try {
+                                            const confirmation = await driver.read(slot, PANE_READ_ROWS);
+                                            paneAbsent = confirmation.trim().length === 0;
+                                            if (!paneAbsent) {
+                                                everHadOutput = true;
+                                                if (stallProgress.observe({ paneText: confirmation, contextTokens }))
+                                                    lastProgressAt = Date.now();
+                                            }
+                                        }
+                                        catch (error) {
+                                            paneAbsent = false;
+                                            if (!paneReadHeld) {
+                                                paneReadHeld = true;
+                                                journal.append("worker-dead-held", t.id, {
+                                                    slot: slot.name, attempt, reason: "pane-read-unreadable",
+                                                    error: error instanceof Error ? error.message : String(error),
+                                                });
+                                            }
+                                        }
+                                    }
+                                    const processTree = paneAbsent && worktreeSinceLaunch === "unchanged" && !hasSeed
+                                        ? await observeWorkerProcessTree(dispatchScript, wt)
+                                        : "unmeasurable";
+                                    if (processTree === "empty") {
+                                        try {
+                                            const confirmation = await driver.read(slot, PANE_READ_ROWS);
+                                            paneAbsent = confirmation.trim().length === 0;
+                                            if (!paneAbsent) {
+                                                everHadOutput = true;
+                                                if (stallProgress.observe({ paneText: confirmation, contextTokens }))
+                                                    lastProgressAt = Date.now();
+                                            }
+                                        }
+                                        catch (error) {
+                                            paneAbsent = false;
+                                            if (!paneReadHeld) {
+                                                paneReadHeld = true;
+                                                journal.append("worker-dead-held", t.id, {
+                                                    slot: slot.name, attempt, reason: "pane-read-unreadable",
+                                                    error: error instanceof Error ? error.message : String(error),
+                                                });
+                                            }
+                                        }
+                                    }
+                                    const worktreeDelta = processTree === "empty"
+                                        && paneAbsent ? await observeWorktreeDelta(taskBase, wt)
+                                        : "unreadable";
+                                    // The first process snapshot can race a just-starting child after the dispatch pane
+                                    // disappeared. Re-read it after the pane and worktree legs have both held: preservation
+                                    // is terminal, so a process appearing in that interval must withdraw the park rather
+                                    // than be orphaned by it. The final worktree recheck remains inside preserveDeadWorker.
+                                    const confirmedProcessTree = worktreeDelta === "unchanged"
+                                        ? await observeWorkerProcessTree(dispatchScript, wt)
+                                        : "unmeasurable";
+                                    const deathCertain = paneAbsent
+                                        && processTree === "empty"
+                                        && confirmedProcessTree === "empty"
+                                        && worktreeDelta === "unchanged";
+                                    if (deathCertain) {
+                                        const preservation = await preserveDeadWorker(wt, taskBase);
+                                        if (!preservation.ref) {
+                                            journal.append("worker-dead-held", t.id, {
+                                                slot: slot.name, attempt, reason: `worktree-${preservation.state}`,
+                                            });
+                                            continue;
+                                        }
+                                        const ref = preservation.ref;
+                                        const reason = `worker is unambiguously dead: pane absent, process tree empty, and worktree unchanged; preserved at ${ref}`;
+                                        deadWorkerPark = { ref, reason };
+                                        journal.append("worktree-preserved", t.id, { ref });
+                                        journal.append("worker-dead-held", t.id, {
+                                            slot: slot.name, attempt, reason: "unambiguous-worker-death", ref,
+                                        });
+                                        break;
+                                    }
                                     // T1 review fix: the kill's "no output growth" leg clocks off the RAW growth signals,
                                     // never lastProgressAt alone — the flat-token rule (stall.ts) deliberately suppresses
                                     // the re-arm report on row growth once tokens stick, and contextTokens is sticky across
@@ -2536,7 +2832,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 if (!finished && exitCode === null) {
                                     // timed out (or only ever saw false positives): harvest whatever the pane holds now
                                     timedOut = Date.now() - lastProgressAt >= stallWindowMs;
-                                    output = await driver.read(slot, PANE_READ_ROWS);
+                                    try {
+                                        output = await driver.read(slot, PANE_READ_ROWS);
+                                    }
+                                    catch {
+                                        // The poll loop already recorded the unreadable pane. Retain the last readable bytes
+                                        // so this ambiguous path still reaches the ordinary timeout/consult backstop.
+                                    }
                                     finished = new RegExp(trailerPattern(nonce)).test(output);
                                     const exit = exitRe.exec(output);
                                     exitCode = exit ? Number(exit[1]) : null;
@@ -2670,6 +2972,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         tokens = addUsage(tokens, attemptUsage);
                         metered++;
                     }
+                    if (deadWorkerPark) {
+                        await park(t, deadWorkerPark.reason, "stall", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { ref: deadWorkerPark.ref });
+                        return;
+                    }
                     let result = settleParsed ?? adapter.parse(output, nonce);
                     const workerFinished = finished;
                     const workerCause = classifyWorkerResultCause({ output, ok: result.ok, finished, exitCode, summary: result.summary, timedOut, deadChannel: deadChannelKilled });

package/dist/run/git.d.ts

@@ -34,6 +34,54 @@ export declare const deriveForkCap: (concurrency: number, cores?: number) => num
 export declare const runWithForkBudget: <T>(concurrency: number, fn: () => Promise<T>) => Promise<T>;
 /** The cap owned by the run on this async context; the standalone default outside one. */
 export declare const resolvedForkCap: () => string;
+/**
+ * T7: the CAPACITY a suite verdict was measured under — the fork cap the command's child actually
+ * received, and the core count that cap was divided from. Two verdicts are comparable only when both
+ * numbers match: a run resumed at a different concurrency divides the same machine by a different
+ * number, so a green measured in that other world is not evidence about this one.
+ *
+ * This pair is the WHOLE comparable identity, and the load averages a gate row already carries beside
+ * it are deliberately NOT part of it — no reader below ever feeds a load sample into the comparison.
+ * The capacity is deterministic and resolved here, where the child's environment is built. The load
+ * endpoints are neither: they are two samples taken at a gate's boundaries, and a gate's INTERIOR is
+ * invisible to them — on this milestone's own run a gate's interior reached well over twice what
+ * either of its own endpoints saw. So matching capacity establishes only that two measurements
+ * divided the same machine by the same number. It says nothing about whether the machine was calm.
+ */
+export interface RunCapacity {
+    forkCap: number;
+    cores: number;
+}
+export type CapacityRead = {
+    state: "present";
+    capacity: RunCapacity;
+} | {
+    state: "absent";
+} | {
+    state: "malformed";
+};
+/**
+ * Three states, never two. A record carrying NO capacity is an older record from before this stamp
+ * existed: it keeps exactly the verdict it has today. A record carrying a capacity it cannot state —
+ * half the pair, an empty container, a zero, a negative, an unparseable value — is a NEWER record
+ * that is malformed, and reading it as an older one is how a fail-closed guard stops firing silently.
+ */
+export declare function readCapacity(value: unknown): CapacityRead;
+/**
+ * May a verdict recorded under `recorded` be reused — forgiven, cached, replayed — by a session
+ * running under `current`? Absent → yes, unchanged. Present and identical → yes. Malformed, a
+ * different capacity, or a current capacity the caller could not state → no.
+ */
+export declare function sameCapacity(recorded: unknown, current: RunCapacity | undefined): boolean;
+export declare const describeCapacity: (value: unknown) => string;
+/**
+ * The capacity a child spawned on THIS async context would receive: the same precedence `shell`
+ * applies below — an operator export of the cap wins over the run's own derived value — beside the
+ * cores it was divided from. A caller holding a command's own result reads the capacity off THAT
+ * result (`ShResult.capacity`, stamped where the child's environment was built); this is for the
+ * decisions taken BEFORE any child exists — a cache hit, a reuse predicate.
+ */
+export declare const resolvedCapacity: () => RunCapacity;
 /** The shipped shell ceiling: the fallback every caller gets when nothing measured a better one. */
 export declare const DEFAULT_SHELL_TIMEOUT_MS = 600000;
 export interface ShResult {
@@ -42,6 +90,8 @@ export interface ShResult {
     stderr: string;
     timedOut?: boolean;
     durationMs?: number;
+    /** T7: the capacity THIS child ran under, stamped where its environment was built (see `shell`). */
+    capacity?: RunCapacity;
 }
 export declare const setSpawnForTests: (fn: typeof spawn) => void;
 export declare const resetSpawnForTests: () => void;