tickmarkr 2.1.6 → 2.1.8

package/dist/compile/native.js

@@ -789,6 +789,20 @@ acceptance is required on every task (a nested list of observable outcomes).
       hard value anywhere in the domain, the criterion asserts a universal that may be FALSE ABOUT THE
       WORLD — bound it or say where it stops holding, rather than demanding a value that does not exist.
 
+  PICK THE CRITERION FORM FROM WHO COULD BE WRONG:
+    - When the WORKER could be wrong because it can choose the value, use "test:" and pin the exact
+      literal it could otherwise choose; an example selected by its implementer proves only itself.
+    - When the AUTHOR could be wrong by omitting a member from a list, quantify universally over the
+      authoritative closed set; a hand-written enumeration can repeat the same omission as the code.
+    - When the REVIEWER could be wrong about a prose artefact, use "judge:" to replay a recorded incident
+      against the changed prose; a keyword check proves vocabulary, not that the artefact prevents a repeat.
+
+  PRE-SCOPE BY TEXT, ENUMERATE BLOCKERS BY EXECUTION:
+    - Before assigning files[], sweep text across the repository tree for names, callers, tests and prose.
+      A text sweep produces a candidate list; only running the change enumerates the real blocker set.
+      Keep the candidates for scope, then execute the production path and full gates before declaring the
+      set closed — this milestone paid a halted run to learn that the two populations are not identical.
+
   WHICH SIDE OF A RUN INHERITS ENVIRONMENT — AND IT DEPENDS ON THE DRIVER (OBS-542):
     - Gate commands and "command:"/"test:" oracles INHERIT THE DAEMON'S ENVIRONMENT. They are children of
       the daemon, so launching it as \`bash -c 'set -a; . .env.test; set +a; exec tickmarkr run'\` reaches

package/dist/compile/ownership.d.ts

@@ -0,0 +1,35 @@
+import type { Task } from "../graph/schema.js";
+export type OwnershipCorroboration = {
+    kind: "direct-import";
+    source: string;
+} | {
+    kind: "command-entry-spawn";
+    source: string;
+    entry: "src/cli/index.ts";
+};
+export type OwnershipFinding = {
+    code: "unowned-test";
+    test: string;
+    taskIds: string[];
+    corroboration?: OwnershipCorroboration;
+    detail: string;
+} | {
+    code: "test-path-outside-allowlist";
+    taskId: string;
+    test: string;
+    path: string;
+    detail: string;
+} | {
+    code: "unordered-context-write";
+    taskId: string;
+    ownerTaskId: string;
+    path: string;
+    detail: string;
+};
+/**
+ * Cross-task ownership evidence. Findings are data: this checker never throws or changes the graph;
+ * the compile seam promotes only a corroborated unowned-test finding and reports every other shape.
+ */
+export declare function ownershipFindings(tasks: readonly Task[], repoRoot: string): OwnershipFinding[];
+export declare function renderOwnershipFinding(finding: OwnershipFinding): string;
+export declare function blocksCompile(finding: OwnershipFinding): boolean;

package/dist/compile/ownership.js

@@ -0,0 +1,213 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { basename, extname, join, posix } from "node:path";
+import { filesGlob } from "../graph/files-glob.js";
+import { collateralHits } from "./collateral.js";
+const normalize = (path) => path.replace(/^\.\//, "").split("\\").join("/");
+function testSources(repoRoot) {
+    const root = join(repoRoot, "tests");
+    try {
+        return readdirSync(root, { recursive: true, encoding: "utf8" })
+            .filter((path) => path.endsWith(".test.ts"))
+            .sort()
+            .flatMap((path) => {
+            try {
+                return [{ path: `tests/${normalize(path)}`, text: readFileSync(join(root, path), "utf8") }];
+            }
+            catch {
+                return [];
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+function namedSources(test, tasks) {
+    const stem = basename(test).replace(/\.test\.ts$/, "");
+    const matches = new Map();
+    for (const task of tasks) {
+        for (const entry of task.files.map(normalize).filter((path) => path.startsWith("src/") && !/[*?{[]/.test(path))) {
+            const source = basename(entry, extname(entry));
+            if (stem === source || stem.startsWith(`${source}-`)) {
+                matches.set(`${task.id}:${entry}`, { taskId: task.id, source: entry });
+            }
+        }
+    }
+    return [...matches.values()];
+}
+const moduleKey = (path) => normalize(path).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+function directImportSpecifiers(text) {
+    // Comments cannot create an edge. Keep strings intact because they are the import target.
+    const source = text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+    const specifiers = new Set();
+    for (const match of source.matchAll(/\bimport\s+(?:type\s+)?(?:[\w$*{},\s]+?\s+from\s+)?["']([^"']+)["']/g)) {
+        specifiers.add(match[1]);
+    }
+    for (const match of source.matchAll(/\bimport\s*\(\s*["']([^"']+)["']\s*\)/g)) {
+        specifiers.add(match[1]);
+    }
+    return [...specifiers];
+}
+function directlyImports(test, source) {
+    // DIRECT is load-bearing: do not walk through imported helpers. src/run/journal.ts alone has 84
+    // test importers in the measured tree, so transitive closure would recreate the raw alarm flood.
+    const target = moduleKey(source);
+    return directImportSpecifiers(test.text).some((specifier) => {
+        const imported = specifier.startsWith(".")
+            ? posix.normalize(posix.join(posix.dirname(test.path), specifier))
+            : specifier.startsWith("src/") ? specifier : "";
+        return imported !== "" && moduleKey(imported) === target;
+    });
+}
+function invokesChildProcessSpawn(text) {
+    const source = text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+    const bindings = new Set();
+    for (const match of source.matchAll(/\bimport\s*{([^}]*)}\s*from\s*["'](?:node:)?child_process["']/g)) {
+        for (const member of match[1].split(",")) {
+            const binding = member.trim().match(/^spawn(?:Sync)?(?:\s+as\s+([A-Za-z_$][\w$]*))?$/);
+            if (binding)
+                bindings.add(binding[1] ?? member.trim());
+        }
+    }
+    for (const match of source.matchAll(/\bimport\s*\*\s*as\s*([A-Za-z_$][\w$]*)\s*from\s*["'](?:node:)?child_process["']/g)) {
+        if (new RegExp(`\\b${match[1]}\\.spawn(?:Sync)?\\s*\\(`).test(source))
+            return true;
+    }
+    return [...bindings].some((binding) => new RegExp(`\\b${binding}\\s*\\(`).test(source));
+}
+function mentionsCommandEntry(text) {
+    return /(?:^|\/)src\/cli\/index\.(?:ts|js)\b/.test(text)
+        || /["'`]src["'`]\s*,\s*["'`]cli["'`]\s*,\s*["'`]index\.(?:ts|js)["'`]/.test(text);
+}
+function corroboration(test, matches) {
+    // A .test.ts-shaped collateral fixture is not by itself a dedicated test. Requiring a runner leaf
+    // keeps import-only scan fixtures advisory while every executable subject in the measured union stays.
+    const executable = test.text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+    if (!/\b(?:test|it)(?:\.(?:concurrent|each|fails|only|skip|todo))*\s*\(/.test(executable))
+        return undefined;
+    for (const match of matches) {
+        if (directlyImports(test, match.source))
+            return { kind: "direct-import", source: match.source };
+    }
+    if (invokesChildProcessSpawn(test.text) && mentionsCommandEntry(test.text)) {
+        const command = matches.find(({ source }) => /^src\/cli\/commands\/[^/]+\.(?:[cm]?[jt]sx?)$/.test(source));
+        if (command)
+            return { kind: "command-entry-spawn", source: command.source, entry: "src/cli/index.ts" };
+    }
+    return undefined;
+}
+function repositoryPaths(text) {
+    const paths = new Set();
+    for (const match of text.matchAll(/["'`]((?:src|tests|fixtures|scripts|skills|docs|\.claude)\/[^"'`\s]+)["'`]/g)) {
+        paths.add(normalize(match[1]));
+    }
+    return [...paths].sort();
+}
+function dependencyOrdered(a, b, byId) {
+    const reaches = (from, target) => {
+        const seen = new Set();
+        const pending = [...from.deps];
+        while (pending.length > 0) {
+            const id = pending.pop();
+            if (id === target)
+                return true;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            pending.push(...(byId.get(id)?.deps ?? []));
+        }
+        return false;
+    };
+    return reaches(a, b.id) || reaches(b, a.id);
+}
+/**
+ * Cross-task ownership evidence. Findings are data: this checker never throws or changes the graph;
+ * the compile seam promotes only a corroborated unowned-test finding and reports every other shape.
+ */
+export function ownershipFindings(tasks, repoRoot) {
+    const sources = testSources(repoRoot);
+    const sourceByPath = new Map(sources.map((source) => [source.path, source]));
+    const byId = new Map(tasks.map((task) => [task.id, task]));
+    const indexed = tasks.map((task) => {
+        const files = task.files.map(normalize);
+        const context = task.context.map(normalize);
+        return {
+            task,
+            owns: files.length === 0 ? () => false : filesGlob(files),
+            allows: files.length === 0 ? () => true : filesGlob([...files, ...context]),
+        };
+    });
+    const owners = (path) => indexed.filter(({ owns }) => owns(path));
+    const predictedBy = new Map();
+    for (const [taskId, hits] of collateralHits(tasks, repoRoot)) {
+        for (const hit of hits) {
+            if (!sourceByPath.has(hit))
+                continue;
+            const ids = predictedBy.get(hit) ?? new Set();
+            ids.add(taskId);
+            predictedBy.set(hit, ids);
+        }
+    }
+    for (const source of sources) {
+        const ids = predictedBy.get(source.path) ?? new Set();
+        for (const { taskId } of namedSources(source.path, tasks))
+            ids.add(taskId);
+        if (ids.size > 0)
+            predictedBy.set(source.path, ids);
+    }
+    const findings = [];
+    for (const [test, taskIds] of predictedBy) {
+        if (owners(test).length === 0) {
+            const ids = [...taskIds].sort();
+            const source = sourceByPath.get(test);
+            const evidence = corroboration(source, namedSources(test, tasks));
+            findings.push({
+                code: "unowned-test",
+                test,
+                taskIds: ids,
+                ...(evidence ? { corroboration: evidence } : {}),
+                detail: `${test} is a dedicated test of source owned by ${ids.join(", ")} but no task owns the test`
+                    + (evidence?.kind === "direct-import" ? `; it imports ${evidence.source} directly`
+                        : evidence?.kind === "command-entry-spawn"
+                            ? `; it spawns ${evidence.entry} to exercise ${evidence.source}` : ""),
+            });
+        }
+    }
+    for (const source of sources) {
+        for (const owner of owners(source.path)) {
+            for (const path of repositoryPaths(source.text)) {
+                if (!owner.allows(path)) {
+                    findings.push({
+                        code: "test-path-outside-allowlist",
+                        taskId: owner.task.id,
+                        test: source.path,
+                        path,
+                        detail: `${source.path} owned by ${owner.task.id} references ${path} outside that task's files[] and context[]`,
+                    });
+                }
+            }
+        }
+    }
+    for (const reader of indexed) {
+        for (const entry of reader.task.context.map(normalize)) {
+            for (const owner of owners(entry)) {
+                if (owner.task.id === reader.task.id || dependencyOrdered(reader.task, owner.task, byId))
+                    continue;
+                findings.push({
+                    code: "unordered-context-write",
+                    taskId: reader.task.id,
+                    ownerTaskId: owner.task.id,
+                    path: entry,
+                    detail: `${reader.task.id} names ${entry} as context while ${owner.task.id} owns it for writing, with no dependency order between them`,
+                });
+            }
+        }
+    }
+    return findings.sort((a, b) => `${a.code}:${"test" in a ? a.test : a.path}:${"taskId" in a ? a.taskId : ""}`.localeCompare(`${b.code}:${"test" in b ? b.test : b.path}:${"taskId" in b ? b.taskId : ""}`));
+}
+export function renderOwnershipFinding(finding) {
+    return `tickmarkr: ownership-lint[${finding.code}]: ${finding.detail}`;
+}
+export function blocksCompile(finding) {
+    return finding.code === "unowned-test" && finding.corroboration !== undefined;
+}

package/dist/drivers/herdr.d.ts

@@ -125,6 +125,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
     reconcile(desired: Set<string>, runId: string, opts?: {
         spareLiveLlm?: boolean;
+        endedRunIds?: Set<string>;
     }): Promise<void>;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;
 }

package/dist/drivers/herdr.js

@@ -1188,12 +1188,13 @@ export class HerdrDriver {
             return s;
         });
     }
-    // OBS-17 T2 / v1.22b T1: close every tickmarkr-owned pane that should not exist (superseded attempts,
-    // killed-daemon orphans, leftovers from OLDER runs) — in this run's workspace OR misplaced in any
-    // other one — then reap the tabs those closes emptied. Ownership is decided ONLY by parseOwnedName
-    // (drivers/types.ts panesToClose) — foreign names never become candidates, in any workspace; a pane
-    // this same run legitimately holds elsewhere is left alone (only run age marks a misplaced pane
-    // garbage). spareLiveLlm: same-run judge/review/consult panes have no journal row while live (their
+    // OBS-17 T2 / v1.22b T1: close THIS RUN'S OWN tickmarkr-owned panes that should not exist
+    // (superseded attempts, killed-daemon orphans of this run), in this run's workspace, then reap the
+    // tabs those closes emptied. Ownership is decided ONLY by parseOwnedName (drivers/types.ts
+    // panesToClose) — foreign names never become candidates. OBS-769/OBS-772/OBS-777: the sweep does
+    // NOT reach other workspaces and reaches another runId only when the daemon's repository-scoped
+    // snapshot proves that run ended. Run age is not consulted and never was. spareLiveLlm: same-run
+    // judge/review/consult panes have no journal row while live (their
     // events land after the verdict is read), so mid-run sweeps spare them; boundary sweeps (start/
     // resume/end) run with nothing in flight and take them too. Cosmetic by contract: every failure —
     // herdr gone, pane vanished mid-sweep, unparseable listing — is swallowed; this method never throws.

package/dist/drivers/types.d.ts

@@ -56,6 +56,7 @@ export interface FleetAgent {
 }
 export declare function panesToClose(agents: FleetAgent[], desired: Set<string>, ws: string, runId: string, opts?: {
     spareLiveLlm?: boolean;
+    endedRunIds?: Set<string>;
 }): {
     paneId: string;
     tabId?: string;
@@ -81,5 +82,6 @@ export interface ExecutorDriver {
     narrator?: (cwd: string, command: string, runId?: string) => Promise<Slot>;
     reconcile?: (desired: Set<string>, runId: string, opts?: {
         spareLiveLlm?: boolean;
+        endedRunIds?: Set<string>;
     }) => Promise<void>;
 }

package/dist/drivers/types.js

@@ -21,12 +21,53 @@ export function isForeignName(name) {
     return parseOwnedName(name) === null;
 }
 // v1.22b T1: workspace-aware fold over a fleet snapshot — decides which owned task panes are garbage
-// right now. In-workspace: the existing desired-set/spareLiveLlm sweep (OBS-17 T2). Out-of-workspace:
-// an owned pane from a DIFFERENT run is a misplaced leftover (bug, foreign actor, pre-VIS-10 relic)
-// and closes regardless of `desired`; an owned pane from THIS run elsewhere is left alone — a live
-// run can legitimately hold panes across workspaces, so only run age marks a misplaced pane garbage.
+// right now: the desired-set/spareLiveLlm sweep (OBS-17 T2), scoped to THIS RUN'S OWN panes (by runId,
+// OBS-772) in THIS RUN'S OWN WORKSPACE (OBS-769). Both conditions, and neither alone is the rule.
 // Watch panes are operator-owned after run end and are reclaimed by the next run; foreign names
-// (parseOwnedName fails) are never candidates, in any workspace.
+// (parseOwnedName fails) are never candidates.
+//
+// OBS-769 — WHY THE SWEEP STOPS AT THE WORKSPACE BOUNDARY. It used to close an owned pane carrying
+// any OTHER runId in any other workspace, unconditionally, as a "misplaced leftover". Two tickmarkr
+// runs in two repositories are lawful (the lock forbids two runs in ONE repository, not on one
+// machine) and herdr gives each its own workspace — so that branch made every pair of concurrent
+// runs kill each other's LIVE workers. Measured 2026-08-28: the run in w0 closed run ...2958's
+// panes at 23:42:40.351/.392, and 53s later ...2958's own task-human sweep closed w0's live codex
+// worker at 23:43:34.096. ...2958 ended 0/8. The death detector cannot see it: closing the pane
+// makes paneAbsent, processTree, confirmedProcessTree and worktreeDelta true by ONE cause, and a
+// closed pane can never accrue the CPU that the `cpu-accruing` hold reads.
+// The comment this replaces claimed "only run age marks a misplaced pane garbage" — there was no age
+// check in the code, and age is the wrong predicate anyway: w0's run STARTED EARLIER than ...2958,
+// so an age rule would have licensed exactly the kill that landed. Run age says nothing about
+// liveness, and a sweeping daemon cannot read another repository's run state. The workspace is the
+// only ownership boundary available without cross-repo I/O, so it is the one enforced.
+// Cost, named: an orphan pane from a dead run stranded in a workspace no later run opens is now left
+// for the operator. That is cosmetic (`reconcile` is cosmetic by contract — "visibility is never a
+// gate"), and a cosmetic cleanup must never be able to kill a live worker.
+// OBS-772 — WHY THE runId LINE EXISTS, AND WHY THE WORKSPACE LINE ALONE WAS NOT THE FIX. The first
+// repair was workspace-scoped only, and its own comment dismissed the residue — "two runs sharing one
+// workspace would still sweep each other" — as unreachable, on the reasoning that one workspace per run
+// is herdr's placement. That reasoned from ONE driver to the whole product. OrcaDriver has no workspace
+// dimension at all: orca.ts passes a single ORCA_SPACE as the workspaceId for EVERY checkout and as
+// `ws`, so `workspaceId !== ws` is never true there and every foreign pane fell straight through. Orca
+// users had zero protection while the defect read as fixed. The runId line is the real rule and it is
+// driver-agnostic: reconcile exists to clean up THIS RUN's panes, and a leftover from a dead run is
+// exactly what cannot be told from a live run's pane without liveness data this process does not have.
+// Both lines are kept — the workspace line preserves the pre-existing sparing of this run's own panes
+// in another workspace, which the runId line alone would not.
+// ⚠ WHAT THE runId LINE COST BEFORE OBS-777 — SUSPENDED, NOT NARROWED, and the price was larger than
+// it read. Sparing every other runId suspended OBS-17's FOUNDING use case: "a killed daemon can't
+// close its slots". This sweep was built to reclaim exactly those orphans, but could not reclaim ANY
+// previous run's panes. Three separate pins asserted the old behaviour (reconcile.test.ts,
+// orca-placement.test.ts,
+// reconcile-live.test.ts); all three were changed deliberately, and the third is why this paragraph
+// exists rather than a shorter one — two flipped pins is a trade, three is a pattern.
+// OBS-777 RESTORES that reclamation: the CALLER passes `opts.endedRunIds`, a Set the daemon computes
+// ONCE at run start from this repository's own `run-end` journals and dead lock holders. This fold
+// stays pure — it gains one optional field, not a repo root — a foreign repository's runId is never
+// resolvable and so stays spared by construction, and no driver learns about workspaces.
+// ponytail: two conditions, no geometry reasoning, nothing driver-specific. `reconcile` is cosmetic by
+// contract, and a cosmetic cleanup must never be able to kill a live worker — which is why the
+// ended-run authority is the only safe way to restore the sweep without reviving the cross-run kill.
 export function panesToClose(agents, desired, ws, runId, opts) {
     const out = [];
     for (const a of agents) {
@@ -35,15 +76,14 @@ export function panesToClose(agents, desired, ws, runId, opts) {
         const owned = parseOwnedName(a.name);
         if (!owned || owned.role === "watch")
             continue;
-        if (a.workspaceId === ws) {
-            if (desired.has(a.name))
-                continue;
-            if (opts?.spareLiveLlm && owned.runId === runId && (owned.role === "judge" || owned.role === "review" || owned.role === "consult"))
-                continue;
-        }
-        else if (owned.runId === runId) {
-            continue; // this run's own pane in another workspace — never touched
-        }
+        if (owned.runId !== runId && !opts?.endedRunIds?.has(owned.runId))
+            continue;
+        if (a.workspaceId !== ws)
+            continue; // OBS-769: another workspace is another run's business
+        if (desired.has(a.name))
+            continue;
+        if (opts?.spareLiveLlm && owned.runId === runId && (owned.role === "judge" || owned.role === "review" || owned.role === "consult"))
+            continue;
         out.push({ paneId: a.paneId, tabId: a.tabId });
     }
     return out;

package/dist/gates/acceptance.d.ts

@@ -28,6 +28,19 @@ export interface VitestListedTest {
     file: string;
     projectName?: string;
 }
+export type VitestListResult = {
+    status: "listed";
+    tests: VitestListedTest[];
+} | {
+    status: "failed";
+    error: string;
+};
+export declare function listVitestTests(cwd: string): Promise<VitestListResult>;
+export interface NamedTestAudit {
+    criterion: string;
+    matches: VitestListedTest[];
+}
+export declare function auditNamedTestOracles(items: readonly AcceptanceItem[], listedTests: readonly VitestListedTest[]): NamedTestAudit[];
 export type AcceptanceCorpusAuditResult = {
     specPath: string;
     status: "parse-failed";

package/dist/gates/acceptance.js

@@ -98,6 +98,47 @@ export function testFiltered(testCmd, name) {
     const fwd = wrapped ? "-- " : "";
     return `${testCmd} ${fwd}-t ${shq(pattern)}`;
 }
+const VitestListedTestsSchema = z.array(z.object({
+    name: z.string(),
+    file: z.string(),
+    projectName: z.string().optional(),
+}));
+export async function listVitestTests(cwd) {
+    const result = await sh(`${shq(join(cwd, "node_modules/.bin/vitest"))} list --json`, cwd);
+    if (result.code !== 0) {
+        return { status: "failed", error: (result.stderr || result.stdout || `exit ${result.code}`).trim() };
+    }
+    try {
+        const start = result.stdout.indexOf("[");
+        if (start < 0)
+            return { status: "failed", error: "runner emitted no JSON test listing" };
+        const parsed = VitestListedTestsSchema.safeParse(JSON.parse(result.stdout.slice(start)));
+        return parsed.success
+            ? { status: "listed", tests: parsed.data }
+            : { status: "failed", error: z.prettifyError(parsed.error) };
+    }
+    catch (error) {
+        return { status: "failed", error: error instanceof Error ? error.message : String(error) };
+    }
+}
+export function auditNamedTestOracles(items, listedTests) {
+    const runnerNames = listedTests.map((listed) => ({
+        listed,
+        fullName: listed.name.split(" > ").join(" "),
+    }));
+    return items.flatMap((item) => {
+        if (typeof item !== "object" || item.oracle !== "test")
+            return [];
+        return [{
+                criterion: item.test,
+                // OBS-511: mirror the gate's leaf-anchored suffix rule — this denominator must count
+                // exactly the tests the shipped -t filter would select.
+                matches: runnerNames
+                    .filter(({ fullName }) => fullName === item.test || fullName.endsWith(` ${item.test}`))
+                    .map(({ listed }) => listed),
+            }];
+    });
+}
 function corpusSpecPaths(root) {
     const paths = [];
     const visit = (dir) => {
@@ -116,32 +157,18 @@ function corpusSpecPaths(root) {
 // listing. Every discovered path contributes either all parser-produced acceptance items or one named
 // parse failure; exceptions are evidence, never permission to shrink the corpus silently.
 export function auditAcceptanceCorpus(corpusRoot, listedTests) {
-    const runnerNames = listedTests.map((listed) => ({
-        listed,
-        fullName: listed.name.split(" > ").join(" "),
-    }));
     const results = [];
     for (const specPath of corpusSpecPaths(corpusRoot)) {
         try {
             const graph = compileNative(specPath);
             for (const task of graph.tasks) {
                 for (const item of task.acceptance) {
+                    const namedTest = auditNamedTestOracles([item], listedTests)[0];
                     results.push({
                         specPath,
                         status: "parsed",
                         item,
-                        ...(typeof item === "object" && item.oracle === "test"
-                            ? {
-                                namedTest: {
-                                    criterion: item.test,
-                                    // OBS-511: mirror the gate's leaf-anchored suffix rule — the audit's denominator
-                                    // must count exactly the tests the -t filter would select, or doctor and gate disagree.
-                                    matches: runnerNames
-                                        .filter(({ fullName }) => fullName === item.test || fullName.endsWith(` ${item.test}`))
-                                        .map(({ listed }) => listed),
-                                },
-                            }
-                            : {}),
+                        ...(namedTest ? { namedTest } : {}),
                     });
                 }
             }

package/dist/gates/baseline.js

@@ -117,7 +117,18 @@ const VOCAB_RE = /\b(?:error|fail(?:ed|ure|ing)?)\b/i;
 // shapes are emitted by the process that was asked to run the oracle; they are deliberately kept in
 // this runner-output classifier rather than applied to any judge-authored reason text. A real test
 // failure still dominates below because one regression-shaped line makes the whole output regression.
-const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable|Token not found in system keyring|Process from config\.webServer was not able to start|\[birpc\] rpc is closed, cannot call\b/i;
+// OBS-791: `[vitest-worker]: Timeout calling "<method>"` is the SAME birpc mechanism one layer up.
+// Vitest's bundled birpc has a fixed 60s DEFAULT_TIMEOUT with no override (fixed upstream only in
+// vitest 4.x), so a suite whose tests all pass can still die at teardown when the worker->host RPC
+// window closes. `.github/workflows/release.yml` has forgiven this exact fingerprint since 2026-08-11
+// while this classifier called it a regression — the product charged a worker for the failure the
+// release gate was written to forgive. The METHOD NAME IS DELIBERATELY NOT PINNED: the timeout is a
+// property of the RPC window, not of `onTaskUpdate`, and pinning one method would forgive a run and
+// charge its sibling for the same infrastructure event. This stays a CLOSED signature — the
+// `[vitest-worker]: ` prefix is vitest's own RPC layer and never user assertion text — and the
+// per-line vetoes below are untouched, so one real failure anywhere still makes the whole output a
+// regression.
+const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable|Token not found in system keyring|Process from config\.webServer was not able to start|\[birpc\] rpc is closed, cannot call\b|\[vitest-worker\]: Timeout calling\b/i;
 // Capture invalidation is deliberately narrower than the gate's infrastructure vocabulary above:
 // keyring/config-webServer startup failures remain gate concerns, while this policy is specifically
 // for evidence that the capture ran while the machine was resource-starved.