tickmarkr 2.2.1 → 2.3.0

package/dist/run/daemon.js

@@ -23,9 +23,9 @@ import { GATE_NAMES } from "../graph/schema.js";
 import { distFingerprint } from "../cli/commands/version.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { runEnvironment } from "./environment.js";
-import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, sameCapacity, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, sameCapacity, sh, shGit, SUITE_PARENT_ENV, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, renderStructuredReviewFinding, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
@@ -69,12 +69,13 @@ export function resolveRunMode(repoRoot, opts = {}) {
     return { cfg: resolved.cfg, mode: resolved.mode, source, ...(conflict ? { conflict } : {}) };
 }
 // T14: the events that prove an approval was ENACTED — narrowly causal, never merely subsequent.
-// An ordinary approval (no release, attempt-cap, recheck, review-upheld) all buy a WORKER, so the
-// proof is a dispatch. Generic terminal events are deliberately NOT proof: an approved human-gate
+// Ordinary, attempt-cap and review-upheld approvals buy a WORKER, so their proof is a dispatch;
+// recheck has its own battery enactment below. Generic terminal events are deliberately NOT proof: an approved human-gate
 // task can fail in routing before task-dispatch, and the catch appends task-failed — treating that
 // as enactment reports "complete" over an approval that never ran (the exact silent-completion this
 // task exists to kill).
 const DISPATCH_ENACTMENT = new Set(["task-dispatch", "repair-dispatch"]);
+const RECHECK_ENACTMENT = "recheck-battery";
 // The ONE approval that enacts without buying a worker: GATE_SATISFIED_RELEASE resumes from the
 // persisted task branch after the approved gate (execTask's satisfiedGate branch), whose first act
 // for the task is worktree-recreation. That event is causal for this path, not incidental.
@@ -97,9 +98,13 @@ export function outstandingApprovals(events) {
         newest.set(e.taskId, i); });
     return [...newest]
         .filter(([taskId, i]) => {
-        const noWorker = events[i].data.release === GATE_SATISFIED_RELEASE;
+        const release = events[i].data.release;
+        const noWorker = release === GATE_SATISFIED_RELEASE;
+        const recheck = release === RECHECK_RELEASE;
         return !events.slice(i + 1).some((e) => e.taskId === taskId
-            && (DISPATCH_ENACTMENT.has(e.event) || (noWorker && e.event === GATE_SATISFIED_ENACTMENT)));
+            && (DISPATCH_ENACTMENT.has(e.event)
+                || (noWorker && e.event === GATE_SATISFIED_ENACTMENT)
+                || (recheck && e.event === RECHECK_ENACTMENT)));
     })
         .map(([taskId]) => taskId)
         .sort();
@@ -165,6 +170,19 @@ const isOracleFailure = (g) => g.details.startsWith("oracle failed:");
  */
 export const gateSatisfied = (g) => (g.pass || g.meta?.skipped === true) && g.meta?.infra !== true;
 const gateFailed = (g) => !gateSatisfied(g);
+const SIGNAL_EXIT_RE = /\b(?:SIGTERM|SIGKILL|signal\s+(?:9|15)|exit(?:s|ed|\s+code)?\s+(?:137|143))\b/i;
+const FAILURE_IDENTITY_RE = /\b(?:AssertionError|FAIL\s+\S|Tests?\s+\d+\s+failed|expected\s+.+\s+to\s+)\b/i;
+/** A signalled test runner with no failure identity produced no verdict about HEAD. Baseline owns the
+ * ordinary infra vocabulary; this daemon-only rider handles the signal-shaped non-verdict before its
+ * journal row and repair accounting are written. */
+function classifySignalOnlyTest(g) {
+    if (g.gate !== "test" || g.pass || g.meta?.infra === true || !SIGNAL_EXIT_RE.test(g.details))
+        return;
+    const named = Array.isArray(g.meta?.failingTests) && g.meta.failingTests.length > 0;
+    if (named || FAILURE_IDENTITY_RE.test(g.details))
+        return;
+    g.meta = { ...g.meta, classification: "infra", infra: true, retryable: false, kind: "signal-exit" };
+}
 // v1.85 T3: the gates whose failure IS a deterministic measurement — a machine re-ran a command over a
 // tree and printed the same bytes. Those are the failures the fingerprint cap governs (the ruling names
 // it a "deterministic-gate" cap): a third identical answer to a question already answered twice is the
@@ -270,6 +288,8 @@ function approvedReviewRoundCeiling(events, taskId) {
     return undefined;
 }
 const BLOCKED_POLL_MS = 30_000; // between trailer-wait slices, check whether the pane is blocked on a prompt
+export const SUITE_POLL_MS = 250;
+export const APPROVAL_POLL_MS = 250;
 const PROVIDER_DEATH_REQUEUE_CAP = 2; // v1.46 T1: requeue same assignment twice, then fall through to the normal ladder
 const PROVIDER_DEATH_BACKOFF_MS = 500; // short backoff before provider-death requeue
 const NO_TRAILER_DEMOTION_STREAK = 2; // OBS-57: consecutive no-trailer windows demote a channel for the rest of the run
@@ -558,6 +578,106 @@ async function observeWorkerProcessTree(marker, cwd) {
     }
     return tree.size === 0 ? "empty" : "running";
 }
+const SUITE_COMMAND_RE = /(?:^|[\s/])(vitest(?:\.mjs)?|jest|mocha)(?:[\s/]|$)|\bnpm(?:\s+run)?\s+test\b/i;
+function processCwd(pid) {
+    try {
+        return realpathSync(readlinkSync(`/proc/${pid}/cwd`));
+    }
+    catch { /* Darwin has no /proc */ }
+    try {
+        const out = execFileSync("lsof", ["-a", "-p", String(pid), "-d", "cwd", "-Fn"], {
+            encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000,
+        });
+        const path = out.split("\n").find((line) => line.startsWith("n"))?.slice(1);
+        return path ? realpathSync(path) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function processSuiteParent(pid) {
+    try {
+        const env = readFileSync(`/proc/${pid}/environ`, "utf8").split("\0");
+        const value = env.find((entry) => entry.startsWith(`${SUITE_PARENT_ENV}=`))?.slice(SUITE_PARENT_ENV.length + 1);
+        return value && /^\d+$/.test(value) ? Number(value) : undefined;
+    }
+    catch { /* Darwin has no /proc process environments */ }
+    try {
+        const out = execFileSync("ps", ["eww", "-p", String(pid), "-o", "command="], {
+            encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000,
+        });
+        const value = new RegExp(`(?:^|\\s)${SUITE_PARENT_ENV}=(\\d+)(?:\\s|$)`).exec(out)?.[1];
+        return value ? Number(value) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const pathAtOrBelow = (root, candidate) => {
+    const rel = relative(root, candidate);
+    return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+};
+/** Count full-suite roots in one process-table snapshot. The probes are arguments so the ownership
+ * rules remain testable on hosts that forbid process inspection; production supplies cwd and the
+ * inherited TICKMARKR_SUITE_PARENT marker from the process itself. */
+export function countLiveSuites(snapshot, repoRoot, daemonPid = process.pid, cwdForPid = processCwd, suiteParentForPid = processSuiteParent) {
+    const rows = [];
+    for (const line of snapshot.split("\n")) {
+        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        if (match && !match[3].startsWith("Z")) {
+            rows.push({ pid: Number(match[1]), ppid: Number(match[2]), command: match[4] });
+        }
+    }
+    const byPid = new Map(rows.map((row) => [row.pid, row]));
+    const ancestors = new Set();
+    for (let pid = daemonPid; pid && !ancestors.has(pid); pid = byPid.get(pid)?.ppid ?? 0)
+        ancestors.add(pid);
+    const descendants = new Set([daemonPid]);
+    for (let grew = true; grew;) {
+        grew = false;
+        for (const row of rows)
+            if (!descendants.has(row.pid) && descendants.has(row.ppid)) {
+                descendants.add(row.pid);
+                grew = true;
+            }
+    }
+    const root = realpathSync(repoRoot);
+    const candidates = rows.filter((row) => !ancestors.has(row.pid) && SUITE_COMMAND_RE.test(row.command));
+    const attributable = new Set(candidates.filter((row) => {
+        if (descendants.has(row.pid))
+            return true;
+        const cwd = cwdForPid(row.pid);
+        if (cwd !== undefined && pathAtOrBelow(root, cwd))
+            return true;
+        const suiteParent = suiteParentForPid(row.pid);
+        if (suiteParent === daemonPid)
+            return true;
+        const parentCwd = suiteParent === undefined ? undefined : cwdForPid(suiteParent);
+        return parentCwd !== undefined && pathAtOrBelow(root, parentCwd);
+    }).map((row) => row.pid));
+    // npm/npx + vitest + pool workers are one suite. Count only attributable suite processes with no
+    // attributable suite ancestor, while still following ordinary non-suite parents between them.
+    return [...attributable].filter((pid) => {
+        for (let parent = byPid.get(pid)?.ppid; parent; parent = byPid.get(parent)?.ppid) {
+            if (attributable.has(parent))
+                return false;
+        }
+        return true;
+    }).length;
+}
+let liveSuiteCountForTests;
+export const setLiveSuiteCountForTests = (probe) => {
+    liveSuiteCountForTests = probe;
+};
+export const resetLiveSuiteCountForTests = () => { liveSuiteCountForTests = undefined; };
+/** Live full-suite roots attributable to this repository or this daemon. Ancestors are excluded so
+ * a daemon invoked by vitest does not wait on its own test harness forever. */
+export async function liveSuiteCount(repoRoot) {
+    if (liveSuiteCountForTests)
+        return liveSuiteCountForTests(repoRoot);
+    const snapshot = await shGit("ps -Aww -o pid=,ppid=,state=,command=", repoRoot, 15_000);
+    return snapshot.code === 0 ? countLiveSuites(snapshot.stdout, repoRoot) : 0;
+}
 const OBSERVE_CHUNK_BYTES = 64 * 1024;
 const OBSERVE_BUDGET_BYTES = 256 * 1024 * 1024;
 let observeBudgetBytes = OBSERVE_BUDGET_BYTES;
@@ -1386,6 +1506,41 @@ export async function runDaemon(repoRoot, opts = {}) {
                 mergeChain = next.catch(() => undefined);
                 return next;
             };
+            // OBS-829/OBS-854: one full-suite verdict round at a time in this run, and do not begin beside an
+            // externally live suite attributable to this repository. The process scan catches nested scratch
+            // suites through daemon parentage even after cwd stops naming a worktree.
+            let suiteChain = Promise.resolve();
+            let suitePending = 0;
+            const withSuiteWindow = async (taskId, enabled, run) => {
+                if (!enabled)
+                    return run();
+                const previous = suiteChain;
+                let release;
+                suiteChain = new Promise((resolve) => { release = resolve; });
+                const queued = suitePending++ > 0;
+                if (queued) {
+                    const count = Math.max(1, await liveSuiteCount(repoRoot));
+                    journal.append("suite-wait", taskId, { count });
+                }
+                await previous;
+                try {
+                    let lastCount = -1;
+                    for (;;) {
+                        const count = await liveSuiteCount(repoRoot);
+                        if (count === 0)
+                            break;
+                        if (count !== lastCount)
+                            journal.append("suite-wait", taskId, { count });
+                        lastCount = count;
+                        await new Promise((wake) => setTimeout(wake, SUITE_POLL_MS));
+                    }
+                    return await run();
+                }
+                finally {
+                    suitePending--;
+                    release();
+                }
+            };
             // gateFails/consults are execTask-scoped counters passed in so a park row is a rich verified-failure
             // observation (e.g. ladder-exhausted + gateFails:4); every task-human row has a closed kind, never prose alone.
             const gateFailApprovalReason = (taskId, identity, includeUphold = false) => {
@@ -1853,21 +2008,24 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // contiguous green prefix whose recorded commit is still the task branch tip.
                 const satisfiedGate = satisfiedGates.get(t.id);
                 const replayedGates = replayedGateResults.get(t.id);
-                resumeGateReplay: if (satisfiedGate || replayedGates) {
+                const recheck = pendingRechecks(journal.read()).has(t.id);
+                resumeGateReplay: if (satisfiedGate || replayedGates || recheck) {
                     const taskBase = await integrationHead(intWt);
                     const taskBranch = `${branch}--${t.id}`;
                     const priorWt = worktreePath(repoRoot, taskBranch);
                     if (!existsSync(priorWt)) {
-                        if (satisfiedGate)
-                            throw new Error(`approved gate ${satisfiedGate} cannot resume: task worktree is missing`);
+                        if (satisfiedGate || recheck)
+                            throw new Error(`${recheck ? "recheck" : `approved gate ${satisfiedGate}`} cannot resume: task worktree is missing`);
                         // Observed passes are an optimization, never authority: without the task worktree there is no
                         // commit to compare and no landed work to gate, so fall through to the ordinary worker path.
                         replayedGateResults.delete(t.id);
                         break resumeGateReplay;
                     }
-                    const resumeReason = satisfiedGate
-                        ? `approved gate ${satisfiedGate}`
-                        : `recorded gates on ${replayedGates.commit.slice(0, 10)}`;
+                    const resumeReason = recheck
+                        ? "operator recheck"
+                        : satisfiedGate
+                            ? `approved gate ${satisfiedGate}`
+                            : `recorded gates on ${replayedGates.commit.slice(0, 10)}`;
                     const priorTaskTip = await gitHead(priorWt);
                     const priorTaskSubject = await gateCommitSubject(taskBase, priorTaskTip, priorWt);
                     const commitsToCarry = await commitsAheadOf(taskBase, priorWt);
@@ -1919,7 +2077,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             : [],
                         raw: "",
                     };
-                    const gateAuthor = rs?.lastAssignment ?? assignment;
+                    const parkedAuthor = recheck
+                        ? [...journal.read()].reverse().find((e) => e.event === "task-dispatch" && e.taskId === t.id)?.data.assignment
+                        : undefined;
+                    const gateAuthor = parkedAuthor ?? rs?.lastAssignment ?? assignment;
                     const satisfiedIndex = satisfiedGate ? GATE_NAMES.indexOf(satisfiedGate) : -1;
                     // The serial pipeline could have at most one blocking result, so "everything after the
                     // approved gate" was enough. v1.85 can record both verdict siblings red in one round, and a
@@ -1943,7 +2104,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         priorResults.set(e.data.gate, e);
                     }
                     let remainingGates;
-                    if (satisfiedGate) {
+                    if (recheck) {
+                        remainingGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
+                    }
+                    else if (satisfiedGate) {
                         remainingGates = t.gates.filter((gate) => {
                             if (gate === satisfiedGate)
                                 return false;
@@ -2001,10 +2165,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // This suffix is re-measured to decide whether resume may advance, but the interrupted
                             // attempt already paid for its red result. The next worker-backed round remains the next
                             // deterministic-fingerprint occurrence/review round for budget accounting.
-                            ...(!satisfiedGate ? { replayMeasurement: true } : {}),
+                            ...(!satisfiedGate && !recheck ? { replayMeasurement: true } : {}),
                         };
                         journal.phaseStart(t.id, "gates");
-                        const { results } = await runGates(resumedTask, {
+                        const { results } = await withSuiteWindow(t.id, resumedTask.gates.includes("test") && commands.test !== undefined, () => runGates(resumedTask, {
                             worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
                             commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                             collateral: collateral.get(t.id) ?? [],
@@ -2031,6 +2195,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     return;
                                 }
                                 const g = e.result;
+                                classifySignalOnlyTest(g);
                                 inParallelOrder(g.gate, () => {
                                     journalGateResult(g);
                                     noteReviewRetry(g);
@@ -2040,7 +2205,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                 });
                             },
-                        });
+                        }));
+                        results.forEach(classifySignalOnlyTest);
+                        if (pendingRechecks(journal.read()).has(t.id)) {
+                            journal.append("recheck-battery", t.id, {
+                                commit: gateSubject.commit,
+                                gates: resumedTask.gates,
+                                pass: results.every(gateSatisfied),
+                            });
+                        }
                         const approvedCommits = await commitsAheadOf(taskBase, wt);
                         graph = addEvidence(graph, t.id, { commits: approvedCommits, gateResults: results });
                         saveGraph(repoRoot, graph);
@@ -2375,7 +2548,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const adapter = getAdapter(assignment.adapter, adapters);
                     // VIS-04: workers share one role tab. T2: `owned` names the pane canonically (ownership contract);
                     // the legacy name stays the fallback for drivers without owned handling (subprocess spies).
-                    const slot = await trackedDriver.slot(wt, `${t.id}-worker-${assignment.adapter}-a${attempt}-${runTag}`, { group: "workers", owned: { role: "worker", taskId: t.id, attempt, runId } });
+                    const workerSlotOpts = {
+                        group: "workers",
+                        owned: { role: "worker", taskId: t.id, attempt, runId },
+                    };
+                    // Keep the established enumerable slot-options shape consumed by legacy drivers while making
+                    // the adapter hook available as an own request field to execution surfaces such as Orca.
+                    Object.defineProperty(workerSlotOpts, "agent", { value: assignment.adapter });
+                    const slot = await trackedDriver.slot(wt, `${t.id}-worker-${assignment.adapter}-a${attempt}-${runTag}`, workerSlotOpts);
                     const sessionId = retryMode === "resume" ? priorSession.id : slot.name;
                     const icmd = retryMode === "resume"
                         ? adapter.resumeCommand(sessionId, promptFile, assignment.model)
@@ -3478,6 +3658,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             return;
                         }
                         const g = e.result;
+                        classifySignalOnlyTest(g);
                         inParallelOrder(g.gate, () => {
                             // GATE-09 (ROADMAP SC-4): journal every judge retry as an attributable event — which gate flaked,
                             // which channel flaked, which channel retried — so `tickmarkr journal`/report can distinguish "judge
@@ -3510,7 +3691,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const gated = await gitHead(wt);
                         gateSubject = { commit: await gateCommitSubject(taskBase, gated, wt), attempt };
                         journal.phaseStart(t.id, "gates");
-                        ({ results, commits } = await runGates(t, {
+                        ({ results, commits } = await withSuiteWindow(t.id, t.gates.includes("test") && commands.test !== undefined, () => runGates(t, {
                             worktree: wt, baseRef: taskBase, result, author: assignment,
                             commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                             collateral: collateral.get(t.id) ?? [],
@@ -3533,7 +3714,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 : undefined,
                             excludeReviewers: badReviewers,
                             onGate,
-                        }));
+                        })));
+                        results.forEach(classifySignalOnlyTest);
                         graph = addEvidence(graph, t.id, { commits, gateResults: results, artifacts: [promptFile] });
                         saveGraph(repoRoot, graph);
                         if (results.some((g) => g.gate === "test" && !g.pass))
@@ -3630,6 +3812,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // failing gate, and `feedback` still carries every one of them to the next attempt.
                     const repairBattery = failing.some((g) => g.gate !== "review") ? failing.filter((g) => g.gate !== "review") : failing;
                     const repairable = narrowRepairBattery(repairBattery) && lostCommits.length === 0 && landed.length > 0;
+                    const repairHistory = repairReachSinceApproval(journal.read(), t.id);
                     const repairsDrawn = repairsSinceApproval(journal.read(), t.id);
                     const repair = repairable && repairsDrawn < MAX_REPAIRS;
                     // v1.85 T3: the fingerprint cap. Two normalized-identical failures of one DETERMINISTIC gate on
@@ -3699,13 +3882,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const repairExhausted = repairable && !repair;
                     if (repair && !capStep) {
                         journal.append("repair-attempt", t.id, {
-                            repair: repairsDrawn + 1, of: MAX_REPAIRS, gates: failing.map((g) => g.gate),
+                            repair: repairHistory.length + 1, charge: repairsDrawn + 1, of: MAX_REPAIRS,
+                            gates: failing.map((g) => g.gate),
                             commits: landed.length,
                             findings: feedback, // the failure bytes this repair must carry, replayable across a resume
                         });
                     }
                     else if (repairExhausted && !capStep) {
-                        journal.append("repair-exhausted", t.id, { repairs: repairsDrawn, of: MAX_REPAIRS, gates: failing.map((g) => g.gate) });
+                        journal.append("repair-exhausted", t.id, {
+                            repairs: repairsDrawn, of: MAX_REPAIRS, gates: failing.map((g) => g.gate),
+                            reached: repairHistory,
+                        });
                     }
                     const step = capStep ?? (repair || (reviewFixRetry && !repairExhausted)
                         ? "retry"
@@ -3714,7 +3901,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         journal.append("escalation", t.id, {
                             step, attempt: attempt + 1,
                             ...(reviewFixRetry && !repairExhausted ? { reviewFix: true } : {}),
-                            ...(repair ? { repair: repairsDrawn + 1 } : {}),
+                            ...(repair ? { repair: repairHistory.length + 1, repairCharge: repairsDrawn + 1 } : {}),
                         });
                         await driver.notify(`tickmarkr ${runId}: ${t.id} escalation: ${step}`, { tier: "attention" });
                     }
@@ -3769,7 +3956,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                 }
                 if (inflight.size === 0)
                     break;
-                await Promise.race([...inflight.values(), aborted]); // aborted rejects on termination — unwinds the run
+                const waiters = [...inflight.values(), aborted];
+                // A free slot is itself a scheduling boundary: poll the append-only approval stream instead of
+                // sleeping until an unrelated long-running task settles.
+                if (inflight.size < concurrency) {
+                    waiters.push(new Promise((wake) => setTimeout(wake, APPROVAL_POLL_MS)));
+                }
+                await Promise.race(waiters); // aborted rejects on termination — unwinds the run
             }
             // D-07: the sweep now closes only what's LEFT in keptSlots — done-closed worker slots were removed
             // (no double-close) and self-cleaned LLM/consult panes were never added under keepLlm:false. This
@@ -3794,7 +3987,7 @@ export async function runDaemon(repoRoot, opts = {}) {
             // OBS-34: post-merge integration-tip verify — strict exit codes, no baseline forgiveness.
             const lastMergedTask = [...journal.read()].reverse().find((e) => e.event === "merge" && e.taskId)?.taskId;
             if (summary.done.length > 0 && Object.keys(commands).length > 0) {
-                const tipFailed = await verifyIntegrationTipCached(intWt, commands, journal, { lastMergedTask, baseline });
+                const tipFailed = await withSuiteWindow(undefined, commands.test !== undefined, () => verifyIntegrationTipCached(intWt, commands, journal, { lastMergedTask, baseline }));
                 summary.tipVerify = tipFailed ? "failed" : "passed";
                 if (tipFailed && lastMergedTask)
                     summary.lastMergedTask = lastMergedTask;

package/dist/run/git.d.ts

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
 export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
+export declare const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
 export declare const DEFAULT_FORK_CAP = "6";
 /**
  * OBS-618: how many PROCESSES one vitest fork can hold at its peak — the fork, a daemon it spawns,

package/dist/run/git.js

@@ -13,6 +13,7 @@ export { ROUTING_ENV_SEAMS };
 // Default to a modest cap through the environment so vitest honors it natively; never pass it
 // as argv (OBS-55) so child test oracles stay intact. The operator's own export wins.
 export const FORK_CAP_ENV = "VITEST_MAX_FORKS";
+export const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
 export const DEFAULT_FORK_CAP = "6";
 /**
  * The fork budget belongs to ONE run: how many gate suites can be in flight at once is exactly that
@@ -150,6 +151,9 @@ function shell(cmd, cwd, timeoutMs, login) {
     // OBS-110: apply the run's own fork cap only when the operator has not already set one.
     if (!(FORK_CAP_ENV in env))
         env[FORK_CAP_ENV] = resolvedForkCap();
+    // OBS-854: descendants can leave the checkout (nested fixture suites do), so cwd alone cannot
+    // attribute them. Every daemon shell exports the daemon pid as their durable parentage marker.
+    env[SUITE_PARENT_ENV] = String(process.pid);
     // T7: the capacity every result of this shell carries, read HERE — off the environment the child
     // is about to receive, after the precedence above has settled. An operator export is already in
     // `env`, so what gets recorded is the operator's number, which is the case a release was re-taken

package/dist/run/journal.d.ts

@@ -116,8 +116,21 @@ export declare function formatPriorFindingEvidence(evidence: PriorFindingEvidenc
 export declare function normalizeGateFailure(details: string): string;
 export declare const GATE_FINGERPRINT_CAP = 2;
 export declare function identicalGateFailures(events: JournalEvent[], taskId: string, gate: string, normalized: string): number;
-/** Repair attempts this engagement has already funded — journal-derived, so a resume inherits it. */
+/** What each funded repair's next battery actually reached. A repair spends its budget only
+ * when that battery reaches one of the gates it was funded to fix; an earlier red is evidence that
+ * this repair never got its funded turn, not a charge against the repair ladder. */
+export interface RepairReach {
+    repair: number;
+    funded: string[];
+    reached: string[];
+    diedAt?: string;
+    charged: boolean;
+}
+export declare function repairReachSinceApproval(events: JournalEvent[], taskId: string): RepairReach[];
+/** Repair slots actually spent this engagement — journal-derived, so a resume inherits it. */
 export declare function repairsSinceApproval(events: JournalEvent[], taskId: string): number;
+/** Recheck releases not yet enacted by a battery (or by a legacy worker launch). */
+export declare function pendingRechecks(events: JournalEvent[]): Set<string>;
 /**
  * Why the last attempt failed, one row per journaled cause, in the daemon's own `source: details`
  * shape. The daemon builds that brief in a loop-local variable, which dies with the process: a resumed
@@ -242,9 +255,9 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     quotaFailover: z.ZodOptional<z.ZodLiteral<true>>;
     overrun: z.ZodOptional<z.ZodLiteral<true>>;
     retryMode: z.ZodOptional<z.ZodEnum<{
+        repair: "repair";
         resume: "resume";
         fresh: "fresh";
-        repair: "repair";
     }>>;
     signalQuality: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<0>, z.ZodLiteral<0.25>, z.ZodLiteral<0.5>, z.ZodLiteral<0.75>, z.ZodLiteral<1>]>>;
     signalBasis: z.ZodOptional<z.ZodEnum<{

package/dist/run/journal.js

@@ -72,8 +72,8 @@ export const REVIEW_UPHELD_RELEASE = "review-upheld";
 // OBS-203: the third decision a gate-fail park needs. Plain approve WAIVES the failed gate (and every
 // gate before it — daemon.ts remainingGates), which is wrong when the gate failed against a stale task
 // DECLARATION rather than a bad diff: amend the spec's files[], recompile, and the gate now passes
-// honestly. This release re-dispatches with the whole gate suite intact and no gate marked satisfied,
-// so the corrected declaration is the thing that earns the green. Budget semantics match attempt-cap
+// honestly. This release runs the whole gate suite over the parked commit before any worker and
+// marks no gate satisfied: green merges directly, red returns to the ladder. Budget semantics match attempt-cap
 // (fresh attempts, tried survives) because the park cost the task its remaining budget.
 export const RECHECK_RELEASE = "recheck";
 // OBS-738: one authority for every recovery surface. The ref is accepted only from the row that
@@ -547,18 +547,65 @@ export function identicalGateFailures(events, taskId, gate, normalized) {
     }
     return n;
 }
-/** Repair attempts this engagement has already funded — journal-derived, so a resume inherits it. */
-export function repairsSinceApproval(events, taskId) {
-    let n = 0;
+export function repairReachSinceApproval(events, taskId) {
+    const repairs = [];
     for (const e of events) {
         if (e.taskId !== taskId)
             continue;
-        if (e.event === "task-approved")
-            n = 0;
-        else if (e.event === "repair-attempt")
-            n++;
+        if (e.event === "task-approved") {
+            repairs.length = 0;
+        }
+        else if (e.event === "repair-attempt") {
+            const funded = Array.isArray(e.data.gates)
+                ? e.data.gates.filter((gate) => typeof gate === "string")
+                : [];
+            repairs.push({
+                repair: typeof e.data.repair === "number" ? e.data.repair : repairs.length + 1,
+                funded,
+                reached: [],
+                charged: false,
+                launched: false,
+                closed: false,
+            });
+        }
+        else {
+            const repair = repairs.at(-1);
+            if (!repair || repair.closed)
+                continue;
+            if (e.event === "worker-launch") {
+                if (repair.launched)
+                    repair.closed = true;
+                else
+                    repair.launched = true;
+            }
+            else if (repair.launched && e.event === "gate-result" && typeof e.data.gate === "string") {
+                if (!repair.reached.includes(e.data.gate))
+                    repair.reached.push(e.data.gate);
+                if (e.data.pass === false && repair.diedAt === undefined)
+                    repair.diedAt = e.data.gate;
+                if (repair.funded.includes(e.data.gate))
+                    repair.charged = true;
+            }
+        }
     }
-    return n;
+    return repairs.map(({ launched: _launched, closed: _closed, ...repair }) => repair);
+}
+/** Repair slots actually spent this engagement — journal-derived, so a resume inherits it. */
+export function repairsSinceApproval(events, taskId) {
+    return repairReachSinceApproval(events, taskId).filter((repair) => repair.charged).length;
+}
+/** Recheck releases not yet enacted by a battery (or by a legacy worker launch). */
+export function pendingRechecks(events) {
+    const pending = new Set();
+    for (const e of events) {
+        if (!e.taskId)
+            continue;
+        if (e.event === "task-approved" && e.data.release === RECHECK_RELEASE)
+            pending.add(e.taskId);
+        else if (e.event === "recheck-battery" || e.event === "worker-launch")
+            pending.delete(e.taskId);
+    }
+    return pending;
 }
 // Both retry decisions below govern exactly ONE dispatch: the next one. So both are read back from the
 // journal at the moment that dispatch is built, never carried in a process variable — a stop between
@@ -695,8 +742,19 @@ export function pendingRepairFindings(events, taskId) {
  * a channel it is no longer using, and a later unrelated failure is not parked under a stale reason.
  */
 export function activeRetryBan(events, taskId, channel) {
-    const e = decisionForNextDispatch(events, taskId, "gate-fingerprint-cap");
-    return e && e.data.channel === channel && typeof e.data.gate === "string" ? e.data.gate : undefined;
+    let pending;
+    for (const e of events) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "gate-fingerprint-cap")
+            pending = e;
+        else if (e.event === DECISION_SPENT
+            || (e.event === "task-approved" && e.data.release === RECHECK_RELEASE))
+            pending = undefined;
+    }
+    return pending && pending.data.channel === channel && typeof pending.data.gate === "string"
+        ? pending.data.gate
+        : undefined;
 }
 // Fail-closed shape for a dispatched assignment (journal.ts:75-90 posture): a malformed assignment in
 // one dispatch degrades that single task toward today's behavior — counts toward attempts, contributes

package/dist/run/supervision.d.ts

@@ -7,6 +7,12 @@ export declare const SUPERVISION_FUTURE_GRACE_MS = 1000;
 export declare const SUPERVISION_DEFAULT_THRESHOLD_PCT = 75;
 export declare const SUPERVISION_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch"];
 export type SupervisionTier = (typeof SUPERVISION_TIERS)[number];
+/**
+ * Resolve a one-shot supervision writer to the repository state it is claiming to supervise.
+ * The nearest state directory wins; reaching a git root without one is a refusal, not permission
+ * to create fresh state there or to wander into an enclosing repository. This function is read-only.
+ */
+export declare function resolveSupervisionRoot(cwd: string): string;
 export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context"];
 export type SeatTier = (typeof SUPERVISION_SEAT_TIERS)[number];
 /** Does this tier's record have to name the seat it speaks for? */

package/dist/run/supervision.js

@@ -1,6 +1,6 @@
 import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { stateDirName, tickmarkrDir } from "../graph/graph.js";
 // SUP-01: supervision liveness as FILE STATE, not as a report — lock.ts's proven shape, one file per
 // tier. A watcher beats its OWN file; every other seat derives that tier's state by stat()ing it. So
@@ -41,6 +41,34 @@ export const SUPERVISION_DEFAULT_THRESHOLD_PCT = 75;
 export const SUPERVISION_TIERS = [
     "orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch",
 ];
+const pathKind = (path) => {
+    try {
+        return statSync(path).isDirectory() ? "directory" : "present";
+    }
+    catch {
+        return "absent";
+    }
+};
+/**
+ * Resolve a one-shot supervision writer to the repository state it is claiming to supervise.
+ * The nearest state directory wins; reaching a git root without one is a refusal, not permission
+ * to create fresh state there or to wander into an enclosing repository. This function is read-only.
+ */
+export function resolveSupervisionRoot(cwd) {
+    let current = resolve(cwd);
+    for (;;) {
+        if (pathKind(join(current, stateDirName(current))) === "directory")
+            return current;
+        if (pathKind(join(current, ".git")) !== "absent") {
+            throw new Error(`missing ${stateDirName(current)}/ state dir at repository root ${current}`);
+        }
+        const parent = dirname(current);
+        if (parent === current) {
+            throw new Error(`missing ${stateDirName(current)}/ state dir — no tickmarkr repository found from ${resolve(cwd)}`);
+        }
+        current = parent;
+    }
+}
 // The tiers whose records must NAME the seat behind them. A one-shot `tickmarkr beat` records a pid
 // that has already exited by the time anyone reads it, and an instant — nothing a reader can attribute
 // to a seat. Measured 2026-08-26: a consult seat of another tier ran the documented beat loop and the