tickmarkr 2.2.1 → 2.4.0

package/dist/gates/baseline.js

@@ -5,10 +5,19 @@ import { DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "..
 // codes that varied between baseline and worktree runs, was reported as a "new failure". Strip ANSI first;
 // a pass-marker line is never a failure. [\d;#] covers raw ANSI and digit-normalized ANSI ("\x1b[#m") from
 // baselines stored by pre-hardening code.
-const ANSI_RE = /\x1b\[[\d;#]*[A-Za-z]/g;
+// OBS-891 (run 3372): vitest toggles the cursor (`\x1b[?25l` / `\x1b[?25h`) around its progress
+// output, and the private-mode parameter byte `?` never matched [\d;#], so an echo-block HEADER glued
+// to a cursor-show sequence stayed invisible to withoutVitestEchoBlocks and its whole block leaked as
+// runner evidence — seven prose-only "infra" parks in one night. Full CSI grammar: parameter bytes
+// 0x30–0x3F (plus `#` for digit-normalized stored baselines), intermediates 0x20–0x2F, final 0x40–0x7E.
+const ANSI_RE = /\x1b\[[0-?#]*[ -/]*[@-~]/g;
 // ponytail: only leading ✓/✔ after optional "label:" prefixes (turbo/vitest), or tickmarkr's own run
 // summary, counts as a pass line — other runners' pass markers (PASS, ok) stay fingerprintable
 const PASS_LINE_RE = /^\s*(?:(?:[\w@./-]+:\s*)*[✓✔]|(?:\[tickmarkr\]\s+)?(?:tickmarkr\s+[\w.-]+:\s+)?(?:\d+|#)\s+done,\s+(?:\d+|#)\s+failed(?:,\s+(?:\d+|#)\s+awaiting human)?\b)/;
+// OBS-888: tickmarkr's own operator lines (`tickmarkr: baseline capture for "test" … spawn EAGAIN`)
+// are printed by this product, never by a runner about the work. When this repository's tests exercise
+// the capture path they print them too, carrying errno tokens INFRA_RE would read as host evidence.
+const OPERATOR_LINE_RE = /^\s*tickmarkr: /;
 // HYG-08 (D-01, incident run-20260711-154920): a failing test went unnamed for 3 attempts because details
 // headlined benign fingerprint-diff noise. These anchors harvest the runner's OWN failure naming from fresh
 // output to headline it. \s is fine in a TS regex — the BSD [[:space:]] rule binds shell grep only.
@@ -149,7 +158,10 @@ const isFingerprintShaped = (l) => isFailureShaped(l) || INFRA_RE.test(l);
  * unreadable-runner case the existing fail-closed path already owns.
  */
 export function classifyFailureOutput(output) {
-    const lines = output.split("\n").map((l) => l.replace(ANSI_RE, "")).filter((l) => !PASS_LINE_RE.test(l));
+    // OBS-891: the gate reads the WHOLE output here when the fresh-fingerprint diff is empty, so an errno
+    // token inside a test's echoed stdout/stderr block must be as invisible to this classifier as it is
+    // to fingerprint(): test-owned output is never runner evidence about the work.
+    const lines = withoutVitestEchoBlocks(output).map((l) => l.replace(ANSI_RE, "")).filter((l) => !PASS_LINE_RE.test(l) && !OPERATOR_LINE_RE.test(l));
     if (lines.some(namesRegression))
         return "regression";
     return lines.some(isInfraLine) ? "infra" : undefined;
@@ -161,7 +173,11 @@ export function classifyFailureOutput(output) {
  * no failure in that incomplete environment can safely become pre-existing forgiveness. Keep this
  * separate from `classifyFailureOutput` so changing capture policy cannot move gate verdicts.
  */
-const VITEST_ECHO_BLOCK_RE = /^\s*std(?:out|err)\s+\|\s+\S+\.(?:test|spec)\.[cm]?[jt]sx?\s+>\s+\S/;
+// OBS-888 row 1: vitest 3.2.7 heads an echo block `std{out,err} | <file> > <test>` when the log is
+// attributed to a test, `stderr | unknown test` when it is not, `stderr | <file>` for file-level output
+// and `stderr | <task id>` (digits and underscores) when the reporter no longer knows the task
+// (dist/chunks/index.*.js, `headerText`). The stripper knew only the first form.
+const VITEST_ECHO_BLOCK_RE = /^\s*std(?:out|err)\s+\|\s+(?:unknown test\s*$|\d+_[\d_]+\s*$|\S+\.(?:test|spec)\.[cm]?[jt]sx?(?:\s*$|\s+>\s+\S))/;
 /** Keep runner output while omitting Vitest's echoed test-owned stdout/stderr diagnostic blocks. */
 const withoutVitestEchoBlocks = (output) => {
     const outside = [];
@@ -186,7 +202,7 @@ const captureInvalidatingLines = (output) => {
     const invalidating = [];
     for (const line of withoutVitestEchoBlocks(output)) {
         const clean = line.replace(ANSI_RE, "");
-        if (!PASS_LINE_RE.test(clean) && CAPTURE_EXHAUSTION_RE.test(clean))
+        if (!PASS_LINE_RE.test(clean) && !OPERATOR_LINE_RE.test(clean) && CAPTURE_EXHAUSTION_RE.test(clean))
             invalidating.push(line);
     }
     return invalidating;
@@ -230,16 +246,18 @@ export const UNRECOGNIZED_FAILURE = "<unrecognized failure output>";
 export function fingerprint(output) {
     const lines = withoutVitestEchoBlocks(output)
         .map((l) => l.replace(ANSI_RE, ""))
-        .filter((l) => !PASS_LINE_RE.test(l));
+        .filter((l) => !PASS_LINE_RE.test(l) && !OPERATOR_LINE_RE.test(l));
     // GATE-FIX-4 DEFECT 4: every line is read twice — as printed, and with a turbo `<pkg>:<task>:`
     // prefix removed. A recognized stripped line fingerprints as its STRIPPED text, so the same
     // failure fingerprints identically whether turbo prefixed it or a bare runner printed it; the
     // prefixed form keeps fingerprinting too (baseline-recorded package-level reds stay forgivable).
     const shaped = [];
     for (const l of lines) {
+        const stripped = stripTurboPrefix(l);
+        if (stripped !== undefined && OPERATOR_LINE_RE.test(stripped))
+            continue; // OBS-888: operator prose under a turbo prefix
         if (isFingerprintShaped(l))
             shaped.push(l);
-        const stripped = stripTurboPrefix(l);
         if (stripped !== undefined && !PASS_LINE_RE.test(stripped) && isFingerprintShaped(stripped))
             shaped.push(stripped);
     }
@@ -427,8 +445,9 @@ export function ceilingKillResult(gate, r, ceilingMs) {
  * shell asks it to finish faster than the thing it is measuring.
  */
 export const CAPTURE_CEILING_MS = 1_800_000;
-const invalidCaptureEntry = (durationMs, invalidatingLines = []) => ({
+const invalidCaptureEntry = (durationMs, invalidCause, invalidatingLines = []) => ({
     infra: true,
+    invalidCause,
     fingerprints: [],
     durationMs,
     fileDurationSumMs: null,
@@ -463,7 +482,7 @@ export async function captureBaseline(cwd, commands) {
             console.error(`tickmarkr: baseline capture for "${name}" was killed at its ${CAPTURE_CEILING_MS}ms ceiling — `
                 + `it recorded NO fingerprints, so nothing is forgiven and every gate will treat a pre-existing `
                 + `failure as a fresh one. Raise the ceiling or shorten the command.`);
-            base.commands[name] = invalidCaptureEntry(durationMs);
+            base.commands[name] = invalidCaptureEntry(durationMs, "ceiling-kill");
             continue;
         }
         const combinedOutput = r.stdout + "\n" + r.stderr;
@@ -479,7 +498,7 @@ export async function captureBaseline(cwd, commands) {
                 + `it recorded NO exit-code verdict and NO fingerprints, so nothing is forgiven for this command; `
                 + `the measurement cannot distinguish a pre-existing failure from one caused by exhaustion. `
                 + `First invalidating line: ${invalidatingLines[0]}`);
-            base.commands[name] = invalidCaptureEntry(durationMs, invalidatingLines);
+            base.commands[name] = invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines);
             continue;
         }
         base.commands[name] = {
@@ -575,7 +594,8 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // result rather than re-derived after the fact. The skip row above ran no command and therefore
         // states no capacity — a row that never divided the machine must not claim that it did.
         const record = (g) => {
-            results.push(r.capacity ? { ...g, capacity: r.capacity } : g);
+            const withReap = r.reapedGroup ? { ...g, meta: { ...g.meta, reapedGroup: true } } : g;
+            results.push(r.capacity ? { ...withReap, capacity: r.capacity } : withReap);
         };
         // …and whether the entry that would forgive this command was measured in the same world. A
         // baseline captured under a different fork cap forgives nothing: its fingerprints describe a
@@ -591,6 +611,19 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
             record(killed);
             continue;
         }
+        const runner = shellToken(cmd) ?? name;
+        if (entry?.missingCommand === true || r.code === 127) {
+            const cause = entry?.missingCommand === true && r.code !== 127
+                ? "the baseline capture recorded this runner as missing"
+                : `the head command exited 127${/\bENOENT\b/i.test(`${r.stdout}\n${r.stderr}`) ? " (spawn ENOENT)" : ""}`;
+            record({
+                gate: name,
+                pass: false,
+                details: `unreadable — ${cause}; runner ${JSON.stringify(runner)} did not produce a trustworthy verdict`,
+                meta: { unreadable: true, runner },
+            });
+            continue;
+        }
         if (r.code === 0) {
             record({ gate: name, pass: true, details: "exit 0" });
             continue;
@@ -629,8 +662,11 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // entries with no exitCode keep the `?? 1` red default both readers share (merge.ts:131).
         const baselineRed = entry?.infra !== true && (entry?.exitCode ?? 1) !== 0;
         if (!failing.length && !baselineRed) {
+            const recordedCause = entry?.invalidCause === "resource-exhaustion" || entry?.invalidatingLines?.length
+                ? `was invalidated by its recorded process/resource-exhaustion cause${entry.invalidatingLines?.[0] ? ` (${entry.invalidatingLines[0]})` : ""}`
+                : "was killed at its ceiling";
             const closed = entry?.infra === true
-                ? `the baseline capture for this command was killed at its ceiling and recorded no verdict, so nothing here is forgivable — it now exits ${r.code} with no recognizable failure lines — failing closed`
+                ? `the baseline capture for this command ${recordedCause} and recorded no verdict, so nothing here is forgivable — it now exits ${r.code} with no recognizable failure lines — failing closed`
                 : `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`;
             const evidence = unrecognizedEvidence(raw);
             record({

package/dist/gates/llm.d.ts

@@ -57,9 +57,15 @@ export declare function captureLlmOutput<T>(run: () => Promise<T>): Promise<{
     value: T;
     outputs: string[];
 }>;
+export interface LlmRunResult {
+    output: string;
+    exitCode?: number;
+    timedOut: boolean;
+}
 export declare function runHeadless(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, timeoutMs?: number): Promise<string>;
 export declare function runViaDriver(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function dewrapPaneVerdict(out: string, nonce: string): string;
+export declare function runLlmDetailed(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via?: LlmVia, timeoutMs?: number): Promise<LlmRunResult>;
 export declare function runLlm(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via?: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function extractJson<T>(raw: string): T | null;
 /** Fable F3: verdict JSON must echo the call nonce — skip unbound or mismatched objects. */

package/dist/gates/llm.js

@@ -129,21 +129,24 @@ export async function captureLlmOutput(run) {
     const value = await llmOutputCapture.run(outputs, run);
     return { value, outputs };
 }
-export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 300000) {
+async function runHeadlessDetailed(adapter, model, prompt, cwd, timeoutMs = 300000) {
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
     try {
         const pf = join(dir, "prompt.md");
         writeFileSync(pf, prompt);
         const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
-        return r.stdout + "\n" + r.stderr;
+        return { output: r.stdout + "\n" + r.stderr, exitCode: r.code, timedOut: r.timedOut === true };
     }
     finally {
         rmSync(dir, { recursive: true, force: true });
     }
 }
+export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 300000) {
+    return (await runHeadlessDetailed(adapter, model, prompt, cwd, timeoutMs)).output;
+}
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
 // as a visible named agent (herdr pane), with the quote-split completion wrapper.
-export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
+async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
     let slot;
     let accountant;
@@ -176,6 +179,7 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
         // false-complete — same guard the worker path uses (daemon.ts:330-331).
         const exitPattern = `TICKMARKR_EXIT_${nonce}:\\d`;
         let out;
+        let timedOut = false;
         const gatePrompt = prompt.startsWith("TICKMARKR-JUDGE") || prompt.startsWith("TICKMARKR-REVIEW");
         if (!gatePrompt) {
             await via.driver.waitOutput(slot, exitPattern, timeoutMs, { regex: true });
@@ -241,8 +245,14 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
                     break;
                 }
             }
+            timedOut = Date.now() - startedAt >= timeoutMs && !new RegExp(exitPattern).test(out);
         }
-        return dewrapPaneVerdict(out, nonce);
+        const exitCode = Number(new RegExp(`TICKMARKR_EXIT_${nonce}:(\\d+)`).exec(out)?.[1]);
+        return {
+            output: dewrapPaneVerdict(out, nonce),
+            ...(Number.isFinite(exitCode) ? { exitCode } : {}),
+            timedOut,
+        };
     }
     finally {
         try {
@@ -256,6 +266,9 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
         }
     }
 }
+export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
+    return (await runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs)).output;
+}
 // OBS-155: a TUI renders the verdict as a bullet and HARD-wraps it at pane width with a 2-space
 // continuation indent, splitting words mid-token — so literal newlines land inside JSON string
 // literals and ZERO lines begin with `{`. `--source recent-unwrapped` cannot undo it: the wrap is
@@ -315,12 +328,15 @@ export function dewrapPaneVerdict(out, nonce) {
     }
     return out;
 }
+export async function runLlmDetailed(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
+    const result = await (via
+        ? runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs)
+        : runHeadlessDetailed(adapter, model, prompt, cwd, timeoutMs));
+    llmOutputCapture.getStore()?.push(result.output);
+    return result;
+}
 export async function runLlm(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
-    const out = await (via
-        ? runViaDriver(adapter, model, prompt, cwd, via, timeoutMs)
-        : runHeadless(adapter, model, prompt, cwd, timeoutMs));
-    llmOutputCapture.getStore()?.push(out);
-    return out;
+    return (await runLlmDetailed(adapter, model, prompt, cwd, via, timeoutMs)).output;
 }
 export function extractJson(raw) {
     const fenced = [...raw.matchAll(/```json\s*\n([\s\S]*?)```/g)].at(-1);

package/dist/gates/review.d.ts

@@ -41,16 +41,20 @@ export type TaskDiffMeasurement = {
     readonly fullMeasurement: ArtifactDiffMeasurement;
     readonly capMeasurement: ArtifactDiffMeasurement;
 };
-export declare function fetchTaskDiff(worktree: string, baseRef: string): Promise<TaskDiffMeasurement>;
+export declare function fetchTaskDiff(worktree: string, baseRef: string, files?: readonly string[]): Promise<TaskDiffMeasurement>;
 export declare function checkDiffCap(gate: string, measured: number, cap: number, prefix?: string): GateResult | null;
 /** Apply the strict reviewable-logic cap and the finite, larger capture cap independently. */
 export declare function checkTaskDiffCaps(gate: string, measured: Pick<TaskDiffMeasurement, "logicBytes" | "captureBytes">, logicCap: number, prefix?: string): GateResult | null;
 export declare function isDiffCapPark(result: GateResult): boolean;
 export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
+/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
+export declare function modelProvider(model: string, fallback?: string): string;
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
-floor?: Tier): BillingChannel | null;
+floor?: Tier, // task-declared only; config floors govern workers and must not silently move review seats
+history?: string[], // run-scoped picks, oldest to newest; empty preserves the established ranking
+onSeat?: (seat: number) => void): BillingChannel | null;
 export type ReviewUnparseableCause = VerdictUnparseableCause;
 /**
  * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
@@ -58,4 +62,4 @@ export type ReviewUnparseableCause = VerdictUnparseableCause;
  * judgement rather than a guarantee made by this renderer.
  */
 export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
-export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string): Promise<GateResult>;
+export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[]): Promise<GateResult>;

package/dist/gates/review.js

@@ -2,12 +2,13 @@ import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { channelKey, shq } from "../adapters/types.js";
 import { criticalPathHits, DEFAULT_DIFF_CAP, DEFAULT_REVIEW_CRITICAL_PATHS, declaredReviewPolicy, isReviewLeafPath, raiseReviewPolicy, REVIEW_VERSION_MIRRORS, TIER_RANK, } from "../config/config.js";
+import { filesGlob } from "../graph/files-glob.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { redactSecrets } from "../run/redact.js";
 import { marginalCostRank } from "../route/router.js";
-import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlmDetailed, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
 import { captureDiffCapFor, measureArtifactDiff, reviewableLogicDiff, } from "./artifact-manifest.js";
 export { isProtectedEvidence, PROTECTED_EVIDENCE_PREFIXES, REGENERABLE_CAPTURE_PATHS, setAsideReceiptPath, setAsideRegenerableCaptures, } from "./artifact-manifest.js";
@@ -99,12 +100,14 @@ export async function mirrorsVersionOnly(worktree, baseRef, path) {
     const changed = diff.split("\n").filter((l) => /^[+-]/.test(l) && !/^(?:\+\+\+|---)/.test(l));
     return changed.length > 0 && changed.every((l) => VERSION_FIELD_LINE_RE.test(l));
 }
-export async function fetchTaskDiff(worktree, baseRef) {
+export async function fetchTaskDiff(worktree, baseRef, files = []) {
     // --full-index: abbreviated index lines vary with object-store density, so two measurements of
     // the same diff could disagree by a few bytes between invocations (CI-only red, release 1.89.0).
-    const [rawFull, rawForCap] = await Promise.all([
-        shOk(`git diff --full-index '${baseRef}..HEAD'`, worktree),
-        shOk(`git diff --full-index -U0 '${baseRef}..HEAD'`, worktree),
+    const matched = files.length ? (await changedPaths(worktree, baseRef)).filter(filesGlob([...files])) : [];
+    const pathspec = matched.length ? ` -- ${matched.map(shq).join(" ")}` : "";
+    const [rawFull, rawForCap] = files.length && matched.length === 0 ? ["", ""] : await Promise.all([
+        shOk(`git diff --full-index '${baseRef}..HEAD'${pathspec}`, worktree),
+        shOk(`git diff --full-index -U0 '${baseRef}..HEAD'${pathspec}`, worktree),
     ]);
     const fullMeasurement = measureArtifactDiff(rawFull);
     const capMeasurement = measureArtifactDiff(rawForCap);
@@ -162,6 +165,24 @@ export function diffCapParkReason(results) {
 export function modelId(model) {
     return model.slice(model.lastIndexOf("/") + 1);
 }
+/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
+export function modelProvider(model, fallback = "unknown") {
+    const id = model.toLowerCase();
+    const prefix = id.includes("/") ? id.slice(0, id.indexOf("/")) : "";
+    if (prefix === "openai" || prefix === "openai-codex" || /^(?:gpt|o\d)/.test(id))
+        return "openai";
+    if (prefix === "anthropic" || /^(?:claude|opus|sonnet|haiku|fable)(?:-|$)/.test(id))
+        return "anthropic";
+    if (prefix === "google" || /^gemini(?:-|$)/.test(id))
+        return "google";
+    if (prefix === "xai" || /^grok(?:-|$)/.test(id))
+        return "xai";
+    if (["zai", "zhipu", "zai-coding-plan"].includes(prefix) || /^glm(?:-|$)/.test(id))
+        return "zhipu";
+    if (["kimi-code", "moonshot"].includes(prefix) || /^kimi(?:-|$)/.test(id))
+        return "moonshot";
+    return fallback;
+}
 // v1.53 T2: same entry grammar as routing.map.prefer (router.ts preferIndex — router is out of this
 // module's dependency direction for a private fn, so the 3 lines live here too): `adapter` matches
 // every channel of that adapter, `adapter:model` exactly one; unmatched channels sort after all entries.
@@ -171,7 +192,9 @@ function reviewPreferIndex(c, prefer) {
 }
 export function pickReviewer(author, channels, exclude = [], // v1.1 failover: reviewer channels that already produced garbage for this task
 prefer = [], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
-floor) {
+floor, // task-declared only; config floors govern workers and must not silently move review seats
+history = [], // run-scoped picks, oldest to newest; empty preserves the established ranking
+onSeat) {
     // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
     // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
     // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
@@ -179,15 +202,23 @@ floor) {
     const authorChannel = channels.find((c) => c.adapter === author.adapter && c.model === author.model);
     if (!authorChannel)
         return null;
-    return (channels
+    const authorProvider = modelProvider(author.model, authorChannel.vendor);
+    const ranked = channels
         // two independent axes: different vendor AND different base-model identity (ADDED TO the vendor
-        // rule, never replacing it — a future edit can't silently drop either). The diversity filter runs
-        // BEFORE preference ranking: prefer sorts survivors only, so no entry can resurrect an excluded channel.
+        // rule, never replacing it — a future edit can't silently drop either). Failover additionally guards
+        // true provider identity; the initial pick keeps the established stamped-vendor contract. The diversity
+        // filter runs BEFORE preference ranking, so prefer cannot resurrect an excluded channel.
         .filter((c) => c.vendor !== authorChannel.vendor
+        && (exclude.length === 0 || modelProvider(c.model, c.vendor) !== authorProvider)
         && modelId(c.model) !== modelId(author.model)
         && !exclude.includes(channelKey(c))
         && (floor === undefined || TIER_RANK[c.tier] >= TIER_RANK[floor]))
-        .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
+        .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b));
+    const reviewer = [...ranked].sort((a, b) => history.lastIndexOf(channelKey(a)) - history.lastIndexOf(channelKey(b))
+        || ranked.indexOf(a) - ranked.indexOf(b))[0] ?? null;
+    if (reviewer)
+        onSeat?.(ranked.indexOf(reviewer) + 1);
+    return reviewer;
 }
 /**
  * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
@@ -205,7 +236,7 @@ ${files.map((path) => `- ${path}`).join("\n")}`;
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers, 
 // OBS-196: run dir for raw-output persistence on an unparseable verdict; absent (older callers,
 // direct tests) skips persistence and changes nothing else.
-artifactDir) {
+artifactDir, reviewHistory) {
     // R3 (OBS-186): participation is keyed on PATHS. The compiler's assignment comes from the DECLARED
     // files[]; the operator's floor may RAISE it to full and can never lower it. `complexityThreshold` is
     // retired — the branch that returned a green skip on a complexity comparison is gone, and with it the
@@ -277,7 +308,8 @@ artifactDir) {
     // A reviewer floor is opt-in at the task. Applying cfg.routing.floors here would change the
     // historical seat for every task that never asked for review-tier coupling.
     const reviewerFloor = task.routingHints?.floor;
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor);
+    let rotationSeat;
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined);
     if (!reviewer) {
         // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
         // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
@@ -285,10 +317,12 @@ artifactDir) {
             ? `no cross-vendor reviewer available at or above task-declared ${reviewerFloor} floor (diversity rule)`
             : "no cross-vendor reviewer available (diversity rule)";
         return cfg.review.required
-            ? { gate: "review", pass: false, details: `${reason}; set review.required:false to waive`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } }
+            ? { gate: "review", pass: false, details: `unreadable — ${reason}; set review.required:false to waive`, meta: { noEligibleReviewer: true, unreadable: true, ...(reviewerFloor ? { reviewerFloor } : {}) } }
             : { gate: "review", pass: true, details: `WARNING: ${reason} — review waived by config`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } };
     }
-    const measuredDiff = await fetchTaskDiff(worktree, baseRef);
+    reviewHistory?.push(channelKey(reviewer));
+    const rotationMeta = rotationSeat === undefined ? {} : { rotationSeat };
+    const measuredDiff = await fetchTaskDiff(worktree, baseRef, task.files);
     // Keep the reader payload identical to the text charged to the strict cap:
     // whole-file source deletions are represented by their citable operation fact.
     const diff = reviewableLogicDiff(measuredDiff.full);
@@ -327,7 +361,7 @@ Approve iff no material finding remains; an empty findings list is a clean appro
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
     let concludedOnInactivity = false;
-    const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? {
+    const llm = await runLlmDetailed(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? {
         driver: via.driver,
         keep: via.keep,
         onSlot: via.onSlot,
@@ -338,16 +372,17 @@ The top-level comments array is optional. Use it only for actionable line-anchor
     // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
     // output until completion — runLlm's 300s default killed reviews mid-flight, returning empty
     // stdout that read as "unparseable" and escalated to re-implementation of green code
-    // (run-20260709-104447 P87-09). ponytail: literal 15min; make it cfg.review.timeoutMs if a
-    // second knob-turner appears.
-    900_000);
+    // (run-20260709-104447 P87-09). The configured ceiling defaults to that measured 15 minutes.
+    cfg.review.timeoutMs);
+    const raw = llm.output;
+    const provider = modelProvider(reviewer.model, reviewer.vendor);
     const v = extractVerdictJson(raw, nonce);
     const findings = v && Array.isArray(v.findings) ? v.findings : null;
     // findings decides the verdict on its own; the legacy path still needs approve + issues to parse.
     if (!v || (findings === null && (typeof v.approve !== "boolean" || !Array.isArray(v.issues)))) {
         // OBS-196: name the cause and persist the raw bytes — a ruled-on "unparseable" without its
         // evidence cannot be audited, and a cutoff must never be indistinguishable from a parse defect.
-        const cause = classifyVerdictCause(raw, nonce, "approve");
+        const cause = classifyVerdictCause(raw, nonce, "approve", llm);
         const bytes = Buffer.byteLength(raw, "utf8");
         let saved;
         if (artifactDir) {
@@ -367,13 +402,17 @@ The top-level comments array is optional. Use it only for actionable line-anchor
         return {
             gate: "review",
             pass: false,
-            details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; cause: ${cause}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
+            details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: ${cause}${cause === "timeout" ? `; killed at configured review timeout ${cfg.review.timeoutMs}ms` : ""}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
             meta: {
                 ...policyMeta,
+                ...rotationMeta,
                 reviewer: channelKey(reviewer),
+                vendor: reviewer.vendor,
+                provider,
                 unparseable: true,
                 cause,
                 ...(cause === "empty-output" ? { bytes } : {}),
+                ...(cause === "timeout" ? { timeoutMs: cfg.review.timeoutMs } : {}),
                 ...(concludedOnInactivity ? { classification: "infra", infra: true } : {}),
             },
         };
@@ -381,11 +420,11 @@ The top-level comments array is optional. Use it only for actionable line-anchor
     const decided = findings !== null
         ? classifyReviewFindings(findings)
         : classifyReviewIssues(v.approve, v.issues);
-    const prose = `reviewer ${reviewer.adapter}:${reviewer.model} (${reviewer.vendor}): ${decided.headline}${decided.lines.length ? "\n" + decided.lines.join("\n") : ""}`;
+    const prose = `reviewer ${reviewer.adapter}:${reviewer.model} (vendor: ${reviewer.vendor}; provider: ${provider}): ${decided.headline}${decided.lines.length ? "\n" + decided.lines.join("\n") : ""}`;
     return {
         gate: "review",
         pass: decided.pass,
         details: appendAnchoredReview(prose, v),
-        meta: { ...policyMeta, reviewer: channelKey(reviewer) },
+        meta: { ...policyMeta, ...rotationMeta, reviewer: channelKey(reviewer), vendor: reviewer.vendor, provider },
     };
 }

package/dist/gates/run-gates.d.ts

@@ -13,13 +13,15 @@ export declare function resetLoadProviderForTests(): void;
  * intervals and nothing between them, so the composite `test` gate (a selected screen, then other
  * gates, then the full suite) reports the two suites' cost rather than the span containing them —
  * and no consumer has to re-derive a duration by subtracting journal timestamps, which measures the
- * queue as well as the work. The load samples bracket the FIRST interval's start and the LAST
- * interval's end: start is what a scheduler would have decided on, end is the state it left behind.
+ * queue as well as the work. Load is sampled at each interval's endpoints and every second within it;
+ * start preserves the scheduling input while max and mean retain sustained interior saturation.
  */
 export interface GateTelemetry {
     durationMs: number;
     load1Start: number;
     load1End: number;
+    load1Max: number;
+    load1Mean: number;
 }
 export type GateEvent = {
     phase: "start";
@@ -51,6 +53,7 @@ export interface GateContext {
     cfg: TickmarkrConfig;
     via?: GateVia;
     excludeReviewers?: string[];
+    reviewHistory?: string[];
     artifactDir?: string;
     pipeline?: "v185" | "legacy";
     selectTests?: boolean;