tickmarkr 2.3.0 → 2.4.1

package/dist/drivers/orca.d.ts

@@ -2,7 +2,7 @@ import { type ShResult } from "../run/git.js";
 import { type JournalEvent } from "../run/journal.js";
 import { type ExecutorDriver, type NotifyOpts, type Slot, type SlotOpts } from "./types.js";
 /** The response families the ONE shared envelope parser serves. There is no second JSON seam. */
-export declare const ORCA_RESPONSE_FAMILIES: readonly ["status", "create", "list", "read", "send", "wait", "show", "close", "worktree-current", "hooks-status"];
+export declare const ORCA_RESPONSE_FAMILIES: readonly ["status", "create", "list", "read", "send", "wait", "show", "close", "worktree-current", "worktree-set", "hooks-status"];
 export type OrcaFamily = (typeof ORCA_RESPONSE_FAMILIES)[number];
 export declare const ORCA_FIXTURE_VERSION = "1.4.195";
 export declare const ORCA_CLI_COMMAND_ENV = "ORCA_CLI_COMMAND";
@@ -15,6 +15,8 @@ export declare const NOT_WRITABLE_CODE = "terminal_not_writable";
 export declare const RUNNING_STATUS = "running";
 export declare const STATUS_GOVERNED_METHODS: readonly ["read", "waitOutput", "status", "waitAgentStatus"];
 export declare const WORKTREE_ADOPTION_TIMEOUT_MS = 60000;
+/** A missing slot gets the same bounded chance to appear as a reaped shell gets to settle. */
+export declare const PENDING_PROJECT_GRACE_MS = 2000;
 export interface OrcaExec {
     (args: string[], cwd: string, timeoutMs?: number): Promise<ShResult>;
 }
@@ -118,6 +120,8 @@ export declare class OrcaDriver implements ExecutorDriver {
     private journalRoots;
     private narrate?;
     private hookCoverage?;
+    private taskWorktrees;
+    private pendingProjects;
     constructor(opts?: OrcaDriverOpts);
     private call;
     /** The live runtime's identity, or an explicit failure. A missing or unreachable runtime is a
@@ -131,7 +135,13 @@ export declare class OrcaDriver implements ExecutorDriver {
     private state;
     private latched;
     private assertAvailable;
+    describe(slot: Slot): {
+        surface?: string;
+        hostPlatform?: string;
+    } | undefined;
     run(slot: Slot, cmd: string): Promise<void>;
+    private sendText;
+    private sendReceipt;
     private create;
     /**
      * A freshly-created git checkout does not become a valid Orca selector atomically. Ask
@@ -188,6 +198,11 @@ export declare class OrcaDriver implements ExecutorDriver {
      *  only after this method validates all four fields. Any malformed/refused wait remains explicit. */
     private waitCondition;
     waitAgentStatus(slot: Slot, status: string, timeoutMs: number): Promise<boolean>;
+    sendKey(slot: Slot, key: string): Promise<void>;
+    nudge(slot: Slot, message: string): Promise<boolean>;
+    narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
+    project(taskId: string, state: "in-progress" | "in-review" | "completed"): Promise<void>;
+    private setWorkspaceStatus;
     notify(msg: string, opts?: NotifyOpts): Promise<void>;
     narrateWith(narrate: (event: JournalEvent) => void): void;
     close(slot: Slot): Promise<void>;
@@ -208,6 +223,8 @@ export declare class OrcaDriver implements ExecutorDriver {
      * that still reports truncated at totalCount rows is a listing this sweep declines to judge on.
      */
     private listAll;
+    private openRunJournal;
+    private dropExpiredProjects;
     /**
      * Sweep tickmarkr-owned terminals down to `desired`. Ownership is decided ONLY by parseOwnedName
      * over the owned TAB title, through the same panesToClose fold herdr uses (drivers/types.ts): an

package/dist/drivers/orca.js

@@ -34,7 +34,7 @@ import { formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 /** The response families the ONE shared envelope parser serves. There is no second JSON seam. */
 export const ORCA_RESPONSE_FAMILIES = [
     "status", "create", "list", "read", "send", "wait", "show", "close",
-    "worktree-current", "hooks-status",
+    "worktree-current", "worktree-set", "hooks-status",
 ];
 export const ORCA_FIXTURE_VERSION = "1.4.195";
 export const ORCA_CLI_COMMAND_ENV = "ORCA_CLI_COMMAND";
@@ -57,6 +57,9 @@ const POLL_MS = 200;
 export const WORKTREE_ADOPTION_TIMEOUT_MS = 60_000;
 const WORKTREE_ADOPTION_POLL_MS = 1_000;
 const WORKTREE_ADOPTION_JOURNAL_MS = 2_000;
+const NUDGE_ECHO_TIMEOUT_MS = 2_000;
+/** A missing slot gets the same bounded chance to appear as a reaped shell gets to settle. */
+export const PENDING_PROJECT_GRACE_MS = 2_000;
 const SYSTEM_TIME = {
     now: () => Date.now(),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -262,6 +265,8 @@ export class OrcaDriver {
     journalRoots = new Map();
     narrate;
     hookCoverage;
+    taskWorktrees = new Map();
+    pendingProjects = new Map();
     constructor(opts = {}) {
         this.bin = opts.bin ?? resolveOrcaCliBinary(process.cwd(), { env: opts.env, platform: opts.platform }) ?? "orca";
         // Config values flow into a shell here: every argv element is quoted, always.
@@ -358,6 +363,15 @@ export class OrcaDriver {
         // receipt, relist, reconcile — is against THIS value.
         const worktree = canonicalWorktreePath(cwd);
         this.slots.set(id, { title, cwd: worktree, agent: opts?.agent, buf: "", recoveries: 0, recovering: false });
+        const owned = parseOwnedName(title);
+        if (owned?.role === "worker") {
+            this.taskWorktrees.set(owned.taskId, worktree);
+            const pending = this.pendingProjects.get(owned.taskId);
+            if (pending) {
+                await this.setWorkspaceStatus(worktree, pending.state);
+                this.pendingProjects.delete(owned.taskId);
+            }
+        }
         return { id, name: title, cwd: worktree, group: opts?.group };
     }
     /** Where to invoke the CLI for this slot's calls (see OrcaSlotState.dir). */
@@ -378,6 +392,17 @@ export class OrcaDriver {
         if (st.unavailable)
             throw new OrcaUnavailableError(family, st.unavailable, "");
     }
+    describe(slot) {
+        const st = this.state(slot);
+        // The daemon asks only after run(), but callers probing a lazy slot must see absence rather
+        // than an invented placement. The interface's object spread accepts this runtime absence.
+        if (!st.handle)
+            return undefined;
+        return {
+            ...(st.surface === undefined ? {} : { surface: st.surface }),
+            ...(st.hostPlatform === undefined ? {} : { hostPlatform: st.hostPlatform }),
+        };
+    }
     async run(slot, cmd) {
         const st = this.state(slot);
         if (!st.handle) {
@@ -387,22 +412,28 @@ export class OrcaDriver {
         this.assertAvailable("send", st);
         // Later deliveries go into the terminal this slot already owns — never a second create.
         // terminalOp proves the runtime binding before the handle goes on the wire.
-        const env = await this.terminalOp("send", st, (h) => this.call("send", ["terminal", "send", "--terminal", h, "--text", cmd, "--enter"], this.cliCwd(st)), { mutating: true });
-        // Recorded 1.4.186 send receipt: result.send = {handle, accepted, bytesWritten} — there is no
-        // `delivered`. `ok:true` alone is not a receipt: only an accepted receipt naming THIS handle
-        // proves the text was submitted, so anything else is a failed send, never a silent no-op.
+        await this.sendText(st, cmd);
+    }
+    async sendText(st, text) {
+        const env = await this.terminalOp("send", st, (h) => this.call("send", ["terminal", "send", "--terminal", h, "--text", text, "--enter"], this.cliCwd(st)), { mutating: true });
+        // Recorded 1.4.195 send receipt: result.send = {handle, accepted, bytesWritten}. `ok:true`
+        // alone is not delivery: the accepted receipt must name this handle and account for the bytes.
+        const receipt = this.sendReceipt(env, st);
+        const expectedBytes = Buffer.byteLength(text, "utf8") + 1;
+        if (receipt.accepted !== true || typeof receipt.bytesWritten !== "number" || receipt.bytesWritten !== expectedBytes) {
+            throw new OrcaError("send", `send receipt does not report expected byte delivery (accepted: ${JSON.stringify(receipt.accepted)}, bytesWritten: ${receipt.bytesWritten}, expected: ${expectedBytes})`, env.raw);
+        }
+    }
+    sendReceipt(env, st) {
         const receipt = env.result.send;
         if (typeof receipt !== "object" || receipt === null || Array.isArray(receipt)) {
             throw new OrcaError("send", "send response carries no send receipt", env.raw);
         }
-        const s = receipt;
-        if (str(s.handle) !== st.handle) {
-            throw new OrcaError("send", `send receipt names terminal ${str(s.handle) ?? "none"}, not the addressed ${st.handle}`, env.raw);
-        }
-        const expectedBytes = Buffer.byteLength(cmd, "utf8") + 1; // 1 for the --enter newline
-        if (s.accepted !== true || typeof s.bytesWritten !== "number" || s.bytesWritten !== expectedBytes) {
-            throw new OrcaError("send", `send receipt does not report expected byte delivery (accepted: ${JSON.stringify(s.accepted)}, bytesWritten: ${s.bytesWritten}, expected: ${expectedBytes})`, env.raw);
+        const parsed = receipt;
+        if (str(parsed.handle) !== st.handle) {
+            throw new OrcaError("send", `send receipt names terminal ${str(parsed.handle) ?? "none"}, not the addressed ${st.handle}`, env.raw);
         }
+        return parsed;
     }
     async create(st, cmd) {
         await this.probeRuntime(this.cliCwd(st));
@@ -435,9 +466,10 @@ export class OrcaDriver {
         st.handle = handle;
         // The handle is bound to the runtime identity that ANSWERED its create.
         st.runtimeId = env.runtimeId;
-        const surface = str(term.surface);
-        if (surface !== undefined && surface !== "visible") {
-            await this.notify(`tickmarkr orca terminal created on ${surface} surface`, { tier: "attention" });
+        st.surface = str(term.surface);
+        st.hostPlatform = str(term.hostPlatform);
+        if (st.surface !== undefined && st.surface !== "visible") {
+            await this.notify(`tickmarkr orca terminal created on ${st.surface} surface`, { tier: "attention" });
         }
     }
     /**
@@ -920,6 +952,75 @@ export class OrcaDriver {
             await this.time.sleep(Math.min(this.pollMs, left2));
         }
     }
+    async sendKey(slot, key) {
+        const st = this.state(slot);
+        this.assertAvailable("send", st);
+        if (key === "enter") {
+            await this.sendText(st, "");
+            return;
+        }
+        if (key === "ctrl+c") {
+            const env = await this.terminalOp("send", st, (h) => this.call("send", ["terminal", "send", "--terminal", h, "--interrupt"], this.cliCwd(st)), { mutating: true });
+            // UNRECORDED SHAPE: Orca 1.4.195 was not captured for `send --interrupt`. Until a live
+            // receipt exists, validate only the shared envelope and its handle binding; do not invent
+            // accepted/bytesWritten semantics for an interrupt.
+            this.sendReceipt(env, st);
+            return;
+        }
+        throw new OrcaError("send", `Orca has no terminal key verb for ${JSON.stringify(key)}`, "");
+    }
+    async nudge(slot, message) {
+        if (!message)
+            return false;
+        try {
+            const st = this.state(slot);
+            if (!await this.waitCondition(st, "tui-idle", 1))
+                return false;
+            // Drain to the current stream cursor before sending. A message already present makes the
+            // proof ambiguous, so decline rather than reporting delivery from old scrollback.
+            const before = await this.sweep(st);
+            if (before.includes(message) || joinWrapped(before).includes(message))
+                return false;
+            await this.sendText(st, message);
+            const deadline = this.time.now() + NUDGE_ECHO_TIMEOUT_MS;
+            for (;;) {
+                const after = await this.sweep(st);
+                if (after.includes(message) || joinWrapped(after).includes(message))
+                    return true;
+                const left = deadline - this.time.now();
+                if (left <= 0)
+                    return false;
+                await this.time.sleep(Math.min(this.pollMs, left));
+            }
+        }
+        catch {
+            return false;
+        }
+    }
+    async narrator(cwd, command, runId) {
+        if (!runId)
+            throw new OrcaError("create", "Orca narrator requires a run identity", "");
+        const slot = await this.slot(cwd, formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId }), { owned: { role: "watch", taskId: "run", attempt: 0, runId } });
+        await this.run(slot, command);
+        return slot;
+    }
+    async project(taskId, state) {
+        const worktree = this.taskWorktrees.get(taskId);
+        if (!worktree) {
+            // The daemon projects in-progress immediately before it creates the task checkout/slot.
+            // Hold only that latest state; slot() applies it once the task's own path is known.
+            this.pendingProjects.set(taskId, { state, since: this.time.now() });
+            return;
+        }
+        await this.setWorkspaceStatus(worktree, state);
+    }
+    async setWorkspaceStatus(worktree, state) {
+        // UNRECORDED SHAPE: no Orca 1.4.195 `worktree set` receipt was captured. The shared envelope
+        // parser is the complete success proof here; no result payload is assumed or fabricated.
+        await this.call("worktree-set", [
+            "worktree", "set", "--worktree", `path:${worktree}`, "--workspace-status", state,
+        ], worktree);
+    }
     async notify(msg, opts) {
         if (opts?.tier === "routine")
             return;
@@ -977,6 +1078,52 @@ export class OrcaDriver {
             throw new OrcaError("list", "terminal list is still truncated at totalCount rows", whole.raw);
         return whole;
     }
+    openRunJournal(runId) {
+        const roots = new Set(this.journalRoots.values());
+        roots.add(process.cwd());
+        for (const repoRoot of roots) {
+            try {
+                return Journal.open(repoRoot, runId, this.narrate);
+            }
+            catch {
+                /* try the next daemon-bound root */
+            }
+        }
+        return undefined;
+    }
+    // A projection exists only to bridge project() to the worker slot that follows it. After the
+    // grace, desired remains the dispatch oracle: a declared worker is still being placed and must
+    // keep its projection. Make genuine absence durable by appending first and deleting second; with
+    // no writable run journal the entry remains eligible for a later reconcile.
+    dropExpiredProjects(desired, runId) {
+        const now = this.time.now();
+        const desiredTasks = new Set();
+        for (const name of desired) {
+            const owned = parseOwnedName(name);
+            if (owned?.role === "worker")
+                desiredTasks.add(owned.taskId);
+        }
+        const expired = [...this.pendingProjects].filter(([, pending]) => now - pending.since > PENDING_PROJECT_GRACE_MS).filter(([taskId]) => !desiredTasks.has(taskId));
+        if (expired.length === 0)
+            return;
+        const journal = this.openRunJournal(runId);
+        if (!journal)
+            return;
+        for (const [taskId, pending] of expired) {
+            try {
+                const pendingMs = Math.max(0, now - pending.since);
+                journal.append("project-unplaced", taskId, {
+                    state: pending.state,
+                    pendingMs,
+                    graceMs: PENDING_PROJECT_GRACE_MS,
+                });
+                this.pendingProjects.delete(taskId);
+            }
+            catch {
+                /* reconcile is cosmetic; preserve the projection until a later journalled drop */
+            }
+        }
+    }
     /**
      * Sweep tickmarkr-owned terminals down to `desired`. Ownership is decided ONLY by parseOwnedName
      * over the owned TAB title, through the same panesToClose fold herdr uses (drivers/types.ts): an
@@ -992,6 +1139,7 @@ export class OrcaDriver {
      * Cosmetic by contract: every failure is swallowed, per candidate and overall.
      */
     async reconcile(desired, runId, opts) {
+        this.dropExpiredProjects(desired, runId);
         try {
             // Every call below is handle-addressed or explicitly selectored, so the CLI's own cwd selects
             // nothing — it only has to exist, which the checkouts being swept no longer need to.

package/dist/drivers/types.d.ts

@@ -66,9 +66,17 @@ export declare function panesToClose(agents: FleetAgent[], desired: Set<string>,
     tabId?: string;
 }[];
 export declare function canonicalizeLegacyName(name: string, runId: string): OwnedName;
+export interface SlotPlacement {
+    surface?: string;
+    hostPlatform?: string;
+}
 export interface ExecutorDriver {
     id: string;
     interactive: boolean;
+    /** The exact terminal read surface used for liveness evidence. */
+    readSource?: string;
+    /** Placement facts returned by drivers whose terminal host exposes them. */
+    describe?(slot: Slot): SlotPlacement | Promise<SlotPlacement> | undefined;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
     run(slot: Slot, cmd: string): Promise<void>;
     waitOutput(slot: Slot, pattern: string, timeoutMs: number, opts?: {
@@ -84,5 +92,7 @@ export interface ExecutorDriver {
     narrateWith?(narrate: (event: JournalEvent) => void): void;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;
     narrator?: (cwd: string, command: string, runId?: string) => Promise<Slot>;
+    /** Best-effort projection of a task's lifecycle onto the execution host. */
+    project?: (taskId: string, state: "in-progress" | "in-review" | "completed") => Promise<void>;
     reconcile?: (desired: Set<string>, runId: string, opts?: PanesToCloseOpts) => Promise<void>;
 }

package/dist/gates/baseline.d.ts

@@ -24,7 +24,9 @@ export interface BaselineCommand {
     fingerprints: string[];
     missingCommand?: boolean;
     /** Why a capture returned no verdict. */
-    invalidCause?: "ceiling-kill" | "resource-exhaustion";
+    invalidCause?: "ceiling-kill" | "resource-exhaustion" | "infra";
+    /** The runner's summary was green and only its teardown fingerprint followed. */
+    teardownFingerprint?: true;
     /** What this command actually took at capture, on a pristine tree. Absent in pre-v1.90 baselines. */
     durationMs?: number;
     /** Sum of the per-file durations named by the runner; null when its output names none. */
@@ -154,4 +156,26 @@ export declare function detectVacuousOracles(cwd: string, tasks: ReadonlyArray<{
     id: string;
     acceptance: AcceptanceItem[];
 }>): Promise<VacuousOracleWarning[]>;
-export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[]): Promise<GateResult[]>;
+export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[], opts?: {
+    rerunOf?: HostStarvedRerun;
+}): Promise<GateResult[]>;
+export interface HostStarvedRerun {
+    durationMs: number;
+    referenceMs: number;
+    waitedMs: number;
+}
+export type RunnerVerdict = FailureClassification | "green-teardown" | undefined;
+/** One interpretation of runner bytes, shared by baseline capture and every gate consumer. */
+export declare function classifyRunnerOutput(raw: string, code: number): RunnerVerdict;
+export declare const HOST_STARVED_DURATION_FACTOR = 2;
+/** Every fresh failure head is timeout-class and the suite took twice its own baseline measurement. */
+export declare function hostStarved(fresh: string, durationMs: number, referenceMs: number | undefined): boolean;
+interface CalmWindow {
+    pollMs: number;
+    maxWaitMs: number;
+    loadProvider: () => number;
+    calmLoad: () => number;
+}
+export declare function setCalmWindowForTests(over: Partial<CalmWindow>): void;
+export declare function resetCalmWindowForTests(): void;
+export {};

package/dist/gates/baseline.js

@@ -1,14 +1,24 @@
 import { existsSync, readFileSync } from "node:fs";
+import { availableParallelism, loadavg } from "node:os";
 import { join } from "node:path";
 import { DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 // incident #2 (run-20260709-104447): a vitest ✓ PASS line with "error" in the test NAME, wrapped in ANSI
 // codes that varied between baseline and worktree runs, was reported as a "new failure". Strip ANSI first;
 // a pass-marker line is never a failure. [\d;#] covers raw ANSI and digit-normalized ANSI ("\x1b[#m") from
 // baselines stored by pre-hardening code.
-const ANSI_RE = /\x1b\[[\d;#]*[A-Za-z]/g;
+// OBS-891 (run 3372): vitest toggles the cursor (`\x1b[?25l` / `\x1b[?25h`) around its progress
+// output, and the private-mode parameter byte `?` never matched [\d;#], so an echo-block HEADER glued
+// to a cursor-show sequence stayed invisible to withoutVitestEchoBlocks and its whole block leaked as
+// runner evidence — seven prose-only "infra" parks in one night. Full CSI grammar: parameter bytes
+// 0x30–0x3F (plus `#` for digit-normalized stored baselines), intermediates 0x20–0x2F, final 0x40–0x7E.
+const ANSI_RE = /\x1b\[[0-?#]*[ -/]*[@-~]/g;
 // ponytail: only leading ✓/✔ after optional "label:" prefixes (turbo/vitest), or tickmarkr's own run
 // summary, counts as a pass line — other runners' pass markers (PASS, ok) stay fingerprintable
 const PASS_LINE_RE = /^\s*(?:(?:[\w@./-]+:\s*)*[✓✔]|(?:\[tickmarkr\]\s+)?(?:tickmarkr\s+[\w.-]+:\s+)?(?:\d+|#)\s+done,\s+(?:\d+|#)\s+failed(?:,\s+(?:\d+|#)\s+awaiting human)?\b)/;
+// OBS-888: tickmarkr's own operator lines (`tickmarkr: baseline capture for "test" … spawn EAGAIN`)
+// are printed by this product, never by a runner about the work. When this repository's tests exercise
+// the capture path they print them too, carrying errno tokens INFRA_RE would read as host evidence.
+const OPERATOR_LINE_RE = /^\s*tickmarkr: /;
 // HYG-08 (D-01, incident run-20260711-154920): a failing test went unnamed for 3 attempts because details
 // headlined benign fingerprint-diff noise. These anchors harvest the runner's OWN failure naming from fresh
 // output to headline it. \s is fine in a TS regex — the BSD [[:space:]] rule binds shell grep only.
@@ -149,7 +159,10 @@ const isFingerprintShaped = (l) => isFailureShaped(l) || INFRA_RE.test(l);
  * unreadable-runner case the existing fail-closed path already owns.
  */
 export function classifyFailureOutput(output) {
-    const lines = output.split("\n").map((l) => l.replace(ANSI_RE, "")).filter((l) => !PASS_LINE_RE.test(l));
+    // OBS-891: the gate reads the WHOLE output here when the fresh-fingerprint diff is empty, so an errno
+    // token inside a test's echoed stdout/stderr block must be as invisible to this classifier as it is
+    // to fingerprint(): test-owned output is never runner evidence about the work.
+    const lines = withoutVitestEchoBlocks(output).map((l) => l.replace(ANSI_RE, "")).filter((l) => !PASS_LINE_RE.test(l) && !OPERATOR_LINE_RE.test(l));
     if (lines.some(namesRegression))
         return "regression";
     return lines.some(isInfraLine) ? "infra" : undefined;
@@ -161,7 +174,11 @@ export function classifyFailureOutput(output) {
  * no failure in that incomplete environment can safely become pre-existing forgiveness. Keep this
  * separate from `classifyFailureOutput` so changing capture policy cannot move gate verdicts.
  */
-const VITEST_ECHO_BLOCK_RE = /^\s*std(?:out|err)\s+\|\s+\S+\.(?:test|spec)\.[cm]?[jt]sx?\s+>\s+\S/;
+// OBS-888 row 1: vitest 3.2.7 heads an echo block `std{out,err} | <file> > <test>` when the log is
+// attributed to a test, `stderr | unknown test` when it is not, `stderr | <file>` for file-level output
+// and `stderr | <task id>` (digits and underscores) when the reporter no longer knows the task
+// (dist/chunks/index.*.js, `headerText`). The stripper knew only the first form.
+const VITEST_ECHO_BLOCK_RE = /^\s*std(?:out|err)\s+\|\s+(?:unknown test\s*$|\d+_[\d_]+\s*$|\S+\.(?:test|spec)\.[cm]?[jt]sx?(?:\s*$|\s+>\s+\S))/;
 /** Keep runner output while omitting Vitest's echoed test-owned stdout/stderr diagnostic blocks. */
 const withoutVitestEchoBlocks = (output) => {
     const outside = [];
@@ -186,7 +203,7 @@ const captureInvalidatingLines = (output) => {
     const invalidating = [];
     for (const line of withoutVitestEchoBlocks(output)) {
         const clean = line.replace(ANSI_RE, "");
-        if (!PASS_LINE_RE.test(clean) && CAPTURE_EXHAUSTION_RE.test(clean))
+        if (!PASS_LINE_RE.test(clean) && !OPERATOR_LINE_RE.test(clean) && CAPTURE_EXHAUSTION_RE.test(clean))
             invalidating.push(line);
     }
     return invalidating;
@@ -230,16 +247,18 @@ export const UNRECOGNIZED_FAILURE = "<unrecognized failure output>";
 export function fingerprint(output) {
     const lines = withoutVitestEchoBlocks(output)
         .map((l) => l.replace(ANSI_RE, ""))
-        .filter((l) => !PASS_LINE_RE.test(l));
+        .filter((l) => !PASS_LINE_RE.test(l) && !OPERATOR_LINE_RE.test(l));
     // GATE-FIX-4 DEFECT 4: every line is read twice — as printed, and with a turbo `<pkg>:<task>:`
     // prefix removed. A recognized stripped line fingerprints as its STRIPPED text, so the same
     // failure fingerprints identically whether turbo prefixed it or a bare runner printed it; the
     // prefixed form keeps fingerprinting too (baseline-recorded package-level reds stay forgivable).
     const shaped = [];
     for (const l of lines) {
+        const stripped = stripTurboPrefix(l);
+        if (stripped !== undefined && OPERATOR_LINE_RE.test(stripped))
+            continue; // OBS-888: operator prose under a turbo prefix
         if (isFingerprintShaped(l))
             shaped.push(l);
-        const stripped = stripTurboPrefix(l);
         if (stripped !== undefined && !PASS_LINE_RE.test(stripped) && isFingerprintShaped(stripped))
             shaped.push(stripped);
     }
@@ -483,11 +502,20 @@ export async function captureBaseline(cwd, commands) {
             base.commands[name] = invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines);
             continue;
         }
+        // OBS-885/887: capture and gate ask the same classifier. A green summary followed only by the
+        // teardown fingerprint is a pass; infrastructure without a summary is no verdict to forgive.
+        const runnerVerdict = classifyRunnerOutput(raw, r.code);
+        if (runnerVerdict === "infra") {
+            console.error(`tickmarkr: baseline capture for "${name}" carries runner-infrastructure evidence and no green summary — it recorded NO verdict; nothing is forgiven for this command`);
+            base.commands[name] = invalidCaptureEntry(durationMs, "infra");
+            continue;
+        }
         base.commands[name] = {
-            exitCode: r.code,
+            exitCode: runnerVerdict === "green-teardown" ? 0 : r.code,
+            ...(runnerVerdict === "green-teardown" ? { teardownFingerprint: true } : {}),
             // a command that exits 0 has no failures to fingerprint — recording any would be a lie the
             // compare step then has to forgive
-            fingerprints: r.code === 0 ? [] : fingerprint(raw),
+            fingerprints: r.code === 0 || runnerVerdict === "green-teardown" ? [] : fingerprint(raw),
             missingCommand: missingConfiguredCommand(cmd, r),
             durationMs,
             ...fileTiming(raw, durationMs),
@@ -552,8 +580,9 @@ function headlineDetails(raw, fresh) {
         meta: { failingTests: headlines.filter(namesFailureEitherForm) },
     };
 }
-export async function compareToBaseline(cwd, commands, baseline, enabled) {
+export async function compareToBaseline(cwd, commands, baseline, enabled, opts = {}) {
     const results = [];
+    const rerunOf = opts.rerunOf;
     for (const name of enabled) {
         const cmd = commands[name];
         if (!cmd) {
@@ -576,7 +605,14 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // result rather than re-derived after the fact. The skip row above ran no command and therefore
         // states no capacity — a row that never divided the machine must not claim that it did.
         const record = (g) => {
-            results.push(r.capacity ? { ...g, capacity: r.capacity } : g);
+            const withReap = r.reapedGroup ? { ...g, meta: { ...g.meta, reapedGroup: true } } : g;
+            const withReapError = r.reapError ? { ...withReap, meta: { ...withReap.meta, reapError: r.reapError } } : withReap;
+            const withRerun = rerunOf ? {
+                ...withReapError,
+                details: `host-starved rerun after waiting ${rerunOf.waitedMs}ms for a calm load window: ${withReapError.details}`,
+                meta: { ...withReapError.meta, hostStarvedRerun: rerunOf },
+            } : withReapError;
+            results.push(r.capacity ? { ...withRerun, capacity: r.capacity } : withRerun);
         };
         // …and whether the entry that would forgive this command was measured in the same world. A
         // baseline captured under a different fork cap forgives nothing: its fingerprints describe a
@@ -610,6 +646,12 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
             continue;
         }
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
+        // OBS-885/887: the same classifier the capture applied names a completed green suite on both sides.
+        const runnerVerdict = classifyRunnerOutput(raw, r.code);
+        if (runnerVerdict === "green-teardown") {
+            record({ gate: name, pass: true, details: `exit ${r.code} after a green suite summary; only the runner's teardown fingerprint followed it`, meta: { teardownFingerprint: true } });
+            continue;
+        }
         // OBS-278: only a failure SHAPE is a verdict — everything fingerprint() keeps is one, except the
         // unrecognized-output marker, which is evidence for the operator and never grounds to reject.
         // ponytail: ceiling — a runner whose failure output holds no shape above and whose baseline is
@@ -621,10 +663,20 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // T9: classify the FRESH diff before charging it. The complete runner output can legitimately
         // contain a baseline-recorded assertion beside a newly introduced infrastructure death; letting
         // that known assertion outvote the fresh birpc line turns machine failure into a worker defect.
-        // `classifyFailureOutput` remains the single discriminator. When there is no fresh fingerprint,
+        // `classifyRunnerOutput` remains the single discriminator. When there is no fresh fingerprint,
         // retain the whole-output read so a repeated infra abort can never be baseline-forgiven as green.
-        const freshClassification = failing.length ? classifyFailureOutput(failing.join("\n")) : undefined;
-        const classification = freshClassification ?? (!failing.length ? classifyFailureOutput(raw) : undefined);
+        const freshVerdict = failing.length ? classifyRunnerOutput(failing.join("\n"), r.code) : undefined;
+        const freshClassification = freshVerdict === "infra" || freshVerdict === "regression" ? freshVerdict : undefined;
+        const classification = freshClassification ?? (!failing.length && (runnerVerdict === "infra" || runnerVerdict === "regression") ? runnerVerdict : undefined);
+        // OBS-896: every fresh failure must be timeout-class, and the suite must take at least twice its
+        // own baseline measurement. The first read buys one calm rerun here, never a worker repair.
+        if (name === "test" && classification !== "infra" && failing.length && !rerunOf
+            && hostStarved(failing.join("\n"), r.durationMs ?? 0, entry?.durationMs)) {
+            const waitedMs = await waitForCalmWindow();
+            const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
+            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { rerunOf: provenance }));
+            continue;
+        }
         if (classification === "infra") {
             const evidence = failing.length
                 ? failing.slice(0, 10).join("\n")
@@ -689,3 +741,53 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
     }
     return results;
 }
+const SUMMARY_LINE_RE = /^[^\S\n]*Test Files[^\S\n]+(.+)$/m;
+const TEARDOWN_RE = /\[vitest-worker\]: Timeout calling\b|\[birpc\] rpc is closed, cannot call\b/;
+const UNHANDLED_HEADER_RE = /^\s*[^\w]*(?:Unhandled Errors|Uncaught Exception)\b/;
+/** One interpretation of runner bytes, shared by baseline capture and every gate consumer. */
+export function classifyRunnerOutput(raw, code) {
+    if (code === 0)
+        return undefined;
+    const lines = withoutVitestEchoBlocks(raw).map((l) => l.replace(ANSI_RE, ""));
+    const text = lines.join("\n");
+    const summary = SUMMARY_LINE_RE.exec(text);
+    if (summary) {
+        const failed = [...summary[1].matchAll(/\b(\d+)\s+failed\b/g)].map((match) => Number(match[1]));
+        const summaryGreen = failed.every((count) => count === 0);
+        const summaryLine = text.slice(0, summary.index).split("\n").length - 1;
+        const teardownLine = lines.findIndex((line, index) => index > summaryLine && TEARDOWN_RE.test(line));
+        const otherFailure = lines.some((line, index) => {
+            if (index === summaryLine || TEARDOWN_RE.test(line))
+                return false;
+            if (PASS_LINE_RE.test(line) || OPERATOR_LINE_RE.test(line))
+                return false;
+            if (index > summaryLine && UNHANDLED_HEADER_RE.test(line))
+                return false;
+            return namesRegression(line);
+        });
+        if (summaryGreen && teardownLine > summaryLine && !otherFailure)
+            return "green-teardown";
+    }
+    return classifyFailureOutput(text);
+}
+const TIMEOUT_CLASS_RE = /\b(?:Test|Hook) timed out in (?:\d+|#) ?ms\b|\bexceeded (?:\d+|#) ?(?:ms|s|seconds)\b|\btimed out after (?:\d+|#)/i;
+const ERROR_HEAD_RE = /^\s*(?:[A-Za-z][A-Za-z0-9]*Error|Error):\s/;
+export const HOST_STARVED_DURATION_FACTOR = 2;
+/** Every fresh failure head is timeout-class and the suite took twice its own baseline measurement. */
+export function hostStarved(fresh, durationMs, referenceMs) {
+    if (!referenceMs || durationMs < HOST_STARVED_DURATION_FACTOR * referenceMs)
+        return false;
+    const heads = fresh.split("\n").map((line) => line.replace(ANSI_RE, "")).filter((line) => ERROR_HEAD_RE.test(line));
+    return heads.length > 0 && heads.every((line) => TIMEOUT_CLASS_RE.test(line));
+}
+const DEFAULT_CALM = { pollMs: 5_000, maxWaitMs: 600_000, loadProvider: () => loadavg()[0] ?? 0, calmLoad: () => availableParallelism() / 2 };
+let calm = DEFAULT_CALM;
+export function setCalmWindowForTests(over) { calm = { ...calm, ...over }; }
+export function resetCalmWindowForTests() { calm = DEFAULT_CALM; }
+async function waitForCalmWindow() {
+    const started = Date.now();
+    while (calm.loadProvider() > calm.calmLoad() && Date.now() - started < calm.maxWaitMs) {
+        await new Promise((resolve) => setTimeout(resolve, calm.pollMs));
+    }
+    return Date.now() - started;
+}

package/dist/gates/review.d.ts

@@ -1,6 +1,7 @@
 import { type Assignment, type BillingChannel, type WorkerAdapter } from "../adapters/types.js";
 import { type TickmarkrConfig, type Tier } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
+import { modelProvider } from "../route/preference.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
 import { type VerdictUnparseableCause } from "./verdict-cause.js";
@@ -48,11 +49,12 @@ export declare function checkTaskDiffCaps(gate: string, measured: Pick<TaskDiffM
 export declare function isDiffCapPark(result: GateResult): boolean;
 export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
-/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
-export declare function modelProvider(model: string, fallback?: string): string;
+export { modelProvider };
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
-floor?: Tier): BillingChannel | null;
+floor?: Tier, // task-declared only; config floors govern workers and must not silently move review seats
+history?: string[], // run-scoped picks, oldest to newest; empty preserves the established ranking
+onSeat?: (seat: number) => void): BillingChannel | null;
 export type ReviewUnparseableCause = VerdictUnparseableCause;
 /**
  * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
@@ -60,4 +62,4 @@ export type ReviewUnparseableCause = VerdictUnparseableCause;
  * judgement rather than a guarantee made by this renderer.
  */
 export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
-export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string): Promise<GateResult>;
+export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[]): Promise<GateResult>;