tickmarkr 2.3.0 → 2.4.1

package/dist/run/daemon.js

@@ -4,6 +4,7 @@ import { shq } from "../adapters/types.js";
 import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, readSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 import { stringify } from "yaml";
 import { classifyDeadChannel, NO_TRAILER_SUMMARY, trailerPattern, UNPARSEABLE_TRAILER_SUMMARY, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, getAdapter, probeAll, readDoctor, rolePools } from "../adapters/registry.js";
@@ -13,7 +14,7 @@ import { collateralHits } from "../compile/collateral.js";
 import { DEFAULT_DIFF_CAP, globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
 import { DeliveryReadinessError } from "../drivers/herdr.js";
 import { driverEvidence } from "../drivers/index.js";
-import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
+import { herdrSealShellPrefix, MAX_BUF, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
@@ -74,7 +75,7 @@ export function resolveRunMode(repoRoot, opts = {}) {
 // task can fail in routing before task-dispatch, and the catch appends task-failed — treating that
 // as enactment reports "complete" over an approval that never ran (the exact silent-completion this
 // task exists to kill).
-const DISPATCH_ENACTMENT = new Set(["task-dispatch", "repair-dispatch"]);
+const DISPATCH_ENACTMENT = new Set(["task-dispatch", "repair-dispatch", "resume-restore"]);
 const RECHECK_ENACTMENT = "recheck-battery";
 // The ONE approval that enacts without buying a worker: GATE_SATISFIED_RELEASE resumes from the
 // persisted task branch after the approved gate (execTask's satisfiedGate branch), whose first act
@@ -137,7 +138,8 @@ export function formatSummary(s) {
  *  run id (cli/commands/status.ts positionalRunId), so naming it here is what stops the board from
  *  following the newest journal in a repo that already carries a second, newer run — a board showing
  *  the wrong run is a recorded incident (skills/tickmarkr-overseer/SKILL.md). */
-export const watchCommand = (runId) => `tickmarkr status --watch ${runId}`;
+export const daemonEntrypoint = fileURLToPath(new URL("../cli/index.js", import.meta.url));
+export const watchCommand = (runId) => `${shq(process.execPath)} ${shq(daemonEntrypoint)} status --watch ${shq(runId)}`;
 const MAX_ATTEMPTS = 10; // ponytail: hard cap so a pathological ladder can never loop forever
 // v1.85 T3 (retry economics): two repairs per engagement, then the fresh ladder. A repair re-uses the
 // findings and the landed diff instead of re-buying onboarding; when two of them have not closed the
@@ -213,7 +215,7 @@ function narrowRepairBattery(failing) {
 }
 // v2.0 T2 (OBS-554): the measurement keys run-gates stamps on a GateResult, lifted verbatim onto the
 // gate row. One list, one lift — both onGate sites record through the same helper.
-const GATE_TELEMETRY_KEYS = ["durationMs", "load1Start", "load1End", "selectedDurationMs", "fullDurationMs", "invocations"];
+const GATE_TELEMETRY_KEYS = ["durationMs", "load1Start", "load1End", "load1Max", "load1Mean", "selectedDurationMs", "fullDurationMs", "invocations"];
 const gateMeasurement = (meta = {}) => Object.fromEntries(GATE_TELEMETRY_KEYS.filter((k) => meta[k] !== undefined).map((k) => [k, meta[k]]));
 /**
  * T4 (OBS-265): the journal with the review objections a round did NOT hinge on removed. Judge and
@@ -289,6 +291,11 @@ function approvedReviewRoundCeiling(events, taskId) {
 }
 const BLOCKED_POLL_MS = 30_000; // between trailer-wait slices, check whether the pane is blocked on a prompt
 export const SUITE_POLL_MS = 250;
+// ponytail: one fixed ceiling on the live-suite wait; the baseline's test ceilingMs is the upgrade path
+export const SUITE_WAIT_CEILING_MS = 600_000;
+let suiteWaitCeilingMs = SUITE_WAIT_CEILING_MS;
+export const setSuiteWaitCeilingForTests = (ms) => { suiteWaitCeilingMs = ms; };
+export const resetSuiteWaitCeilingForTests = () => { suiteWaitCeilingMs = SUITE_WAIT_CEILING_MS; };
 export const APPROVAL_POLL_MS = 250;
 const PROVIDER_DEATH_REQUEUE_CAP = 2; // v1.46 T1: requeue same assignment twice, then fall through to the normal ladder
 const PROVIDER_DEATH_BACKOFF_MS = 500; // short backoff before provider-death requeue
@@ -339,6 +346,49 @@ export function resetNudgeTimingForTests() {
 // diff merely quotes "rate limit" keeps working undisturbed).
 const QUOTA_BANNER_SILENT_MS = 3 * 60_000;
 let quotaBannerSilentMs = QUOTA_BANNER_SILENT_MS;
+const WORKER_STARTUP_FAILURE_RE = /(?:not logged in|authentication(?:[ _-](?:required|failed|error))|401 unauthorized|model[_ -]?not[_ -]?found|(?:model|deployment)[^\n]{0,80}(?:not found|does not exist|is unavailable)|(?:404|not[_ -]?found)[^\n]{0,80}(?:model|deployment))/i;
+// A startup banner is evidence only while the process is starting. Applying this matcher to every
+// later poll let ordinary worker prose (including a diff that mentions model-not-found handling)
+// condemn a live attempt. Bound both dimensions: time prevents a late line from becoming startup
+// evidence, and bytes prevent a chatty launch from keeping an ever-growing classification surface.
+export const WORKER_STARTUP_WINDOW_MS = EARLY_LAUNCH_LIVENESS_MS;
+export const WORKER_STARTUP_WINDOW_BYTES = 64 * 1024;
+let workerStartupWindowMs = WORKER_STARTUP_WINDOW_MS;
+/** Test seam — exercises both sides of the startup boundary without a production-length fixture. */
+export function setWorkerStartupWindowMsForTests(ms) {
+    workerStartupWindowMs = ms;
+}
+export function resetWorkerStartupWindowMsForTests() {
+    workerStartupWindowMs = WORKER_STARTUP_WINDOW_MS;
+}
+function startupFailureInWindow(output, launchedAt) {
+    if (launchedAt === undefined || Date.now() - launchedAt > workerStartupWindowMs)
+        return false;
+    const bytes = Buffer.from(output);
+    const bounded = bytes.length <= WORKER_STARTUP_WINDOW_BYTES
+        ? output
+        : bytes.subarray(0, WORKER_STARTUP_WINDOW_BYTES).toString("utf8");
+    return WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(bounded));
+}
+// OBS-901/906: one daemon-owned writer for every execution surface. Drivers expose one retained
+// stream through read(); the daemon persists that exact surface before any close/reconcile can make
+// it disappear. MAX_BUF is the execution layer's existing two-MiB retention contract; truncate the
+// encoded bytes from the head so the completion/error tail is always the part that survives.
+async function captureWorkerStream(journalDir, taskId, attempt, driver, slot, fallback) {
+    let captured = fallback;
+    try {
+        captured = await driver.read(slot, PANE_READ_ROWS);
+    }
+    catch {
+        // Earlier successful reads are still a captured stream. Persist them rather than losing the
+        // only failure evidence because the pane vanished between its terminal read and this snapshot.
+    }
+    const bytes = Buffer.from(captured);
+    const tail = bytes.length > MAX_BUF ? bytes.subarray(bytes.length - MAX_BUF) : bytes;
+    const path = posix.join("prompts", `${taskId}-a${attempt}.out`);
+    writeFileSync(join(journalDir, path), tail);
+    return { path, output: captured };
+}
 /** Test seam — shrink the quota-banner silence gate without minute-long sleeps. */
 export function setQuotaBannerSilentMsForTests(ms) {
     quotaBannerSilentMs = ms;
@@ -642,7 +692,11 @@ export function countLiveSuites(snapshot, repoRoot, daemonPid = process.pid, cwd
             }
     }
     const root = realpathSync(repoRoot);
-    const candidates = rows.filter((row) => !ancestors.has(row.pid) && SUITE_COMMAND_RE.test(row.command));
+    // OBS-889 (run 3372): a bare-codex worker carries its whole prompt in argv and the prompt names the
+    // runner ("…as a vitest test whose…"), so a finished interactive worker counted as a live suite and
+    // held a task's gates for 9 min 46 s. A runner is named in a command's HEAD — `node <bin>`,
+    // `npm test`, `npx vitest`, `sh -c npm test` — never 140 KB into it: read the first four tokens only.
+    const candidates = rows.filter((row) => !ancestors.has(row.pid) && SUITE_COMMAND_RE.test(row.command.split(/\s+/, 4).join(" ")));
     const attributable = new Set(candidates.filter((row) => {
         if (descendants.has(row.pid))
             return true;
@@ -1219,6 +1273,8 @@ export async function runDaemon(repoRoot, opts = {}) {
             const trackedDriver = {
                 id: driver.id,
                 interactive: driver.interactive,
+                ...(driver.readSource ? { readSource: driver.readSource } : {}),
+                ...(driver.describe ? { describe: driver.describe.bind(driver) } : {}),
                 slot: async (cwd, name, o) => { const s = await driver.slot(cwd, name, o); liveSlots.add(s); return s; },
                 run: (s, cmd) => driver.run(s, cmd),
                 waitOutput: (s, p, ms, o) => driver.waitOutput(s, p, ms, o),
@@ -1227,10 +1283,25 @@ export async function runDaemon(repoRoot, opts = {}) {
                 read: (s, n) => driver.read(s, n),
                 ...(driver.sendKey ? { sendKey: driver.sendKey.bind(driver) } : {}),
                 ...(driver.nudge ? { nudge: driver.nudge.bind(driver) } : {}),
+                ...(driver.narrator ? { narrator: async (cwd, command, id) => {
+                        const s = await driver.narrator(cwd, command, id);
+                        liveSlots.add(s);
+                        return s;
+                    } } : {}),
+                ...(driver.project ? { project: driver.project.bind(driver) } : {}),
+                ...(driver.reconcile ? { reconcile: driver.reconcile.bind(driver) } : {}),
                 notify: (m, o) => driver.notify(m, o),
                 close: closeSlot,
                 worktree: (r, b, base) => driver.worktree(r, b, base),
             };
+            const absentCapabilities = new Set();
+            const noteCapabilityAbsent = (capability) => {
+                if (absentCapabilities.has(capability)
+                    || journal.read().some((event) => event.event === "driver-capability-absent" && event.data.capability === capability))
+                    return;
+                absentCapabilities.add(capability);
+                journal.append("driver-capability-absent", undefined, { driver: driver.id, capability });
+            };
             // Termination (SIGINT/SIGTERM): record the daemon-controlled exit before closing every live slot,
             // reconcile owned panes against an EMPTY
             // desired set (herdr panes not in memory; panesToClose spares foreign names, watch panes, and
@@ -1255,6 +1326,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         catch (error) {
                             console.error(`tickmarkr ${runId}: deliberate exit cause could not be journalled (${error instanceof Error ? error.message : String(error)})`);
                         }
+                        // Stop the scheduler before the first awaited retirement. Otherwise a freed slot can fund a
+                        // new attempt while this reaper is still closing the old ones.
+                        abortRun(new Error(`terminated by ${sig}`));
                         if (cfg.visibility.keepPanes !== "forever") {
                             for (const s of liveSlots) { // closeSlot only deletes the element being visited — safe during Set iteration
                                 try {
@@ -1269,13 +1343,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                         }
                         releaseRunLock(repoRoot); // the process dies at exit() below — the finally never runs on this path
                     }
-                    abortRun(new Error(`terminated by ${sig}`));
                     exit(sig === "SIGINT" ? 130 : 143);
                 })();
             };
             process.on("SIGINT", onTermination);
             process.on("SIGTERM", onTermination);
             journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
+            const reviewHistory = journal.read()
+                .filter((event) => event.event === "gate-result" && event.data.gate === "review" && typeof event.data.reviewer === "string")
+                .map((event) => event.data.reviewer);
             // Capture this before this observer appends run-resume. A prior run-end belongs to a completed
             // lifecycle and must use the ordinary resume/redispatch rules; only an interrupted live attempt
             // owns reusable measurements or unclean-death residue.
@@ -1305,6 +1381,20 @@ export async function runDaemon(repoRoot, opts = {}) {
             const approved = new Set(approvalStartupEvents.filter((e) => e.event === "task-approved" && e.taskId).map((e) => e.taskId));
             let approvalSweepCursor = approvalStartupEvents.length;
             const commands = detectGateCommands(repoRoot, cfg);
+            const watchName = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
+            let watchSlot;
+            const openBoard = async () => {
+                if (!trackedDriver.narrator) {
+                    noteCapabilityAbsent("narrator");
+                    return;
+                }
+                try {
+                    watchSlot = await trackedDriver.narrator(repoRoot, watchCommand(runId), runId);
+                }
+                catch (error) {
+                    journal.append("watch-placement-failed", undefined, { error: error instanceof Error ? error.message : String(error) });
+                }
+            };
             let baseRef;
             let baseline;
             // Phase 46 (RES-01/RES-02): the resume-state map is built ONCE here so execTask closes over it.
@@ -1372,9 +1462,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                     ...(replayedExclusions.size > 0 ? { excludedChannels: [...replayedExclusions].sort() } : {}),
                     ...(opts.retryFailed ? { retryFailed: true } : {}),
                 });
+                await openBoard();
             }
             else {
                 baseRef = await gitHead(repoRoot);
+                journal.append("baseline-start", undefined, { baseRef, commands });
+                await openBoard();
                 baseline = await captureBaseline(repoRoot, commands);
                 writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(baseline, null, 2));
                 writeFileSync(join(journal.dir, "graph.json"), readFileSync(join(tickmarkrDir(repoRoot), "graph.json")));
@@ -1420,21 +1513,6 @@ export async function runDaemon(repoRoot, opts = {}) {
             const collateral = pinnedCollateral ?? collateralHits(graph.tasks, repoRoot);
             if (!pinnedCollateral)
                 writeFileSync(collateralPath, JSON.stringify(Object.fromEntries(collateral), null, 2));
-            // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
-            // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
-            // a failed-to-open or later-dead watch pane never affects the run.
-            // OBS-103: hold the returned slot — narrator() returns the run's board under its canonical owned
-            // name whichever way it got there (the herdr driver retires a survivor it finds and re-splits, so
-            // the live command is run-bound), and the run-end sweep below retires it by that name regardless
-            // of which daemon instance split the pane.
-            const watchName = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
-            let watchSlot;
-            try {
-                watchSlot = await driver.narrator?.(repoRoot, watchCommand(runId), runId);
-            }
-            catch (error) {
-                journal.append("watch-placement-failed", undefined, { error: error instanceof Error ? error.message : String(error) });
-            }
             const intWt = await ensureIntegration(repoRoot, branch, baseRef);
             // v1.1 visibility: role-named slots; panes persist per keepPanes (attempt = v1 close-after-harvest)
             const keepOpen = cfg.visibility.keepPanes !== "attempt";
@@ -1473,7 +1551,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     if (watchSlot && watchSlot.name === watchName && !desired.has(watchName)) {
                         const w = watchSlot;
                         watchSlot = undefined;
-                        await driver.close(w);
+                        await trackedDriver.close(w);
                     }
                 }
                 catch {
@@ -1525,10 +1603,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                 await previous;
                 try {
                     let lastCount = -1;
+                    const startedAt = Date.now();
                     for (;;) {
                         const count = await liveSuiteCount(repoRoot);
                         if (count === 0)
                             break;
+                        // OBS-889: a census that never reaches zero held T5's gates with no row and no end. Proceed at
+                        // the ceiling, flagged: the verdict that follows was produced beside whatever is still counted.
+                        if (Date.now() - startedAt >= suiteWaitCeilingMs) {
+                            journal.append("suite-wait-ceiling", taskId, { count, waitedMs: Date.now() - startedAt });
+                            break;
+                        }
                         if (count !== lastCount)
                             journal.append("suite-wait", taskId, { count });
                         lastCount = count;
@@ -1799,6 +1884,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // `test` row whose scope no consumer could recover.
                         ...(Array.isArray(g.meta?.selectedTests) ? { selectedTests: g.meta.selectedTests } : {}),
                         ...(g.meta?.fullSuite === true ? { fullSuite: true } : {}),
+                        ...(g.meta?.reapedGroup === true ? { reapedGroup: true } : {}),
+                        ...(g.gate === "review" && typeof g.meta?.reviewer === "string" ? {
+                            reviewer: g.meta.reviewer,
+                            ...(typeof g.meta.vendor === "string" ? { vendor: g.meta.vendor } : {}),
+                            ...(typeof g.meta.provider === "string" ? { provider: g.meta.provider } : {}),
+                            ...(typeof g.meta.rotationSeat === "number" ? { rotationSeat: g.meta.rotationSeat } : {}),
+                            ...(typeof g.meta.timeoutMs === "number" ? { timeoutMs: g.meta.timeoutMs } : {}),
+                        } : {}),
                         // A finding's path is its own evidence path. Do not pass task scope here: a declaration says
                         // where work is allowed, not where this verdict found the defect.
                         ...(blocking ? {
@@ -1820,9 +1913,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // T7: the capacity the gate's own command child ran under, lifted verbatim from the result
                         // the battery produced — read where the shell built that child's environment, never
                         // re-derived from the run's own budget, which would answer a different number than the
-                        // operator's export did. It is this row's only COMPARABLE identity: the two load samples
-                        // beside it are endpoint reads of a gate whose interior neither of them saw, so no reader
-                        // compares them, and matching capacity never claims the machine was calm. A gate that ran
+                        // operator's export did. It is this row's only COMPARABLE identity: the load samples describe
+                        // contention while capacity describes how the command divided the machine, and matching
+                        // capacity never claims the machine was calm. A gate that ran
                         // no command carries nothing — it divided nothing.
                         //
                         // `dirtiedBy` is the one hole in that lift: run-gates REPLACES a green battery verdict with
@@ -2167,6 +2260,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // deterministic-fingerprint occurrence/review round for budget accounting.
                             ...(!satisfiedGate && !recheck ? { replayMeasurement: true } : {}),
                         };
+                        await trackedDriver.project?.(t.id, "in-review");
                         journal.phaseStart(t.id, "gates");
                         const { results } = await withSuiteWindow(t.id, resumedTask.gates.includes("test") && commands.test !== undefined, () => runGates(resumedTask, {
                             worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
@@ -2184,6 +2278,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                                 : undefined,
                             excludeReviewers: badReviewers,
+                            reviewHistory,
                             onGate: async (e) => {
                                 if (e.phase === "start") {
                                     notePhaseStart(e);
@@ -2260,6 +2355,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             attempts: rs?.attempts ?? 0, assignment: gateAuthor, taskContentDigest: contentDigest,
                         });
                         journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
+                        await trackedDriver.project?.(t.id, "completed");
                         journal.telemetry({
                             taskId: t.id, shape: t.shape, adapter: gateAuthor.adapter, model: gateAuthor.model,
                             channel: gateAuthor.channel, attempts: rs?.attempts ?? 0, outcome: "done",
@@ -2275,6 +2371,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // starts at 0 (fresh budget) instead of re-parking at the cap in the same tick.
                 let providerDeathRequeues = 0;
                 let providerDeathAttempt = -1;
+                // A completed attempt may keep its pane for gate-failure context, but once another worker is
+                // funded that context is superseded and — more importantly — must not remain a second writer on
+                // the same worktree. The next loop iteration retires it before reading/recreating the tree.
+                let supersededWorkerSlot;
                 attempts: for (let attempt = rs?.attempts ?? 0;; attempt++) {
                     if (attempt !== providerDeathAttempt) {
                         providerDeathRequeues = 0;
@@ -2289,6 +2389,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                         await park(t, `attempt cap (${MAX_ATTEMPTS}) reached`, "attempt-cap", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
                         return;
                     }
+                    if (supersededWorkerSlot && !keepForever) {
+                        const prior = supersededWorkerSlot;
+                        supersededWorkerSlot = undefined;
+                        const idx = keptSlots.indexOf(prior);
+                        if (idx >= 0)
+                            keptSlots.splice(idx, 1);
+                        try {
+                            await closeSlot(prior);
+                        }
+                        catch (error) {
+                            await park(t, `superseded worker could not be swept before dispatch: ${error instanceof Error ? error.message : String(error)}`, "stall", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
+                    }
                     // OBS-419: read the approval-carried ceiling at the funding boundary, after every escalation
                     // decision but before the sole task-dispatch below. Both interactive and headless worker-launch
                     // branches are dominated by this check, so no route can fund another worker without consulting it.
@@ -2430,11 +2544,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                     lastContextTokens = undefined;
                     graph = setStatus(graph, t.id, "running");
                     saveGraph(repoRoot, graph);
+                    await trackedDriver.project?.(t.id, "in-progress");
                     // T6: a dispatch that carries an outstanding finding says so, and names it. Without this the
                     // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
                     // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
                     journal.append("task-dispatch", t.id, {
                         assignment, attempt, provenance: dispatchProvenance(r.provenance), retryMode,
+                        excludedChannels: [...demotedChannels].sort(),
                         ...(outstandingFindings.length > 0 ? { carriedFindings: outstandingFindings } : {}),
                         ...(carriedConsultGuidance ? { carriedConsultGuidance } : {}),
                     });
@@ -2546,6 +2662,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // itself before gates regardless of what the worker does with it.
                     writeFileSync(promptFile, `${WORKTREE_LAYOUT_CONTRACT}\n\n${workerContract}\n\n${readFileSync(promptFile, "utf8")}`);
                     const adapter = getAdapter(assignment.adapter, adapters);
+                    if (adapter.trustDialog && !trackedDriver.sendKey)
+                        noteCapabilityAbsent("sendKey");
                     // VIS-04: workers share one role tab. T2: `owned` names the pane canonically (ownership contract);
                     // the legacy name stays the fallback for drivers without owned handling (subprocess spies).
                     const workerSlotOpts = {
@@ -2599,7 +2717,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // between task-dispatch and this line — worktree recreation, setup, prompt write, slot allocation,
                     // the launch itself — can still die with no worker having seen the brief, and `--retry-failed`
                     // must then re-send that same brief rather than a fresh prompt on a possibly banned channel.
-                    const noteLaunched = () => journal.append("worker-launch", t.id, { attempt, retryMode });
+                    let workerLaunchedAt;
+                    const noteLaunched = async () => {
+                        // Startup evidence begins when the worker exists, not while prompt preparation, slot
+                        // allocation, or interactive readiness is still consuming the attempt wall clock.
+                        workerLaunchedAt ??= Date.now();
+                        journal.append("worker-launch", t.id, {
+                            attempt,
+                            retryMode,
+                            ...(trackedDriver.describe ? await trackedDriver.describe(slot) : {}),
+                        });
+                    };
+                    const noteWorkerLiveness = (event, data) => journal.append(event, t.id, { ...data, source: trackedDriver.readSource ?? "driver.read" });
                     let cpuFlat;
                     let cpuAccountant;
                     let cpuGapCount = 0;
@@ -2731,6 +2860,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // subprocess tree that REACHED its exit marker, not about what the worker claimed.
                     let processExited = false;
                     let earlyLaunchDead = false;
+                    let startupFailure = false;
                     let deadWorkerPark;
                     let settleParsed;
                     let seedResult;
@@ -2813,7 +2943,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         continue attempts;
                                     return;
                                 }
-                                noteLaunched();
+                                await noteLaunched();
                                 output = seedResult.output;
                             }
                             else {
@@ -2827,14 +2957,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         continue attempts;
                                     return;
                                 }
-                                noteLaunched();
+                                await noteLaunched();
                                 output = await driver.read(slot, PANE_READ_ROWS);
                             }
                             // The returning paths report the same fact on the result; both callbacks land on the one
                             // latch, and the second is a no-op. A seed that answered is never re-answered by the loop.
                             if (seedResult?.trustAnswered)
                                 noteSeedTrustAnswered();
-                            if (seedResult?.seedFailed) {
+                            startupFailure = startupFailureInWindow(output, workerLaunchedAt);
+                            if (seedResult?.seedFailed || startupFailure) {
                                 finished = false;
                             }
                             else {
@@ -2877,6 +3008,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     const sliceStart = Date.now();
                                     const remaining = stallWindowMs - (sliceStart - lastProgressAt);
                                     let slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
+                                    const startupLeft = workerLaunchedAt === undefined
+                                        ? 0
+                                        : workerStartupWindowMs - (sliceStart - workerLaunchedAt);
+                                    if (startupLeft > 0)
+                                        slice = Math.min(slice, Math.max(1, startupLeft));
                                     if (!everHadOutput) {
                                         const earlyLeft = earlyLaunchLivenessMs - (sliceStart - attemptStart);
                                         if (earlyLeft > 0)
@@ -2896,6 +3032,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         const exit = exitRe.exec(output);
                                         if (finished || exit) {
                                             exitCode = exit ? Number(exit[1]) : null; // null ⇔ the TUI is still alive
+                                            processExited = exit !== null;
                                             await sampleContext(); // final poll-seam sample before leaving the wait
                                             break;
                                         }
@@ -2922,7 +3059,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             throw error;
                                         if (!paneReadHeld) {
                                             paneReadHeld = true;
-                                            journal.append("worker-dead-held", t.id, {
+                                            noteWorkerLiveness("worker-dead-held", {
                                                 slot: slot.name, attempt, reason: "pane-read-unreadable",
                                                 error: error instanceof Error ? error.message : String(error),
                                             });
@@ -2935,6 +3072,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     if (paneText.length > 0)
                                         everHadOutput = true;
+                                    if (startupFailureInWindow(paneText, workerLaunchedAt)) {
+                                        startupFailure = true;
+                                        output = paneText;
+                                        break;
+                                    }
                                     // OBS-117 (v1.71 T6): zero raw output by the early-launch deadline is a dead channel now.
                                     if (!everHadOutput && Date.now() - attemptStart >= earlyLaunchLivenessMs) {
                                         earlyLaunchDead = true;
@@ -3008,7 +3150,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     catch (error) {
                                         if (!paneStatusHeld) {
                                             paneStatusHeld = true;
-                                            journal.append("worker-dead-held", t.id, {
+                                            noteWorkerLiveness("worker-dead-held", {
                                                 slot: slot.name, attempt, reason: "pane-status-unreadable",
                                                 error: error instanceof Error ? error.message : String(error),
                                             });
@@ -3085,7 +3227,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             paneAbsent = false;
                                             if (!paneReadHeld) {
                                                 paneReadHeld = true;
-                                                journal.append("worker-dead-held", t.id, {
+                                                noteWorkerLiveness("worker-dead-held", {
                                                     slot: slot.name, attempt, reason: "pane-read-unreadable",
                                                     error: error instanceof Error ? error.message : String(error),
                                                 });
@@ -3109,7 +3251,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             paneAbsent = false;
                                             if (!paneReadHeld) {
                                                 paneReadHeld = true;
-                                                journal.append("worker-dead-held", t.id, {
+                                                noteWorkerLiveness("worker-dead-held", {
                                                     slot: slot.name, attempt, reason: "pane-read-unreadable",
                                                     error: error instanceof Error ? error.message : String(error),
                                                 });
@@ -3133,7 +3275,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     if (deathCertain) {
                                         const preservation = await preserveDeadWorker(wt, taskBase);
                                         if (!preservation.ref) {
-                                            journal.append("worker-dead-held", t.id, {
+                                            noteWorkerLiveness("worker-dead-held", {
                                                 slot: slot.name, attempt, reason: `worktree-${preservation.state}`,
                                             });
                                             continue;
@@ -3142,7 +3284,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         const reason = `worker is unambiguously dead: pane absent, process tree empty, and worktree unchanged; preserved at ${ref}`;
                                         deadWorkerPark = { ref, reason };
                                         journal.append("worktree-preserved", t.id, { ref });
-                                        journal.append("worker-dead-held", t.id, {
+                                        noteWorkerLiveness("worker-dead-held", {
                                             slot: slot.name, attempt, reason: "unambiguous-worker-death", ref,
                                         });
                                         break;
@@ -3158,8 +3300,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     // Everything the fast-kill can decide from the CHANNEL, evaluated before the CPU leg is
                                     // asked for anything: the kill's own probe costs a `ps` every 100ms, so an ineligible
                                     // slice must not pay for it. The CPU reading is consulted at the kill itself, below.
-                                    const fastKillEligible = !stallProgress.rowSignalSaturated
-                                        && !nudgePending && !nudgeFailed
+                                    const fastKillEligible = !nudgePending && !nudgeFailed
                                         && sliceNow - lastOutputGrowthAt >= deadChannelFastKillMs
                                         && worktreeSinceLaunch === "unchanged";
                                     const harvestCpuEligible = !nudgePending && !nudgeFailed
@@ -3200,14 +3341,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     // (an elapsed "9s"→"10s" lengthens the read and would hide a frozen pane). But the
                                     // tracker SHARES the read window's ceiling: its row signal saturates once a sample
                                     // FILLS a PANE_READ_ROWS read on raw lines (blanks/chrome included — see stall.ts),
-                                    // and past that point a flat tracker means "unmeasurable", not "dead". For unmetered
-                                    // adapters (codex, cursor-agent, grok, opencode — no contextUsage, so the token signal
-                                    // never fires) rows are the ONLY
-                                    // signal, and those are exactly the non-nudgeable adapters this kill governs — a live
-                                    // worker past the ceiling would be concluded dead mid-work. So the kill STANDS DOWN on
-                                    // a saturated row signal (journaled once per attempt); the rolling window still owns
-                                    // that pane, exactly as pre-T1. Token growth counts as life either way, so a metered
-                                    // worker thinking through a long tool run survives.
+                                    // and past that point a flat tracker means "unmeasurable", not "dead". Journal that
+                                    // unreadability once, then let the independent CPU and worktree legs decide: accruing or
+                                    // unreadable CPU preserves the worker; flat CPU beside an unchanged tree may conclude.
+                                    // A saturated row alone is never a death verdict.
                                     // The triad has NO status exemption: a pane that herdr reports as blocked, idle, working
                                     // or unknown dies alike once it holds no trailer, an unchanged tree and no growth — waiting the
                                     // rolling window out on a status reading is exactly the blindness T1 removes. A matched
@@ -3221,7 +3358,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     // filesystem/git observation answer that clause.
                                     if (stallProgress.rowSignalSaturated && !rowSaturationHeld) {
                                         rowSaturationHeld = true;
-                                        journal.append("worker-dead-held", t.id, { slot: slot.name, attempt, reason: "row-signal-saturated" });
+                                        journal.append("contact-unreadable", t.id, {
+                                            slot: slot.name, attempt, source: "pane-rows", reason: "row-signal-saturated", concludes: false,
+                                        });
                                     }
                                     // OBS-548: the FOURTH leg, and the one the daemon already measured. The three legs above
                                     // are all channel-side: they say a pane stopped talking. The tree's CPU says whether
@@ -3238,12 +3377,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             journal.append("worker-dead", t.id, {
                                                 slot: slot.name, attempt, silentMs: sliceNow - lastOutputGrowthAt,
                                                 cpuMs: leg.cpu.ms, cpuResolutionMs: leg.cpu.resolutionMs,
+                                                source: trackedDriver.readSource ?? "driver.read",
                                             });
                                             break;
                                         }
                                         if (!cpuHeld) {
                                             cpuHeld = true;
-                                            journal.append("worker-dead-held", t.id, {
+                                            noteWorkerLiveness("worker-dead-held", {
                                                 slot: slot.name, attempt, reason: leg.state === "accruing" ? "cpu-accruing" : "cpu-unmeasurable",
                                             });
                                         }
@@ -3285,6 +3425,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         const exit = exitRe.exec(output);
                                         if (finished || exit) {
                                             exitCode = exit ? Number(exit[1]) : null;
+                                            processExited = exit !== null;
                                             await sampleContext();
                                             break;
                                         }
@@ -3330,6 +3471,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     finished = new RegExp(trailerPattern(nonce)).test(output);
                                     const exit = exitRe.exec(output);
                                     exitCode = exit ? Number(exit[1]) : null;
+                                    processExited = exit !== null;
                                 }
                                 if (finished) {
                                     await driver.waitAgentStatus(slot, "idle", 5_000); // settle, then re-harvest the final render
@@ -3371,11 +3513,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     continue attempts;
                                 return;
                             }
-                            noteLaunched();
+                            await noteLaunched();
                             // OBS-54: headless workers have the same output-inactivity budget as visible panes.
                             // v1.76: same monotonic-progress measure as the interactive site; harvest stays raw.
                             const stallWindowMs = taskTimeoutMinutes * 60_000;
                             const initialPane = await driver.read(slot, 500);
+                            startupFailure = startupFailureInWindow(initialPane, workerLaunchedAt);
                             let everHadOutput = initialPane.length > 0;
                             const stallProgress = new StallProgressTracker();
                             stallProgress.observe({ paneText: initialPane, seedSubmitted: true, contextTokens });
@@ -3388,9 +3531,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // worker-result-harvested row. The interactive site has always kept them apart (`finished`
                             // there is the trailer regex; the exit marker only sets exitCode), and the cause taxonomy
                             // already names this shape "clean-exit-no-trailer" — unreachable in print mode until now.
-                            while (Date.now() - lastProgressAt < stallWindowMs) {
+                            while (!startupFailure && Date.now() - lastProgressAt < stallWindowMs) {
                                 const remaining = stallWindowMs - (Date.now() - lastProgressAt);
                                 let slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
+                                const startupLeft = workerLaunchedAt === undefined
+                                    ? 0
+                                    : workerStartupWindowMs - (Date.now() - workerLaunchedAt);
+                                if (startupLeft > 0)
+                                    slice = Math.min(slice, Math.max(1, startupLeft));
                                 if (!everHadOutput) {
                                     const earlyLeft = earlyLaunchLivenessMs - (Date.now() - attemptStart);
                                     if (earlyLeft > 0)
@@ -3405,6 +3553,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 const paneText = await driver.read(slot, 500);
                                 if (paneText.length > 0)
                                     everHadOutput = true;
+                                if (startupFailureInWindow(paneText, workerLaunchedAt)) {
+                                    startupFailure = true;
+                                    break;
+                                }
                                 if (!everHadOutput && Date.now() - attemptStart >= earlyLaunchLivenessMs) {
                                     earlyLaunchDead = true;
                                     break;
@@ -3443,12 +3595,52 @@ export async function runDaemon(repoRoot, opts = {}) {
                     if (interactive && finished && !exitRe.test(output)) {
                         await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, 2_000, { regex: true });
                     }
-                    // keepPanes retains visible context, not a timed-out subprocess tree. Close before consult/retry
-                    // can recreate the worktree; Herdr and subprocesses that reached their exit marker stay unchanged.
-                    if (keepOpen && (finished || processExited || driver.id !== "subprocess"))
+                    // Free availability reroutes deliberately reuse the charged-attempt ordinal. Stream artifacts
+                    // cannot: every dispatch owns bytes that must remain independently recoverable, so derive the
+                    // append-only dispatch ordinal from the journal instead of overwriting an earlier a<n>.out.
+                    const streamAttempt = journal.read().filter((event) => event.event === "task-dispatch" && event.taskId === t.id).length - 1;
+                    const capturedStream = await captureWorkerStream(journal.dir, t.id, streamAttempt, driver, slot, output);
+                    // An interactive settle already selected the bounded parse it is allowed to use. Every other
+                    // path parses the common final stream snapshot — notably envelope adapters whose trailer is
+                    // encoded and therefore invisible to the raw wait regex. Keep `output` bounded: every text
+                    // classifier below retains its pre-artifact tail surface.
+                    let result = settleParsed ?? adapter.parse(capturedStream.output, nonce);
+                    const adapterCause = result.cause;
+                    // Law 46: there is one completion fact. A classified adapter result with no parse-failure cause
+                    // means its decoder found the nonce-bound trailer even when the raw JSON envelope escaped it.
+                    const workerFinished = finished || adapterCause === undefined;
+                    finished = workerFinished;
+                    const adapterStartupFailure = adapterCause === "startup-failure";
+                    const workerCause = adapterStartupFailure
+                        ? "startup-failure"
+                        : startupFailure
+                            ? "startup-failure"
+                            : classifyWorkerResultCause({ output, ok: result.ok, finished: workerFinished, exitCode, summary: result.summary, timedOut, deadChannel: deadChannelKilled });
+                    // OBS-897/889(4): neither a timeout/quiet-harvest nor a trailer is a verdict on a tree while
+                    // its writer remains alive. Reap through the same driver lifecycle every execution surface
+                    // already implements, then (and only then) permit commitsAheadOf/gates below to read the tree.
+                    // A failed reap is a stall disposition, never permission to gate a moving branch.
+                    let reapFailure;
+                    if (!processExited && !deadWorkerPark) {
+                        try {
+                            await closeSlot(slot);
+                            if (!workerFinished) {
+                                journal.append("worker-reaped-before-harvest", t.id, {
+                                    slot: slot.name, attempt, cause: workerCause ?? "stall-timeout",
+                                });
+                            }
+                        }
+                        catch (error) {
+                            reapFailure = error instanceof Error ? error.message : String(error);
+                        }
+                    }
+                    else if (keepOpen && (workerFinished || processExited || driver.id !== "subprocess")) {
                         keptSlots.push(slot);
-                    else
+                        supersededWorkerSlot = slot;
+                    }
+                    else {
                         await closeSlot(slot);
+                    }
                     // SPEND-01: usage from the harness's own cwd-keyed structured store, read POST-HOC from disk —
                     // `wt` is this task's private worktree, so the path is unique; the read is sliced to records
                     // stamped at/after this attempt's dispatch instant. Never the harvested pane text, never the
@@ -3464,13 +3656,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                         await park(t, deadWorkerPark.reason, "stall", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { ref: deadWorkerPark.ref });
                         return;
                     }
-                    let result = settleParsed ?? adapter.parse(output, nonce);
-                    const workerFinished = finished;
-                    const workerCause = classifyWorkerResultCause({ output, ok: result.ok, finished, exitCode, summary: result.summary, timedOut, deadChannel: deadChannelKilled });
                     journal.append("worker-result", t.id, {
                         ok: result.ok, summary: result.summary, deviations: result.deviations, finished: workerFinished, exitCode,
-                        mode: interactive ? "interactive" : "print", ...(workerCause ? { cause: workerCause } : {}),
+                        mode: interactive ? "interactive" : "print", stream: capturedStream.path,
+                        ...(workerCause ? { cause: workerCause } : {}),
                     });
+                    if (reapFailure) {
+                        await park(t, `worker could not be reaped before harvest: ${reapFailure}`, "stall", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { reapFailure });
+                        return;
+                    }
                     // T2 review (routing precedence): provider-death, quota and dead-channel classification
                     // derive from ONE rule — the worker's OWN outcome, workerFinished and this PRE-HARVEST
                     // parse — never from the synthesized result below. A worker that committed and then walled
@@ -3557,6 +3751,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     catch { /* cosmetic — reconcile is the backstop */ }
                                 }
+                                if (supersededWorkerSlot === slot)
+                                    supersededWorkerSlot = undefined;
                             }
                             // v1.8 TEL-05 — FROM-channel attribution for mid-task quota failover: `assignment` is still the
                             // throttled-away-FROM channel here (before the reassign below). durationMs:0 marks this as a
@@ -3583,7 +3779,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // T2 review: classify the PRE-HARVEST parse — classifyDeadChannel bails on any ok:true
                     // result, so reading the synthesized harvest result would swallow auth-required /
                     // setup-required / provider-outage for every committed-but-walled attempt (in both modes).
-                    const dead = classifyDeadChannel(preHarvestResult) ?? (earlyLaunchDead ? "setup-required" : undefined);
+                    const dead = classifyDeadChannel({ ...preHarvestResult, raw: output })
+                        ?? (earlyLaunchDead || startupFailure || adapterStartupFailure ? "setup-required" : undefined);
                     if (dead) {
                         const from = channelKey(assignment);
                         demotedChannels.add(from); // excluded for later attempts AND later tasks in this run
@@ -3602,12 +3799,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     catch { /* cosmetic — reconcile is the backstop */ }
                                 }
+                                if (supersededWorkerSlot === slot)
+                                    supersededWorkerSlot = undefined;
                             }
                             assignment = next;
                             tried.push(channelKey(next));
+                            // Startup failures bought no worker turn: preserve the attempt ordinal/budget while the
+                            // verified-dead channel remains excluded for every later dispatch in this run.
+                            if (adapterStartupFailure || startupFailure)
+                                attempt--;
                             continue;
                         }
-                        await park(t, `dead channel (${dead}) and no eligible channel remains`, "reroute-exhausted", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                        const chargedAttempts = adapterStartupFailure || startupFailure ? attempt : attempt + 1;
+                        await park(t, `dead channel (${dead}) and no eligible channel remains`, "reroute-exhausted", assignment, chargedAttempts, startMs, gateFails, consults, tokens, metered, retryMode);
                         return;
                     }
                     if (!finished) {
@@ -3690,6 +3894,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     gateLoop: while (true) {
                         const gated = await gitHead(wt);
                         gateSubject = { commit: await gateCommitSubject(taskBase, gated, wt), attempt };
+                        await trackedDriver.project?.(t.id, "in-review");
                         journal.phaseStart(t.id, "gates");
                         ({ results, commits } = await withSuiteWindow(t.id, t.gates.includes("test") && commands.test !== undefined, () => runGates(t, {
                             worktree: wt, baseRef: taskBase, result, author: assignment,
@@ -3713,6 +3918,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                                 : undefined,
                             excludeReviewers: badReviewers,
+                            reviewHistory,
                             onGate,
                         })));
                         results.forEach(classifySignalOnlyTest);
@@ -3751,6 +3957,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 attempts: attempt + 1, assignment, taskContentDigest: contentDigest,
                             });
                             journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
+                            await trackedDriver.project?.(t.id, "completed");
                             // firstAttemptOk/gateFails/consults are recorded FACTS, not policy — a parkKind:"stall" row is
                             // recorded but NOT quality-negative in v1.6; Phase 12 owns reward policy, so flipping it later needs zero data migration.
                             journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts: attempt + 1, outcome: "done", durationMs: Date.now() - startMs, firstAttemptOk: attempt === 0, gateFails, consults, tokens, meteredAttempts: tokens ? metered : undefined, retryMode });