tickmarkr 2.4.0 → 2.4.2

package/dist/compile/index.js

@@ -37,12 +37,16 @@ function detect(src) {
 function repoOverlayMode(repoRoot) {
     if (!repoRoot)
         return undefined;
+    const path = join(repoRoot, ".tickmarkr", "config.yaml");
+    if (!existsSync(path))
+        return undefined;
     try {
-        const cfg = parse(readFileSync(join(repoRoot, ".tickmarkr", "config.yaml"), "utf8"));
+        const cfg = parse(readFileSync(path, "utf8"));
         return typeof cfg?.routing?.mode === "string" ? cfg.routing.mode : undefined;
     }
-    catch {
-        return undefined;
+    catch (error) {
+        throw new CompileError(`${path} does not parse, so compile cannot prove the repository routing overlay: `
+            + `${error instanceof Error ? error.message : String(error)}`);
     }
 }
 function hasModeOverride(src) {
@@ -58,9 +62,13 @@ function hasModeOverride(src) {
     return false;
 }
 function enforceModeOverlay(graph, src, repoRoot) {
-    if (graph.spec.source !== "native" || graph.mode === undefined)
+    if (graph.spec.source !== "native")
         return;
+    // Read every native compile's overlay before checking whether either side declares a mode. A
+    // corrupt file cannot masquerade as an absent mode and silently skip the disagreement gate.
     const overlayMode = repoOverlayMode(repoRoot);
+    if (graph.mode === undefined)
+        return;
     if (overlayMode === undefined || overlayMode === graph.mode || hasModeOverride(src))
         return;
     throw new CompileError(`${src} front-matter mode ${graph.mode} disagrees with repository routing.mode ${overlayMode}; `
@@ -75,7 +83,7 @@ function enforceTaskUnitContract(g, src, repoRoot) {
     return g;
 }
 export function finalizePlan(plan, src, repoRoot) {
-    const graph = enforceTaskUnitContract(validateGraph({
+    const graph = validateGraph({
         version: plan.version,
         ...(plan.mode !== undefined ? { mode: plan.mode } : {}),
         spec: {
@@ -85,8 +93,11 @@ export function finalizePlan(plan, src, repoRoot) {
             ...(plan.base !== undefined ? { base: plan.base } : {}),
         },
         tasks: plan.tasks,
-    }), src, repoRoot);
+    });
+    // Overlay readability is compile truth, not a mode-disagreement optimization. Check it before
+    // other repo-dependent lints so malformed native config cannot be hidden by an earlier finding.
     enforceModeOverlay(graph, src, repoRoot);
+    enforceTaskUnitContract(graph, src, repoRoot);
     // overseer-217 removal condition, now paid: on this milestone's authored graph the conventional
     // name map emitted 21 raw unowned-test findings; review found 1 real and 20 false, while intersecting
     // with a direct import or command-entry spawn retained the real one and left 0 false positives. That

package/dist/compile/native.js

@@ -286,11 +286,19 @@ export function authoringLintFindings(tasks, file) {
             if (scope)
                 findings.push(scope);
             for (const symbol of fencedIdentifiers(text)) {
-                if (!taskTexts.size || [...taskTexts.values()].some((body) => body.includes(symbol)))
+                // Empty files[] is the deliberately unrestricted scope and a non-repository programmatic
+                // compile has no disk corpus to prove against. But a declared files[] that expands to zero
+                // repository files is evidence, not absence: its preservation fence cannot be satisfied.
+                if (!root || task.files.length === 0)
                     continue;
+                if ([...taskTexts.values()].some((body) => body.includes(symbol)))
+                    continue;
+                const matchDetail = taskFiles.length === 0
+                    ? `this task's files[] matched zero files on disk (${task.files.join(", ")})`
+                    : `that symbol has zero hits in this task's files[] (${taskFiles.join(", ")})`;
                 findings.push({
                     code: "fence-symbol-absent", fixtureId: id, taskId: task.id, criterion: index + 1,
-                    detail: `preservation fence cites \`${symbol}\` but that symbol has zero hits in this task's files[] (${taskFiles.join(", ")}) — OBS-604`,
+                    detail: `preservation fence cites \`${symbol}\` but ${matchDetail} — OBS-604`,
                 });
             }
             if (/line[- ]count|physical line|not greater than (?:the|\d)|no larger than|at most \d+ (?:lines|bytes)/i.test(text)) {

package/dist/compile/ownership.js

@@ -34,24 +34,29 @@ function sourceFiles(repoRoot) {
         return [];
     }
 }
-// OBS-898: `allSources` is indexed once per ownership pass by the caller, never per test source.
-function namedSources(test, tasks, allSources) {
-    const stem = basename(test).replace(/\.test\.ts$/, "");
+// OBS-898: expand the task's source declarations against ONE source-tree listing, once per compile.
+// Tests then query this in-memory index; neither a test file nor a second corroboration pass can
+// trigger another source walk or glob expansion.
+function namedSourceIndex(tasks, allSources) {
     const matches = new Map();
     for (const task of tasks) {
         for (const entry of task.files.map(normalize).filter((path) => path.startsWith("src/"))) {
             const fromGlob = /[*?{[]/.test(entry);
             const entries = fromGlob ? allSources.filter(filesGlob(entry)) : [entry];
             for (const sourcePath of entries) {
-                const source = basename(sourcePath, extname(sourcePath));
-                if (stem === source || stem.startsWith(`${source}-`)) {
-                    matches.set(`${task.id}:${sourcePath}`, { taskId: task.id, source: sourcePath, fromGlob });
-                }
+                matches.set(`${task.id}:${sourcePath}`, { taskId: task.id, source: sourcePath, fromGlob });
             }
         }
     }
     return [...matches.values()];
 }
+function namedSources(test, index) {
+    const stem = basename(test).replace(/\.test\.ts$/, "");
+    return index.filter(({ source }) => {
+        const sourceStem = basename(source, extname(source));
+        return stem === sourceStem || stem.startsWith(`${sourceStem}-`);
+    });
+}
 const moduleKey = (path) => normalize(path).replace(/\.(?:[cm]?[jt]sx?)$/, "");
 function directImportSpecifiers(text) {
     // Comments cannot create an edge. Keep strings intact because they are the import target.
@@ -167,9 +172,10 @@ export function ownershipFindings(tasks, repoRoot) {
     }
     const globOwnedTests = new Map();
     const allSources = sourceFiles(repoRoot);
+    const namedIndex = namedSourceIndex(tasks, allSources);
     for (const source of sources) {
         const ids = predictedBy.get(source.path) ?? new Set();
-        for (const named of namedSources(source.path, tasks, allSources)) {
+        for (const named of namedSources(source.path, namedIndex)) {
             ids.add(named.taskId);
             if (named.fromGlob) {
                 const owners = globOwnedTests.get(source.path) ?? new Set();
@@ -185,7 +191,7 @@ export function ownershipFindings(tasks, repoRoot) {
         if (owners(test).length === 0 && !(globOwnedTests.get(test)?.size)) {
             const ids = [...taskIds].sort();
             const source = sourceByPath.get(test);
-            const evidence = corroboration(source, namedSources(test, tasks, allSources));
+            const evidence = corroboration(source, namedSources(test, namedIndex));
             findings.push({
                 code: "unowned-test",
                 test,

package/dist/drivers/herdr.d.ts

@@ -71,6 +71,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     private watches;
     constructor(bin?: string, workersPerTab?: number, time?: HerdrTimeSource, journal?: DriverJournal | undefined);
     private appendDispatchRetry;
+    private appendPaneClose;
     private openRunJournal;
     private liveSupervisionSeats;
     private journalReconcile;

package/dist/drivers/herdr.js

@@ -196,6 +196,29 @@ export class HerdrDriver {
         // recovery to the file and the pipe while the operator's rail stays silent about it.
         Journal.open(repoRoot, owned.runId, this.narrate).append("dispatch-retry", owned.taskId, data);
     }
+    // OBS-906: close() is the harvest path, not a reconcile path, so the sweep's close row cannot
+    // describe it. Persist the worker slot identity beside the exact pane/tab address this path used.
+    // A driver used outside a daemon has no bound run journal; the injectable sink remains the unit
+    // seam there, while every daemon-created worktree is bound by worktree() below.
+    appendPaneClose(slot, placement) {
+        const owned = parseOwnedName(slot.name);
+        if (owned?.role !== "worker")
+            return;
+        try {
+            const data = { slot: slot.name, ...placement };
+            if (this.journal) {
+                this.journal("pane-close", slot.name, data);
+                return;
+            }
+            const repoRoot = this.journalRoots.get(slot.cwd);
+            if (!repoRoot)
+                return;
+            Journal.open(repoRoot, owned.runId, this.narrate).append("pane-close", owned.taskId, data);
+        }
+        catch {
+            /* close is best-effort; a journal failure must not make a successful pane reap fatal */
+        }
+    }
     openRunJournal(runId) {
         const roots = new Set(this.journalRoots.values());
         roots.add(process.cwd());
@@ -1101,11 +1124,15 @@ export class HerdrDriver {
             return this.serial(() => this.closeGrouped(slot));
         }
         if (slot.tabId) {
-            await this.herdr(`tab close ${shq(slot.tabId)}`); // reaps the slot's whole tab, best-effort
+            const closed = await this.herdr(`tab close ${shq(slot.tabId)}`); // reaps the slot's whole tab, best-effort
+            if (closed.code === 0)
+                this.appendPaneClose(slot, { tabId: slot.tabId });
             return;
         }
         const pane = await this.paneId(slot);
-        await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        const closed = await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        if (closed.code === 0)
+            this.appendPaneClose(slot, { paneId: pane });
     }
     // D-08 ref-counted teardown, PER GENERATION (VIS-09 item 2): pane close per member; a generation's
     // tab closes only when ITS OWN last member leaves; the group entry dies when all generations are gone.
@@ -1119,7 +1146,9 @@ export class HerdrDriver {
         if (!gen)
             return; // generation already torn down — its tab is gone
         const pane = await this.paneId(slot);
-        await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        const closed = await this.herdr(`pane close ${shq(pane)}`); // best-effort
+        if (closed.code === 0)
+            this.appendPaneClose(slot, { paneId: pane, tabId: gen.tabId });
         gen.members = gen.members.filter((m) => m.name !== slot.name);
         await this.renameGroupTab(gen);
         if (gen.members.length === 0) {

package/dist/drivers/orca.d.ts

@@ -15,6 +15,8 @@ export declare const NOT_WRITABLE_CODE = "terminal_not_writable";
 export declare const RUNNING_STATUS = "running";
 export declare const STATUS_GOVERNED_METHODS: readonly ["read", "waitOutput", "status", "waitAgentStatus"];
 export declare const WORKTREE_ADOPTION_TIMEOUT_MS = 60000;
+/** A missing slot gets the same bounded chance to appear as a reaped shell gets to settle. */
+export declare const PENDING_PROJECT_GRACE_MS = 2000;
 export interface OrcaExec {
     (args: string[], cwd: string, timeoutMs?: number): Promise<ShResult>;
 }
@@ -136,7 +138,7 @@ export declare class OrcaDriver implements ExecutorDriver {
     describe(slot: Slot): {
         surface?: string;
         hostPlatform?: string;
-    };
+    } | undefined;
     run(slot: Slot, cmd: string): Promise<void>;
     private sendText;
     private sendReceipt;
@@ -221,6 +223,8 @@ export declare class OrcaDriver implements ExecutorDriver {
      * that still reports truncated at totalCount rows is a listing this sweep declines to judge on.
      */
     private listAll;
+    private openRunJournal;
+    private dropExpiredProjects;
     /**
      * Sweep tickmarkr-owned terminals down to `desired`. Ownership is decided ONLY by parseOwnedName
      * over the owned TAB title, through the same panesToClose fold herdr uses (drivers/types.ts): an

package/dist/drivers/orca.js

@@ -58,6 +58,8 @@ export const WORKTREE_ADOPTION_TIMEOUT_MS = 60_000;
 const WORKTREE_ADOPTION_POLL_MS = 1_000;
 const WORKTREE_ADOPTION_JOURNAL_MS = 2_000;
 const NUDGE_ECHO_TIMEOUT_MS = 2_000;
+/** A missing slot gets the same bounded chance to appear as a reaped shell gets to settle. */
+export const PENDING_PROJECT_GRACE_MS = 2_000;
 const SYSTEM_TIME = {
     now: () => Date.now(),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -366,7 +368,7 @@ export class OrcaDriver {
             this.taskWorktrees.set(owned.taskId, worktree);
             const pending = this.pendingProjects.get(owned.taskId);
             if (pending) {
-                await this.setWorkspaceStatus(worktree, pending);
+                await this.setWorkspaceStatus(worktree, pending.state);
                 this.pendingProjects.delete(owned.taskId);
             }
         }
@@ -1007,7 +1009,7 @@ export class OrcaDriver {
         if (!worktree) {
             // The daemon projects in-progress immediately before it creates the task checkout/slot.
             // Hold only that latest state; slot() applies it once the task's own path is known.
-            this.pendingProjects.set(taskId, state);
+            this.pendingProjects.set(taskId, { state, since: this.time.now() });
             return;
         }
         await this.setWorkspaceStatus(worktree, state);
@@ -1076,6 +1078,52 @@ export class OrcaDriver {
             throw new OrcaError("list", "terminal list is still truncated at totalCount rows", whole.raw);
         return whole;
     }
+    openRunJournal(runId) {
+        const roots = new Set(this.journalRoots.values());
+        roots.add(process.cwd());
+        for (const repoRoot of roots) {
+            try {
+                return Journal.open(repoRoot, runId, this.narrate);
+            }
+            catch {
+                /* try the next daemon-bound root */
+            }
+        }
+        return undefined;
+    }
+    // A projection exists only to bridge project() to the worker slot that follows it. After the
+    // grace, desired remains the dispatch oracle: a declared worker is still being placed and must
+    // keep its projection. Make genuine absence durable by appending first and deleting second; with
+    // no writable run journal the entry remains eligible for a later reconcile.
+    dropExpiredProjects(desired, runId) {
+        const now = this.time.now();
+        const desiredTasks = new Set();
+        for (const name of desired) {
+            const owned = parseOwnedName(name);
+            if (owned?.role === "worker")
+                desiredTasks.add(owned.taskId);
+        }
+        const expired = [...this.pendingProjects].filter(([, pending]) => now - pending.since > PENDING_PROJECT_GRACE_MS).filter(([taskId]) => !desiredTasks.has(taskId));
+        if (expired.length === 0)
+            return;
+        const journal = this.openRunJournal(runId);
+        if (!journal)
+            return;
+        for (const [taskId, pending] of expired) {
+            try {
+                const pendingMs = Math.max(0, now - pending.since);
+                journal.append("project-unplaced", taskId, {
+                    state: pending.state,
+                    pendingMs,
+                    graceMs: PENDING_PROJECT_GRACE_MS,
+                });
+                this.pendingProjects.delete(taskId);
+            }
+            catch {
+                /* reconcile is cosmetic; preserve the projection until a later journalled drop */
+            }
+        }
+    }
     /**
      * Sweep tickmarkr-owned terminals down to `desired`. Ownership is decided ONLY by parseOwnedName
      * over the owned TAB title, through the same panesToClose fold herdr uses (drivers/types.ts): an
@@ -1091,6 +1139,7 @@ export class OrcaDriver {
      * Cosmetic by contract: every failure is swallowed, per candidate and overall.
      */
     async reconcile(desired, runId, opts) {
+        this.dropExpiredProjects(desired, runId);
         try {
             // Every call below is handle-addressed or explicitly selectored, so the CLI's own cwd selects
             // nothing — it only has to exist, which the checkouts being swept no longer need to.

package/dist/drivers/types.d.ts

@@ -76,7 +76,7 @@ export interface ExecutorDriver {
     /** The exact terminal read surface used for liveness evidence. */
     readSource?: string;
     /** Placement facts returned by drivers whose terminal host exposes them. */
-    describe?(slot: Slot): SlotPlacement | Promise<SlotPlacement>;
+    describe?(slot: Slot): SlotPlacement | Promise<SlotPlacement> | undefined;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
     run(slot: Slot, cmd: string): Promise<void>;
     waitOutput(slot: Slot, pattern: string, timeoutMs: number, opts?: {

package/dist/gates/baseline.d.ts

@@ -24,7 +24,9 @@ export interface BaselineCommand {
     fingerprints: string[];
     missingCommand?: boolean;
     /** Why a capture returned no verdict. */
-    invalidCause?: "ceiling-kill" | "resource-exhaustion";
+    invalidCause?: "ceiling-kill" | "resource-exhaustion" | "infra";
+    /** The runner's summary was green and only its teardown fingerprint followed. */
+    teardownFingerprint?: true;
     /** What this command actually took at capture, on a pristine tree. Absent in pre-v1.90 baselines. */
     durationMs?: number;
     /** Sum of the per-file durations named by the runner; null when its output names none. */
@@ -154,4 +156,26 @@ export declare function detectVacuousOracles(cwd: string, tasks: ReadonlyArray<{
     id: string;
     acceptance: AcceptanceItem[];
 }>): Promise<VacuousOracleWarning[]>;
-export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[]): Promise<GateResult[]>;
+export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[], opts?: {
+    rerunOf?: HostStarvedRerun;
+}): Promise<GateResult[]>;
+export interface HostStarvedRerun {
+    durationMs: number;
+    referenceMs: number;
+    waitedMs: number;
+}
+export type RunnerVerdict = FailureClassification | "green-teardown" | undefined;
+/** One interpretation of runner bytes, shared by baseline capture and every gate consumer. */
+export declare function classifyRunnerOutput(raw: string, code: number): RunnerVerdict;
+export declare const HOST_STARVED_DURATION_FACTOR = 2;
+/** Every fresh failure head is timeout-class and the suite took twice its own baseline measurement. */
+export declare function hostStarved(fresh: string, durationMs: number, referenceMs: number | undefined): boolean;
+interface CalmWindow {
+    pollMs: number;
+    maxWaitMs: number;
+    loadProvider: () => number;
+    calmLoad: () => number;
+}
+export declare function setCalmWindowForTests(over: Partial<CalmWindow>): void;
+export declare function resetCalmWindowForTests(): void;
+export {};

package/dist/gates/baseline.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
+import { availableParallelism, loadavg } from "node:os";
 import { join } from "node:path";
 import { DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 // incident #2 (run-20260709-104447): a vitest ✓ PASS line with "error" in the test NAME, wrapped in ANSI
@@ -501,11 +502,20 @@ export async function captureBaseline(cwd, commands) {
             base.commands[name] = invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines);
             continue;
         }
+        // OBS-885/887: capture and gate ask the same classifier. A green summary followed only by the
+        // teardown fingerprint is a pass; infrastructure without a summary is no verdict to forgive.
+        const runnerVerdict = classifyRunnerOutput(raw, r.code);
+        if (runnerVerdict === "infra") {
+            console.error(`tickmarkr: baseline capture for "${name}" carries runner-infrastructure evidence and no green summary — it recorded NO verdict; nothing is forgiven for this command`);
+            base.commands[name] = invalidCaptureEntry(durationMs, "infra");
+            continue;
+        }
         base.commands[name] = {
-            exitCode: r.code,
+            exitCode: runnerVerdict === "green-teardown" ? 0 : r.code,
+            ...(runnerVerdict === "green-teardown" ? { teardownFingerprint: true } : {}),
             // a command that exits 0 has no failures to fingerprint — recording any would be a lie the
             // compare step then has to forgive
-            fingerprints: r.code === 0 ? [] : fingerprint(raw),
+            fingerprints: r.code === 0 || runnerVerdict === "green-teardown" ? [] : fingerprint(raw),
             missingCommand: missingConfiguredCommand(cmd, r),
             durationMs,
             ...fileTiming(raw, durationMs),
@@ -570,8 +580,9 @@ function headlineDetails(raw, fresh) {
         meta: { failingTests: headlines.filter(namesFailureEitherForm) },
     };
 }
-export async function compareToBaseline(cwd, commands, baseline, enabled) {
+export async function compareToBaseline(cwd, commands, baseline, enabled, opts = {}) {
     const results = [];
+    const rerunOf = opts.rerunOf;
     for (const name of enabled) {
         const cmd = commands[name];
         if (!cmd) {
@@ -595,7 +606,13 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // states no capacity — a row that never divided the machine must not claim that it did.
         const record = (g) => {
             const withReap = r.reapedGroup ? { ...g, meta: { ...g.meta, reapedGroup: true } } : g;
-            results.push(r.capacity ? { ...withReap, capacity: r.capacity } : withReap);
+            const withReapError = r.reapError ? { ...withReap, meta: { ...withReap.meta, reapError: r.reapError } } : withReap;
+            const withRerun = rerunOf ? {
+                ...withReapError,
+                details: `host-starved rerun after waiting ${rerunOf.waitedMs}ms for a calm load window: ${withReapError.details}`,
+                meta: { ...withReapError.meta, hostStarvedRerun: rerunOf },
+            } : withReapError;
+            results.push(r.capacity ? { ...withRerun, capacity: r.capacity } : withRerun);
         };
         // …and whether the entry that would forgive this command was measured in the same world. A
         // baseline captured under a different fork cap forgives nothing: its fingerprints describe a
@@ -629,6 +646,12 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
             continue;
         }
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
+        // OBS-885/887: the same classifier the capture applied names a completed green suite on both sides.
+        const runnerVerdict = classifyRunnerOutput(raw, r.code);
+        if (runnerVerdict === "green-teardown") {
+            record({ gate: name, pass: true, details: `exit ${r.code} after a green suite summary; only the runner's teardown fingerprint followed it`, meta: { teardownFingerprint: true } });
+            continue;
+        }
         // OBS-278: only a failure SHAPE is a verdict — everything fingerprint() keeps is one, except the
         // unrecognized-output marker, which is evidence for the operator and never grounds to reject.
         // ponytail: ceiling — a runner whose failure output holds no shape above and whose baseline is
@@ -640,10 +663,20 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // T9: classify the FRESH diff before charging it. The complete runner output can legitimately
         // contain a baseline-recorded assertion beside a newly introduced infrastructure death; letting
         // that known assertion outvote the fresh birpc line turns machine failure into a worker defect.
-        // `classifyFailureOutput` remains the single discriminator. When there is no fresh fingerprint,
+        // `classifyRunnerOutput` remains the single discriminator. When there is no fresh fingerprint,
         // retain the whole-output read so a repeated infra abort can never be baseline-forgiven as green.
-        const freshClassification = failing.length ? classifyFailureOutput(failing.join("\n")) : undefined;
-        const classification = freshClassification ?? (!failing.length ? classifyFailureOutput(raw) : undefined);
+        const freshVerdict = failing.length ? classifyRunnerOutput(failing.join("\n"), r.code) : undefined;
+        const freshClassification = freshVerdict === "infra" || freshVerdict === "regression" ? freshVerdict : undefined;
+        const classification = freshClassification ?? (!failing.length && (runnerVerdict === "infra" || runnerVerdict === "regression") ? runnerVerdict : undefined);
+        // OBS-896: every fresh failure must be timeout-class, and the suite must take at least twice its
+        // own baseline measurement. The first read buys one calm rerun here, never a worker repair.
+        if (name === "test" && classification !== "infra" && failing.length && !rerunOf
+            && hostStarved(failing.join("\n"), r.durationMs ?? 0, entry?.durationMs)) {
+            const waitedMs = await waitForCalmWindow();
+            const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
+            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { rerunOf: provenance }));
+            continue;
+        }
         if (classification === "infra") {
             const evidence = failing.length
                 ? failing.slice(0, 10).join("\n")
@@ -708,3 +741,53 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
     }
     return results;
 }
+const SUMMARY_LINE_RE = /^[^\S\n]*Test Files[^\S\n]+(.+)$/m;
+const TEARDOWN_RE = /\[vitest-worker\]: Timeout calling\b|\[birpc\] rpc is closed, cannot call\b/;
+const UNHANDLED_HEADER_RE = /^\s*[^\w]*(?:Unhandled Errors|Uncaught Exception)\b/;
+/** One interpretation of runner bytes, shared by baseline capture and every gate consumer. */
+export function classifyRunnerOutput(raw, code) {
+    if (code === 0)
+        return undefined;
+    const lines = withoutVitestEchoBlocks(raw).map((l) => l.replace(ANSI_RE, ""));
+    const text = lines.join("\n");
+    const summary = SUMMARY_LINE_RE.exec(text);
+    if (summary) {
+        const failed = [...summary[1].matchAll(/\b(\d+)\s+failed\b/g)].map((match) => Number(match[1]));
+        const summaryGreen = failed.every((count) => count === 0);
+        const summaryLine = text.slice(0, summary.index).split("\n").length - 1;
+        const teardownLine = lines.findIndex((line, index) => index > summaryLine && TEARDOWN_RE.test(line));
+        const otherFailure = lines.some((line, index) => {
+            if (index === summaryLine || TEARDOWN_RE.test(line))
+                return false;
+            if (PASS_LINE_RE.test(line) || OPERATOR_LINE_RE.test(line))
+                return false;
+            if (index > summaryLine && UNHANDLED_HEADER_RE.test(line))
+                return false;
+            return namesRegression(line);
+        });
+        if (summaryGreen && teardownLine > summaryLine && !otherFailure)
+            return "green-teardown";
+    }
+    return classifyFailureOutput(text);
+}
+const TIMEOUT_CLASS_RE = /\b(?:Test|Hook) timed out in (?:\d+|#) ?ms\b|\bexceeded (?:\d+|#) ?(?:ms|s|seconds)\b|\btimed out after (?:\d+|#)/i;
+const ERROR_HEAD_RE = /^\s*(?:[A-Za-z][A-Za-z0-9]*Error|Error):\s/;
+export const HOST_STARVED_DURATION_FACTOR = 2;
+/** Every fresh failure head is timeout-class and the suite took twice its own baseline measurement. */
+export function hostStarved(fresh, durationMs, referenceMs) {
+    if (!referenceMs || durationMs < HOST_STARVED_DURATION_FACTOR * referenceMs)
+        return false;
+    const heads = fresh.split("\n").map((line) => line.replace(ANSI_RE, "")).filter((line) => ERROR_HEAD_RE.test(line));
+    return heads.length > 0 && heads.every((line) => TIMEOUT_CLASS_RE.test(line));
+}
+const DEFAULT_CALM = { pollMs: 5_000, maxWaitMs: 600_000, loadProvider: () => loadavg()[0] ?? 0, calmLoad: () => availableParallelism() / 2 };
+let calm = DEFAULT_CALM;
+export function setCalmWindowForTests(over) { calm = { ...calm, ...over }; }
+export function resetCalmWindowForTests() { calm = DEFAULT_CALM; }
+async function waitForCalmWindow() {
+    const started = Date.now();
+    while (calm.loadProvider() > calm.calmLoad() && Date.now() - started < calm.maxWaitMs) {
+        await new Promise((resolve) => setTimeout(resolve, calm.pollMs));
+    }
+    return Date.now() - started;
+}

package/dist/gates/review.d.ts

@@ -1,6 +1,7 @@
 import { type Assignment, type BillingChannel, type WorkerAdapter } from "../adapters/types.js";
 import { type TickmarkrConfig, type Tier } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
+import { modelProvider } from "../route/preference.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
 import { type VerdictUnparseableCause } from "./verdict-cause.js";
@@ -48,8 +49,7 @@ export declare function checkTaskDiffCaps(gate: string, measured: Pick<TaskDiffM
 export declare function isDiffCapPark(result: GateResult): boolean;
 export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
-/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
-export declare function modelProvider(model: string, fallback?: string): string;
+export { modelProvider };
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor?: Tier, // task-declared only; config floors govern workers and must not silently move review seats

package/dist/gates/review.js

@@ -8,6 +8,7 @@ import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { redactSecrets } from "../run/redact.js";
 import { marginalCostRank } from "../route/router.js";
+import { modelProvider } from "../route/preference.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlmDetailed, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
 import { captureDiffCapFor, measureArtifactDiff, reviewableLogicDiff, } from "./artifact-manifest.js";
@@ -165,24 +166,7 @@ export function diffCapParkReason(results) {
 export function modelId(model) {
     return model.slice(model.lastIndexOf("/") + 1);
 }
-/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
-export function modelProvider(model, fallback = "unknown") {
-    const id = model.toLowerCase();
-    const prefix = id.includes("/") ? id.slice(0, id.indexOf("/")) : "";
-    if (prefix === "openai" || prefix === "openai-codex" || /^(?:gpt|o\d)/.test(id))
-        return "openai";
-    if (prefix === "anthropic" || /^(?:claude|opus|sonnet|haiku|fable)(?:-|$)/.test(id))
-        return "anthropic";
-    if (prefix === "google" || /^gemini(?:-|$)/.test(id))
-        return "google";
-    if (prefix === "xai" || /^grok(?:-|$)/.test(id))
-        return "xai";
-    if (["zai", "zhipu", "zai-coding-plan"].includes(prefix) || /^glm(?:-|$)/.test(id))
-        return "zhipu";
-    if (["kimi-code", "moonshot"].includes(prefix) || /^kimi(?:-|$)/.test(id))
-        return "moonshot";
-    return fallback;
-}
+export { modelProvider };
 // v1.53 T2: same entry grammar as routing.map.prefer (router.ts preferIndex — router is out of this
 // module's dependency direction for a private fn, so the 3 lines live here too): `adapter` matches
 // every channel of that adapter, `adapter:model` exactly one; unmatched channels sort after all entries.

package/dist/graph/graph.d.ts

@@ -1,6 +1,26 @@
 import { type RunGraph, type Task, type TaskStatus } from "./schema.js";
 export declare function stateDirName(_repoRoot: string): string;
 export declare function graphPath(repoRoot: string): string;
+export interface CompileRefusalRecord {
+    refusedAt: string;
+    source: string;
+    error: string;
+}
+export declare function compileRefusalPath(repoRoot: string): string;
+export declare function readCompileRefusal(repoRoot: string): CompileRefusalRecord | undefined;
+export declare function saveCompileRefusal(repoRoot: string, record: CompileRefusalRecord): void;
+export declare function clearCompileRefusal(repoRoot: string): void;
+export interface OnDiskSpecHash {
+    path: string;
+    hash: string;
+}
+/**
+ * Re-hash the exact single source file recorded by CLI compiles. Native and PRD record the source
+ * markdown; Spec Kit records its tasks.md. GSD combines several plan bodies and is deliberately not
+ * reconstructed here. A missing file is the one fail-open case: the refusal record is the fail-closed
+ * evidence for failed recompiles, while moved/deleted source files need not strand a compiled graph.
+ */
+export declare function onDiskSpecHash(_repoRoot: string, graph: RunGraph): OnDiskSpecHash | undefined;
 export declare function graphDefinitionHash(g: RunGraph): string;
 export declare function taskContentDigest(task: Pick<Task, "goal" | "files" | "acceptance">): string;
 export declare function tickmarkrDir(repoRoot: string): string;