tickmarkr 2.4.0 → 2.4.2

package/dist/graph/graph.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { validateGraph } from "./schema.js";
 export function stateDirName(_repoRoot) {
     return ".tickmarkr";
@@ -8,6 +8,71 @@ export function stateDirName(_repoRoot) {
 export function graphPath(repoRoot) {
     return join(repoRoot, stateDirName(repoRoot), "graph.json");
 }
+export function compileRefusalPath(repoRoot) {
+    return join(repoRoot, stateDirName(repoRoot), "compile-refusal.json");
+}
+export function readCompileRefusal(repoRoot) {
+    const path = compileRefusalPath(repoRoot);
+    if (!existsSync(path))
+        return undefined;
+    let value;
+    try {
+        value = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`compile refusal record at ${path} is unreadable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (typeof value !== "object" || value === null
+        || typeof value.refusedAt !== "string"
+        || typeof value.source !== "string"
+        || typeof value.error !== "string") {
+        throw new Error(`compile refusal record at ${path} is malformed`);
+    }
+    return value;
+}
+export function saveCompileRefusal(repoRoot, record) {
+    tickmarkrDir(repoRoot);
+    const path = compileRefusalPath(repoRoot);
+    const tmp = `${path}.${process.pid}.tmp`;
+    try {
+        writeFileSync(tmp, JSON.stringify(record, null, 2) + "\n");
+        renameSync(tmp, path);
+    }
+    catch (error) {
+        rmSync(tmp, { force: true });
+        throw error;
+    }
+}
+export function clearCompileRefusal(repoRoot) {
+    rmSync(compileRefusalPath(repoRoot), { force: true });
+}
+/**
+ * Re-hash the exact single source file recorded by CLI compiles. Native and PRD record the source
+ * markdown; Spec Kit records its tasks.md. GSD combines several plan bodies and is deliberately not
+ * reconstructed here. A missing file is the one fail-open case: the refusal record is the fail-closed
+ * evidence for failed recompiles, while moved/deleted source files need not strand a compiled graph.
+ */
+export function onDiskSpecHash(_repoRoot, graph) {
+    if (graph.spec.source === "gsd")
+        return undefined;
+    if (graph.spec.paths.length !== 1)
+        return undefined;
+    const recorded = graph.spec.paths[0];
+    // CLI compilation records an absolute source. Relative paths belong to legacy/programmatic
+    // graphs whose resolution context is unknowable here, so preserve their prior fail-open behavior.
+    if (!isAbsolute(recorded))
+        return undefined;
+    const path = recorded;
+    try {
+        const content = readFileSync(path);
+        return { path, hash: createHash("sha256").update(content).digest("hex") };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new Error(`cannot verify compiled spec hash from ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 // T3 (Sol #2 / Fable F2): ONE canonical engagement identity over COMPILED TASK DEFINITIONS only.
 // status/evidence are runtime-mutated (the daemon flips status, accumulates evidence every attempt) so
 // they are excluded — the identity survives a status flip or evidence growth but changes the instant a

package/dist/route/preference.d.ts

@@ -5,7 +5,9 @@ export interface Disallowed {
     entry: string;
 }
 export type PreferenceRole = "worker" | "judge" | "review" | "consult";
-export declare function routingModelProvider(model: string, fallback?: string): string;
+/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
+export declare function modelProvider(model: string, fallback?: string): string;
+export declare const routingModelProvider: typeof modelProvider;
 export declare const modelRouteIdentity: (model: string, fallback?: string) => string;
 export declare const channelRouteIdentity: (key: string, fallback?: string) => string;
 export declare function routingEntrySeatLines(cfg: TickmarkrConfig): string[];

package/dist/route/preference.js

@@ -2,10 +2,8 @@ import { channelKey, channelsFromConfig } from "../adapters/types.js";
 import { validateGraph } from "../graph/schema.js";
 import { route, RoutingError } from "./router.js";
 const PREFERENCE_ROLES = ["worker", "judge", "review", "consult"];
-// Keep routing retries on the same identity review diversity uses: the served provider plus the
-// unprefixed model id. Gate review owns the original modelProvider policy; this dependency-leaf copy
-// avoids importing gates back into route/run and must move with that helper when the scope permits.
-export function routingModelProvider(model, fallback = "unknown") {
+/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
+export function modelProvider(model, fallback = "unknown") {
     const id = model.toLowerCase();
     const prefix = id.includes("/") ? id.slice(0, id.indexOf("/")) : "";
     if (prefix === "openai" || prefix === "openai-codex" || /^(?:gpt|o\d)/.test(id))
@@ -22,6 +20,8 @@ export function routingModelProvider(model, fallback = "unknown") {
         return "moonshot";
     return fallback;
 }
+// Router naming remains explicit while sharing the review gate's exact function object.
+export const routingModelProvider = modelProvider;
 export const modelRouteIdentity = (model, fallback = "unknown") => `${routingModelProvider(model, fallback)}/${model.slice(model.lastIndexOf("/") + 1).toLowerCase()}`;
 export const channelRouteIdentity = (key, fallback = "unknown") => {
     const i = key.indexOf(":");

package/dist/run/consult.js

@@ -63,6 +63,7 @@ function excludedProviderFromDossier(d, adapter) {
     try {
         const events = JSON.parse(d.journalTail);
         const assignment = [...events].reverse().find((event) => event.event === "task-dispatch"
+            && event.taskId === d.taskId
             && event.data?.assignment?.adapter === adapter
             && typeof event.data.assignment.model === "string")?.data?.assignment;
         if (typeof assignment?.model !== "string")

package/dist/run/daemon.d.ts

@@ -117,6 +117,11 @@ export declare const WORKER_NUDGE_MESSAGE = "tickmarkr liveness check: if the ta
 /** Test seam — shrink the nudge gate and grace without minute-long sleeps. */
 export declare function setNudgeTimingForTests(silentMs: number, graceMs: number): void;
 export declare function resetNudgeTimingForTests(): void;
+export declare const WORKER_STARTUP_WINDOW_MS = 60000;
+export declare const WORKER_STARTUP_WINDOW_BYTES: number;
+/** Test seam — exercises both sides of the startup boundary without a production-length fixture. */
+export declare function setWorkerStartupWindowMsForTests(ms: number): void;
+export declare function resetWorkerStartupWindowMsForTests(): void;
 /** Test seam — shrink the quota-banner silence gate without minute-long sleeps. */
 export declare function setQuotaBannerSilentMsForTests(ms: number): void;
 export declare function resetQuotaBannerSilentMsForTests(): void;

package/dist/run/daemon.js

@@ -14,7 +14,7 @@ import { collateralHits } from "../compile/collateral.js";
 import { DEFAULT_DIFF_CAP, globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
 import { DeliveryReadinessError } from "../drivers/herdr.js";
 import { driverEvidence } from "../drivers/index.js";
-import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
+import { herdrSealShellPrefix, MAX_BUF, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
@@ -347,6 +347,48 @@ export function resetNudgeTimingForTests() {
 const QUOTA_BANNER_SILENT_MS = 3 * 60_000;
 let quotaBannerSilentMs = QUOTA_BANNER_SILENT_MS;
 const WORKER_STARTUP_FAILURE_RE = /(?:not logged in|authentication(?:[ _-](?:required|failed|error))|401 unauthorized|model[_ -]?not[_ -]?found|(?:model|deployment)[^\n]{0,80}(?:not found|does not exist|is unavailable)|(?:404|not[_ -]?found)[^\n]{0,80}(?:model|deployment))/i;
+// A startup banner is evidence only while the process is starting. Applying this matcher to every
+// later poll let ordinary worker prose (including a diff that mentions model-not-found handling)
+// condemn a live attempt. Bound both dimensions: time prevents a late line from becoming startup
+// evidence, and bytes prevent a chatty launch from keeping an ever-growing classification surface.
+export const WORKER_STARTUP_WINDOW_MS = EARLY_LAUNCH_LIVENESS_MS;
+export const WORKER_STARTUP_WINDOW_BYTES = 64 * 1024;
+let workerStartupWindowMs = WORKER_STARTUP_WINDOW_MS;
+/** Test seam — exercises both sides of the startup boundary without a production-length fixture. */
+export function setWorkerStartupWindowMsForTests(ms) {
+    workerStartupWindowMs = ms;
+}
+export function resetWorkerStartupWindowMsForTests() {
+    workerStartupWindowMs = WORKER_STARTUP_WINDOW_MS;
+}
+function startupFailureInWindow(output, launchedAt) {
+    if (launchedAt === undefined || Date.now() - launchedAt > workerStartupWindowMs)
+        return false;
+    const bytes = Buffer.from(output);
+    const bounded = bytes.length <= WORKER_STARTUP_WINDOW_BYTES
+        ? output
+        : bytes.subarray(0, WORKER_STARTUP_WINDOW_BYTES).toString("utf8");
+    return WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(bounded));
+}
+// OBS-901/906: one daemon-owned writer for every execution surface. Drivers expose one retained
+// stream through read(); the daemon persists that exact surface before any close/reconcile can make
+// it disappear. MAX_BUF is the execution layer's existing two-MiB retention contract; truncate the
+// encoded bytes from the head so the completion/error tail is always the part that survives.
+async function captureWorkerStream(journalDir, taskId, attempt, driver, slot, fallback) {
+    let captured = fallback;
+    try {
+        captured = await driver.read(slot, PANE_READ_ROWS);
+    }
+    catch {
+        // Earlier successful reads are still a captured stream. Persist them rather than losing the
+        // only failure evidence because the pane vanished between its terminal read and this snapshot.
+    }
+    const bytes = Buffer.from(captured);
+    const tail = bytes.length > MAX_BUF ? bytes.subarray(bytes.length - MAX_BUF) : bytes;
+    const path = posix.join("prompts", `${taskId}-a${attempt}.out`);
+    writeFileSync(join(journalDir, path), tail);
+    return { path, output: captured };
+}
 /** Test seam — shrink the quota-banner silence gate without minute-long sleeps. */
 export function setQuotaBannerSilentMsForTests(ms) {
     quotaBannerSilentMs = ms;
@@ -2329,6 +2371,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // starts at 0 (fresh budget) instead of re-parking at the cap in the same tick.
                 let providerDeathRequeues = 0;
                 let providerDeathAttempt = -1;
+                // A completed attempt may keep its pane for gate-failure context, but once another worker is
+                // funded that context is superseded and — more importantly — must not remain a second writer on
+                // the same worktree. The next loop iteration retires it before reading/recreating the tree.
+                let supersededWorkerSlot;
                 attempts: for (let attempt = rs?.attempts ?? 0;; attempt++) {
                     if (attempt !== providerDeathAttempt) {
                         providerDeathRequeues = 0;
@@ -2343,6 +2389,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                         await park(t, `attempt cap (${MAX_ATTEMPTS}) reached`, "attempt-cap", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
                         return;
                     }
+                    if (supersededWorkerSlot && !keepForever) {
+                        const prior = supersededWorkerSlot;
+                        supersededWorkerSlot = undefined;
+                        const idx = keptSlots.indexOf(prior);
+                        if (idx >= 0)
+                            keptSlots.splice(idx, 1);
+                        try {
+                            await closeSlot(prior);
+                        }
+                        catch (error) {
+                            await park(t, `superseded worker could not be swept before dispatch: ${error instanceof Error ? error.message : String(error)}`, "stall", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
+                    }
                     // OBS-419: read the approval-carried ceiling at the funding boundary, after every escalation
                     // decision but before the sole task-dispatch below. Both interactive and headless worker-launch
                     // branches are dominated by this check, so no route can fund another worker without consulting it.
@@ -2657,11 +2717,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // between task-dispatch and this line — worktree recreation, setup, prompt write, slot allocation,
                     // the launch itself — can still die with no worker having seen the brief, and `--retry-failed`
                     // must then re-send that same brief rather than a fresh prompt on a possibly banned channel.
-                    const noteLaunched = async () => journal.append("worker-launch", t.id, {
-                        attempt,
-                        retryMode,
-                        ...(trackedDriver.describe ? await trackedDriver.describe(slot) : {}),
-                    });
+                    let workerLaunchedAt;
+                    const noteLaunched = async () => {
+                        // Startup evidence begins when the worker exists, not while prompt preparation, slot
+                        // allocation, or interactive readiness is still consuming the attempt wall clock.
+                        workerLaunchedAt ??= Date.now();
+                        journal.append("worker-launch", t.id, {
+                            attempt,
+                            retryMode,
+                            ...(trackedDriver.describe ? await trackedDriver.describe(slot) : {}),
+                        });
+                    };
                     const noteWorkerLiveness = (event, data) => journal.append(event, t.id, { ...data, source: trackedDriver.readSource ?? "driver.read" });
                     let cpuFlat;
                     let cpuAccountant;
@@ -2898,7 +2964,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // latch, and the second is a no-op. A seed that answered is never re-answered by the loop.
                             if (seedResult?.trustAnswered)
                                 noteSeedTrustAnswered();
-                            startupFailure = WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(output));
+                            startupFailure = startupFailureInWindow(output, workerLaunchedAt);
                             if (seedResult?.seedFailed || startupFailure) {
                                 finished = false;
                             }
@@ -2942,6 +3008,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     const sliceStart = Date.now();
                                     const remaining = stallWindowMs - (sliceStart - lastProgressAt);
                                     let slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
+                                    const startupLeft = workerLaunchedAt === undefined
+                                        ? 0
+                                        : workerStartupWindowMs - (sliceStart - workerLaunchedAt);
+                                    if (startupLeft > 0)
+                                        slice = Math.min(slice, Math.max(1, startupLeft));
                                     if (!everHadOutput) {
                                         const earlyLeft = earlyLaunchLivenessMs - (sliceStart - attemptStart);
                                         if (earlyLeft > 0)
@@ -2961,6 +3032,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         const exit = exitRe.exec(output);
                                         if (finished || exit) {
                                             exitCode = exit ? Number(exit[1]) : null; // null ⇔ the TUI is still alive
+                                            processExited = exit !== null;
                                             await sampleContext(); // final poll-seam sample before leaving the wait
                                             break;
                                         }
@@ -3000,7 +3072,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     if (paneText.length > 0)
                                         everHadOutput = true;
-                                    if (WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(paneText))) {
+                                    if (startupFailureInWindow(paneText, workerLaunchedAt)) {
                                         startupFailure = true;
                                         output = paneText;
                                         break;
@@ -3353,6 +3425,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         const exit = exitRe.exec(output);
                                         if (finished || exit) {
                                             exitCode = exit ? Number(exit[1]) : null;
+                                            processExited = exit !== null;
                                             await sampleContext();
                                             break;
                                         }
@@ -3398,6 +3471,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     finished = new RegExp(trailerPattern(nonce)).test(output);
                                     const exit = exitRe.exec(output);
                                     exitCode = exit ? Number(exit[1]) : null;
+                                    processExited = exit !== null;
                                 }
                                 if (finished) {
                                     await driver.waitAgentStatus(slot, "idle", 5_000); // settle, then re-harvest the final render
@@ -3444,7 +3518,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // v1.76: same monotonic-progress measure as the interactive site; harvest stays raw.
                             const stallWindowMs = taskTimeoutMinutes * 60_000;
                             const initialPane = await driver.read(slot, 500);
-                            startupFailure = WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(initialPane));
+                            startupFailure = startupFailureInWindow(initialPane, workerLaunchedAt);
                             let everHadOutput = initialPane.length > 0;
                             const stallProgress = new StallProgressTracker();
                             stallProgress.observe({ paneText: initialPane, seedSubmitted: true, contextTokens });
@@ -3460,6 +3534,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                             while (!startupFailure && Date.now() - lastProgressAt < stallWindowMs) {
                                 const remaining = stallWindowMs - (Date.now() - lastProgressAt);
                                 let slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
+                                const startupLeft = workerLaunchedAt === undefined
+                                    ? 0
+                                    : workerStartupWindowMs - (Date.now() - workerLaunchedAt);
+                                if (startupLeft > 0)
+                                    slice = Math.min(slice, Math.max(1, startupLeft));
                                 if (!everHadOutput) {
                                     const earlyLeft = earlyLaunchLivenessMs - (Date.now() - attemptStart);
                                     if (earlyLeft > 0)
@@ -3474,7 +3553,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 const paneText = await driver.read(slot, 500);
                                 if (paneText.length > 0)
                                     everHadOutput = true;
-                                if (WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(paneText))) {
+                                if (startupFailureInWindow(paneText, workerLaunchedAt)) {
                                     startupFailure = true;
                                     break;
                                 }
@@ -3516,12 +3595,52 @@ export async function runDaemon(repoRoot, opts = {}) {
                     if (interactive && finished && !exitRe.test(output)) {
                         await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, 2_000, { regex: true });
                     }
-                    // keepPanes retains visible context, not a timed-out subprocess tree. Close before consult/retry
-                    // can recreate the worktree; Herdr and subprocesses that reached their exit marker stay unchanged.
-                    if (keepOpen && (finished || processExited || driver.id !== "subprocess"))
+                    // Free availability reroutes deliberately reuse the charged-attempt ordinal. Stream artifacts
+                    // cannot: every dispatch owns bytes that must remain independently recoverable, so derive the
+                    // append-only dispatch ordinal from the journal instead of overwriting an earlier a<n>.out.
+                    const streamAttempt = journal.read().filter((event) => event.event === "task-dispatch" && event.taskId === t.id).length - 1;
+                    const capturedStream = await captureWorkerStream(journal.dir, t.id, streamAttempt, driver, slot, output);
+                    // An interactive settle already selected the bounded parse it is allowed to use. Every other
+                    // path parses the common final stream snapshot — notably envelope adapters whose trailer is
+                    // encoded and therefore invisible to the raw wait regex. Keep `output` bounded: every text
+                    // classifier below retains its pre-artifact tail surface.
+                    let result = settleParsed ?? adapter.parse(capturedStream.output, nonce);
+                    const adapterCause = result.cause;
+                    // Law 46: there is one completion fact. A classified adapter result with no parse-failure cause
+                    // means its decoder found the nonce-bound trailer even when the raw JSON envelope escaped it.
+                    const workerFinished = finished || adapterCause === undefined;
+                    finished = workerFinished;
+                    const adapterStartupFailure = adapterCause === "startup-failure";
+                    const workerCause = adapterStartupFailure
+                        ? "startup-failure"
+                        : startupFailure
+                            ? "startup-failure"
+                            : classifyWorkerResultCause({ output, ok: result.ok, finished: workerFinished, exitCode, summary: result.summary, timedOut, deadChannel: deadChannelKilled });
+                    // OBS-897/889(4): neither a timeout/quiet-harvest nor a trailer is a verdict on a tree while
+                    // its writer remains alive. Reap through the same driver lifecycle every execution surface
+                    // already implements, then (and only then) permit commitsAheadOf/gates below to read the tree.
+                    // A failed reap is a stall disposition, never permission to gate a moving branch.
+                    let reapFailure;
+                    if (!processExited && !deadWorkerPark) {
+                        try {
+                            await closeSlot(slot);
+                            if (!workerFinished) {
+                                journal.append("worker-reaped-before-harvest", t.id, {
+                                    slot: slot.name, attempt, cause: workerCause ?? "stall-timeout",
+                                });
+                            }
+                        }
+                        catch (error) {
+                            reapFailure = error instanceof Error ? error.message : String(error);
+                        }
+                    }
+                    else if (keepOpen && (workerFinished || processExited || driver.id !== "subprocess")) {
                         keptSlots.push(slot);
-                    else
+                        supersededWorkerSlot = slot;
+                    }
+                    else {
                         await closeSlot(slot);
+                    }
                     // SPEND-01: usage from the harness's own cwd-keyed structured store, read POST-HOC from disk —
                     // `wt` is this task's private worktree, so the path is unique; the read is sliced to records
                     // stamped at/after this attempt's dispatch instant. Never the harvested pane text, never the
@@ -3537,15 +3656,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                         await park(t, deadWorkerPark.reason, "stall", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { ref: deadWorkerPark.ref });
                         return;
                     }
-                    let result = settleParsed ?? adapter.parse(output, nonce);
-                    const workerFinished = finished;
-                    const workerCause = startupFailure
-                        ? "startup-failure"
-                        : classifyWorkerResultCause({ output, ok: result.ok, finished, exitCode, summary: result.summary, timedOut, deadChannel: deadChannelKilled });
                     journal.append("worker-result", t.id, {
                         ok: result.ok, summary: result.summary, deviations: result.deviations, finished: workerFinished, exitCode,
-                        mode: interactive ? "interactive" : "print", ...(workerCause ? { cause: workerCause } : {}),
+                        mode: interactive ? "interactive" : "print", stream: capturedStream.path,
+                        ...(workerCause ? { cause: workerCause } : {}),
                     });
+                    if (reapFailure) {
+                        await park(t, `worker could not be reaped before harvest: ${reapFailure}`, "stall", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { reapFailure });
+                        return;
+                    }
                     // T2 review (routing precedence): provider-death, quota and dead-channel classification
                     // derive from ONE rule — the worker's OWN outcome, workerFinished and this PRE-HARVEST
                     // parse — never from the synthesized result below. A worker that committed and then walled
@@ -3632,6 +3751,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     catch { /* cosmetic — reconcile is the backstop */ }
                                 }
+                                if (supersededWorkerSlot === slot)
+                                    supersededWorkerSlot = undefined;
                             }
                             // v1.8 TEL-05 — FROM-channel attribution for mid-task quota failover: `assignment` is still the
                             // throttled-away-FROM channel here (before the reassign below). durationMs:0 marks this as a
@@ -3658,7 +3779,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // T2 review: classify the PRE-HARVEST parse — classifyDeadChannel bails on any ok:true
                     // result, so reading the synthesized harvest result would swallow auth-required /
                     // setup-required / provider-outage for every committed-but-walled attempt (in both modes).
-                    const dead = classifyDeadChannel(preHarvestResult) ?? (earlyLaunchDead || startupFailure ? "setup-required" : undefined);
+                    const dead = classifyDeadChannel({ ...preHarvestResult, raw: output })
+                        ?? (earlyLaunchDead || startupFailure || adapterStartupFailure ? "setup-required" : undefined);
                     if (dead) {
                         const from = channelKey(assignment);
                         demotedChannels.add(from); // excluded for later attempts AND later tasks in this run
@@ -3677,12 +3799,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     catch { /* cosmetic — reconcile is the backstop */ }
                                 }
+                                if (supersededWorkerSlot === slot)
+                                    supersededWorkerSlot = undefined;
                             }
                             assignment = next;
                             tried.push(channelKey(next));
+                            // Startup failures bought no worker turn: preserve the attempt ordinal/budget while the
+                            // verified-dead channel remains excluded for every later dispatch in this run.
+                            if (adapterStartupFailure || startupFailure)
+                                attempt--;
                             continue;
                         }
-                        await park(t, `dead channel (${dead}) and no eligible channel remains`, "reroute-exhausted", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                        const chargedAttempts = adapterStartupFailure || startupFailure ? attempt : attempt + 1;
+                        await park(t, `dead channel (${dead}) and no eligible channel remains`, "reroute-exhausted", assignment, chargedAttempts, startMs, gateFails, consults, tokens, metered, retryMode);
                         return;
                     }
                     if (!finished) {

package/dist/run/git.d.ts

@@ -92,6 +92,8 @@ export interface ShResult {
     timedOut?: boolean;
     /** The shell exited, but descendants still held its process group and pipes past the grace. */
     reapedGroup?: boolean;
+    /** The grace reap's group kill failed with something other than ESRCH (for example EPERM). */
+    reapError?: string;
     durationMs?: number;
     /** T7: the capacity THIS child ran under, stamped where its environment was built (see `shell`). */
     capacity?: RunCapacity;

package/dist/run/git.js

@@ -174,6 +174,7 @@ function shell(cmd, cwd, timeoutMs, login) {
         const stdoutDecoder = new StringDecoder("utf8");
         const stderrDecoder = new StringDecoder("utf8");
         let timedOut = false, reapedGroup = false, done = false, started = false, outputSeen = false;
+        let reapError, exitedCode;
         let reapTimer;
         const finish = (code, err) => {
             if (done)
@@ -191,6 +192,7 @@ function shell(cmd, cwd, timeoutMs, login) {
                 durationMs: Date.now() - startedAt,
                 capacity,
                 ...(reapedGroup ? { reapedGroup: true } : {}),
+                ...(reapError ? { reapError } : {}),
             });
         };
         const timer = setTimeout(() => {
@@ -198,8 +200,15 @@ function shell(cmd, cwd, timeoutMs, login) {
             try {
                 process.kill(-p.pid, "SIGKILL");
             }
-            catch {
+            catch (error) {
+                const code = error?.code;
+                if (code !== "ESRCH") {
+                    reapError ??= `${code ?? "kill"}: ${error instanceof Error ? error.message : String(error)}`;
+                }
                 p.kill("SIGKILL");
+                // A failed group kill can leave inherited pipes open forever; the command ceiling still wins.
+                if (code !== "ESRCH")
+                    finish(exitedCode ?? 1);
             }
         }, timeoutMs);
         p.on("spawn", () => { started = true; }); // the command exists from here on — never retryable past it
@@ -233,8 +242,9 @@ function shell(cmd, cwd, timeoutMs, login) {
         // cannot hold this promise until the command ceiling. A real timeout wins first and is never
         // reclassified as a grace reap.
         p.on("exit", (code) => {
+            exitedCode = code ?? 1;
             if (timedOut) {
-                finish(code ?? 1);
+                finish(exitedCode);
                 return;
             }
             reapTimer = setTimeout(() => {
@@ -244,8 +254,12 @@ function shell(cmd, cwd, timeoutMs, login) {
                     process.kill(-p.pid, "SIGKILL");
                     reapedGroup = true;
                 }
-                catch {
-                    // The group closed between the shell's exit and the grace boundary; "close" owns finish.
+                catch (error) {
+                    // ESRCH means the group closed in the grace race; every other error must survive to the
+                    // result while the command timeout remains the explicit backstop.
+                    const code = error?.code;
+                    if (code !== "ESRCH")
+                        reapError = `${code ?? "kill"}: ${error instanceof Error ? error.message : String(error)}`;
                 }
             }, SHELL_REAP_GRACE_MS);
         });

package/dist/run/journal.d.ts

@@ -196,7 +196,7 @@ export declare const PARK_KINDS: readonly ["human-gate", "ladder-exhausted", "at
 export type ParkKind = (typeof PARK_KINDS)[number];
 export declare const RETRY_MODES: readonly ["resume", "fresh", "repair"];
 export type RetryMode = (typeof RETRY_MODES)[number];
-export declare const WORKER_RESULT_CAUSES: readonly ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer"];
+export declare const WORKER_RESULT_CAUSES: readonly ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer", "startup-failure"];
 export type WorkerResultCause = (typeof WORKER_RESULT_CAUSES)[number];
 export declare function isQualityFailureParkKind(kind: ParkKind): boolean;
 export declare function classifyTaskFailure(taskEvents: JournalEvent[]): ParkKind;

package/dist/run/journal.js

@@ -782,7 +782,7 @@ export const RETRY_MODES = ["resume", "fresh", "repair"];
 // concludes a worker while the rolling stall window still has most of its time left, so labelling it
 // stall-timeout points every downstream reader — the repair brief, the consult — at a mechanism that
 // cannot have fired.
-export const WORKER_RESULT_CAUSES = ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer"];
+export const WORKER_RESULT_CAUSES = ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer", "startup-failure"];
 // Status consumes the routing profile's existing quality split directly: verified park kinds classify
 // to 0, while availability/recovery noise classifies to null. Keep the synthetic row here at the
 // run↔route seam so presentation code never grows a second list of "bad" park kinds.

package/dist/run/lock.d.ts

@@ -9,6 +9,10 @@ export interface Inspection {
     mtimeMs: number;
     ino: number;
 }
+export type RunLineEvent = {
+    event: string;
+    ts: string;
+};
 export declare function shouldRefuse(i: Pick<Inspection, "garbage" | "dead">): boolean;
 export declare function isPidLive(pid: number): boolean;
 export declare function acquireRunLock(repoRoot: string, runId: string): {
@@ -29,6 +33,8 @@ export declare function runLockOwner(repoRoot: string): {
     runId?: string;
     live: boolean;
 } | undefined;
+export declare function runLockRunId(repoRoot: string): string | undefined;
+export declare function runStatusLine(repoRoot: string, runId: string, events: readonly RunLineEvent[]): string | null;
 export declare function isRunLockLive(repoRoot: string): boolean;
 export declare function unlockRun(repoRoot: string): {
     held: false;

package/dist/run/lock.js

@@ -2,6 +2,7 @@ import { linkSync, readFileSync, statSync, unlinkSync, utimesSync, writeFileSync
 import { join } from "node:path";
 import { z } from "zod";
 import { tickmarkrDir, stateDirName } from "../graph/graph.js";
+import { parseRunId } from "./journal.js";
 // HARD-01/02: coarse per-run advisory lock over .tickmarkr/graph.json. LOCK-02: the lock is created by
 // the link(2) idiom — write the full payload to graph.lock.<pid>.tmp, then linkSync(tmp, lockPath),
 // which is atomic and throws EEXIST if the lock already exists (the mutual-exclusion primitive).
@@ -238,7 +239,7 @@ export async function acquireApprovalSerialization(repoRoot, runId) {
 export function runLockOwner(repoRoot) {
     let insp;
     try {
-        insp = inspect(lockPath(repoRoot));
+        insp = inspect(join(repoRoot, stateDirName(repoRoot), "graph.lock"));
     }
     catch {
         return undefined;
@@ -247,6 +248,45 @@ export function runLockOwner(repoRoot) {
     // REPOSITORY-wide, so a live pid here is not proof it is running the run the caller cares about.
     return { pid: insp.pid, runId: insp.runId, live: shouldRefuse(insp) };
 }
+export function runLockRunId(repoRoot) {
+    const runId = runLockOwner(repoRoot)?.runId;
+    if (runId === undefined)
+        return undefined;
+    try {
+        return parseRunId(runId);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function runStatusLine(repoRoot, runId, events) {
+    let parsedRunId;
+    try {
+        parsedRunId = parseRunId(runId);
+    }
+    catch {
+        return null;
+    }
+    const owner = runLockOwner(repoRoot);
+    const ownerRunId = owner?.runId === undefined ? undefined : (() => {
+        try {
+            return parseRunId(owner.runId);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (owner && ownerRunId === parsedRunId) {
+        if (owner.live)
+            return `run ${parsedRunId} active`;
+        return owner.pid === undefined
+            ? `run ${parsedRunId} stale lock`
+            : `run ${parsedRunId} stale lock naming dead holder pid ${owner.pid}`;
+    }
+    if (events.some((event) => event.event === "run-end"))
+        return null;
+    return `run ${parsedRunId} abandoned since ${events.at(-1)?.ts ?? "unknown"}`;
+}
 // Read-only predicate: true iff a lock exists that the decision table would REFUSE on (alive,
 // EPERM, or ANY garbage). A provably-dead holder (ESRCH) reads not-live (LOCK-02/OBS-05). Never
 // mutates the lock. compile now acquires via acquireRunLock; this remains for drift oracles/tests.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",