tickmarkr 2.4.2 → 2.5.1

package/dist/gates/llm.js

@@ -1,3 +1,4 @@
+import { stripVTControlCharacters } from "node:util";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes } from "node:crypto";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
@@ -5,7 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { matchesTrustDialog } from "../adapters/types.js";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
-import { bannerShell, paneDispatchCommand } from "../brand.js";
+import { bannerShell, paneDispatchCommand, PLAIN_BANNER } from "../brand.js";
 import { sh } from "../run/git.js";
 import { harvestCpuFlatWindowMs, normalizeStallSnapshot, WorkerTreeCpuAccountant, } from "../run/stall.js";
 export const GATE_PANE_SEP = " · ";
@@ -129,13 +130,164 @@ export async function captureLlmOutput(run) {
     const value = await llmOutputCapture.run(outputs, run);
     return { value, outputs };
 }
+// The harness preamble has a fixed row shape, in order: the dispatch echo rows (the identity export
+// and the START printf, each possibly re-echoed behind the shell prompt), the START acknowledgement
+// row, the banner rows, blank rows, and the identity row. RULING-229-15 add.1 makes the boundary
+// STRUCTURAL: a pane read is line-terminated, so only the LAST row of a capture can be a partial
+// paint. Every row before it is complete, and a complete row is harness only when it EQUALS a full
+// harness row in the position the preamble allows. A complete row that merely starts with "T",
+// "export", "review" or a banner glyph is seat text, and seat prose that MENTIONS a marker mid-row
+// counts in full — "contains TICKMARKR_START_ somewhere" is never by itself a reason to measure zero.
+const BANNER_ROWS = PLAIN_BANNER.replace(/\n$/, "").split("\n");
+const ECHO_OPENER = "export HERDR_WORKSPACE_ID=";
+const ECHO_START_OPENER = "printf '%s%s\\n' 'TICKMARKR_START_' '";
+const ECHO_OPENERS = [ECHO_OPENER, ECHO_START_OPENER];
+// RULING-229-15 add.5: the prompt glyph set is this CLOSED list — the corpus sweeps it, the grammar
+// consumes the LONGEST glyph that matches (so ">>" is one glyph and ">" is still one).
+export const PROMPT_GLYPHS = ["➜", "❯", "$", "%", ">>", ">"];
+const GIT_SEGMENT_OPEN = "git:(";
+function echoRowMatch(row) {
+    const opener = (at) => {
+        const body = row.slice(at);
+        if (ECHO_OPENERS.some((o) => body.startsWith(o)))
+            return "complete";
+        return ECHO_OPENERS.some((o) => o.startsWith(body)) ? "partial" : "none";
+    };
+    const ws = (at) => /^\s+/.exec(row.slice(at))?.[0].length;
+    const bare = opener(0);
+    if (bare !== "none")
+        return bare;
+    const glyph = PROMPT_GLYPHS.find((g) => row.startsWith(g));
+    if (glyph === undefined)
+        return "none";
+    let i = glyph.length;
+    const ws1 = ws(i);
+    if (ws1 === undefined)
+        return row.length === i ? "partial" : "none";
+    i += ws1;
+    const dir = /^\S+/.exec(row.slice(i));
+    if (!dir)
+        return "partial";
+    i += dir[0].length;
+    const ws2 = ws(i);
+    if (ws2 === undefined)
+        return "partial";
+    i += ws2;
+    const rest = row.slice(i);
+    if (rest.startsWith(GIT_SEGMENT_OPEN)) {
+        const close = row.indexOf(")", i + GIT_SEGMENT_OPEN.length);
+        if (close < 0)
+            return "partial";
+        i = close + 1;
+        const ws3 = ws(i);
+        if (ws3 === undefined)
+            return row.length === i ? "partial" : "none";
+        return opener(i + ws3);
+    }
+    if (GIT_SEGMENT_OPEN.startsWith(rest))
+        return "partial"; // "", "g", "gi", "git", "git:"
+    return opener(i);
+}
+// A complete dispatch echo row: the grammar reaches the opener. Never "contains the opener" — a row
+// that mentions it mid-prose is the seat's.
+function completeEchoRow(row) {
+    return echoRowMatch(row) === "complete";
+}
+// A LAST row still being painted: any prefix of a row in the grammar.
+function partialEchoRow(row) {
+    return echoRowMatch(row) !== "none";
+}
+const START_MARKER = "TICKMARKR_START_";
+const START_ROW = /^TICKMARKR_START_[\w-]+$/;
+const IDENTITY_LINE = /^(?:review\s*·|tickmarkr(?::|$))/;
+const IDENTITY_OPENERS = ["review ·", "tickmarkr"];
+// Stages of the preamble walk. Each complete harness row is accepted only at or after its stage.
+const ECHO = 0, START = 1, BANNER = 2, IDENTITY = 3, SEAT = 4;
+// The char offset where the seat's own text begins, or -1 when the capture ends inside the preamble.
+function seatStart(output) {
+    const rows = output.split("\n");
+    if (rows.length > 1 && rows[rows.length - 1] === "")
+        rows.pop(); // the read's own line terminator
+    let stage = ECHO;
+    let bannerAt; // next banner row expected once the banner has begun
+    let offset = 0;
+    for (let i = 0; i < rows.length; i++) {
+        const row = rows[i].replace(/[ \t]+$/, "");
+        const t = row.trim();
+        const last = i === rows.length - 1;
+        // Complete harness rows: equality against the shape the preamble allows at this stage.
+        let accepted = false;
+        if (stage < SEAT && t.length === 0)
+            accepted = true; // blank rows between preamble rows
+        else if (stage <= ECHO && completeEchoRow(row))
+            accepted = true;
+        else if (stage <= START && START_ROW.test(row)) {
+            stage = BANNER;
+            accepted = true;
+        }
+        else if (stage <= BANNER && bannerAt === undefined && BANNER_ROWS.includes(row)) {
+            stage = BANNER;
+            bannerAt = BANNER_ROWS.indexOf(row) + 1;
+            accepted = true;
+        }
+        else if (stage <= BANNER && bannerAt !== undefined && row === BANNER_ROWS[bannerAt]) {
+            bannerAt++;
+            accepted = true;
+        }
+        else if (stage <= IDENTITY && IDENTITY_LINE.test(t)) {
+            stage = SEAT;
+            accepted = true;
+        }
+        if (accepted) {
+            offset += rows[i].length + 1;
+            continue;
+        }
+        if (!last)
+            return offset;
+        // The last row may be a partial paint: a prefix of the next harness row the preamble allows.
+        if (stage <= ECHO && partialEchoRow(row))
+            return -1;
+        if (stage <= START && (START_MARKER.startsWith(row) || /^TICKMARKR_START_[\w-]*$/.test(row)))
+            return -1;
+        if (stage <= BANNER && (bannerAt === undefined
+            ? BANNER_ROWS.some((b) => b.startsWith(row))
+            : BANNER_ROWS[bannerAt]?.startsWith(row) === true))
+            return -1;
+        // The identity row is painted right after the banner, so its prefix is a partial paint only there;
+        // with no banner in the capture, "review" or "tick" alone is the seat's own first row.
+        if (stage <= IDENTITY && bannerAt === BANNER_ROWS.length && IDENTITY_OPENERS.some((o) => o.startsWith(t)))
+            return -1;
+        return offset;
+    }
+    return -1; // every row was harness — the seat has not taken its turn
+}
+// A pane's dispatch echo, start acknowledgement, banner and identity are harness bytes.
+// Remove only that leading preamble, never matching text later in the seat's response.
+// Every capture taken before the preamble finishes therefore measures ZERO seat-authored bytes,
+// which is what makes the caller's running Math.max safe: a partial banner counted once would be
+// retained for the whole call and buy a silent seat its full ceiling.
+export function reviewSeatOutput(raw, nonce) {
+    const output = stripVTControlCharacters(raw).replace(/\r\n?/g, "\n");
+    const start = seatStart(output);
+    if (start < 0)
+        return "";
+    const seat = output.slice(start);
+    // Anything after the nonce-bound trailer belongs to the terminal (typically the next shell
+    // prompt), not the reviewer. Deleting only the marker would count that postlude as seat output and
+    // let a zero-byte seat escape first-silence demotion.
+    const trailer = new RegExp(`(?:^|\\n)TICKMARKR_EXIT_${nonce}:\\d+[^\\n]*(?:\\n|$)`).exec(seat);
+    // A trailer row still being typed is not stripped: after the preamble a last row "T" is far more
+    // often the seat's first byte than the harness's exit marker, and the next read completes either.
+    return trailer ? seat.slice(0, trailer.index) : seat;
+}
+export const REVIEW_FIRST_LIVENESS_MS = 30_000;
 async function runHeadlessDetailed(adapter, model, prompt, cwd, timeoutMs = 300000) {
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
     try {
         const pf = join(dir, "prompt.md");
         writeFileSync(pf, prompt);
         const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
-        return { output: r.stdout + "\n" + r.stderr, exitCode: r.code, timedOut: r.timedOut === true };
+        return { output: r.stdout + "\n" + r.stderr, exitCode: r.code, timedOut: r.timedOut === true, seatAuthoredBytes: Buffer.byteLength(r.stdout + r.stderr) };
     }
     finally {
         rmSync(dir, { recursive: true, force: true });
@@ -150,6 +302,7 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
     let slot;
     let accountant;
+    let forceClose = false;
     try {
         const pf = join(dir, "prompt.md");
         writeFileSync(pf, prompt);
@@ -180,6 +333,8 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
         const exitPattern = `TICKMARKR_EXIT_${nonce}:\\d`;
         let out;
         let timedOut = false;
+        let launchNeverStarted = false;
+        let seatAuthoredBytes = 0;
         const gatePrompt = prompt.startsWith("TICKMARKR-JUDGE") || prompt.startsWith("TICKMARKR-REVIEW");
         if (!gatePrompt) {
             await via.driver.waitOutput(slot, exitPattern, timeoutMs, { regex: true });
@@ -193,6 +348,9 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
             await accountant.start();
             const startedAt = Date.now();
             out = await via.driver.read(slot, 400);
+            const reviewing = prompt.startsWith("TICKMARKR-REVIEW");
+            seatAuthoredBytes = Buffer.byteLength(reviewSeatOutput(out, nonce));
+            let firstLivenessObserved = false;
             let priorSnapshot = normalizeStallSnapshot(out);
             const anchoredAt = Date.now();
             let quietSince = anchoredAt;
@@ -207,12 +365,35 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
                 const matched = await via.driver.waitOutput(slot, exitPattern, sliceMs, { regex: true });
                 const raw = await via.driver.read(slot, 400);
                 out = raw;
+                seatAuthoredBytes = Math.max(seatAuthoredBytes, Buffer.byteLength(reviewSeatOutput(raw, nonce)));
                 // waitOutput is the driver's authoritative marker match. The raw check covers drivers whose
                 // wait timed out at the same boundary the marker landed; either way a trailer completes
                 // normally and is never mistaken for inactivity.
                 if (matched || new RegExp(exitPattern).test(raw))
                     break;
                 const now = Date.now();
+                // The ceiling wins if it coincides with the first beat (or the read crosses it).
+                // That seat was killed by its configured timeout, not an early launch reroute.
+                if (now - startedAt >= timeoutMs)
+                    break;
+                if (reviewing && !firstLivenessObserved && now - startedAt >= REVIEW_FIRST_LIVENESS_MS) {
+                    firstLivenessObserved = true;
+                    // RS-2: the beat reads seat-authored bytes ALONE. CPU evidence never holds a preamble-only
+                    // capture open to the ceiling; a seat that has not written one byte of its own is re-routed.
+                    // OBS-944 is why a buffering runner earns no exemption here: the claude-code seat's 901 s
+                    // capture was byte-identical across two legs and ended at the pane-identity line — that
+                    // seat never started, it was not quietly working. RULING-229-06 puts the beat on the PANE
+                    // path only; a headless `-p` runner (runHeadlessDetailed, no pane, no beat) buffers every
+                    // byte until completion and keeps its full ceiling.
+                    if (seatAuthoredBytes === 0) {
+                        launchNeverStarted = true;
+                        forceClose = true;
+                        break;
+                    }
+                }
+                // Producing reviews own their full ceiling; inactivity is not a review verdict.
+                if (reviewing)
+                    continue;
                 const snapshot = normalizeStallSnapshot(raw);
                 if (snapshot !== priorSnapshot) {
                     priorSnapshot = snapshot;
@@ -246,18 +427,22 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
                 }
             }
             timedOut = Date.now() - startedAt >= timeoutMs && !new RegExp(exitPattern).test(out);
+            if (timedOut)
+                forceClose = true;
         }
         const exitCode = Number(new RegExp(`TICKMARKR_EXIT_${nonce}:(\\d+)`).exec(out)?.[1]);
         return {
             output: dewrapPaneVerdict(out, nonce),
             ...(Number.isFinite(exitCode) ? { exitCode } : {}),
             timedOut,
+            launchNeverStarted,
+            seatAuthoredBytes,
         };
     }
     finally {
         try {
             await accountant?.stop();
-            if (slot && !via.keep)
+            if (slot && (forceClose || !via.keep))
                 await via.driver.close(slot);
         }
         finally {

package/dist/gates/review.d.ts

@@ -1,6 +1,7 @@
 import { type Assignment, type BillingChannel, type WorkerAdapter } from "../adapters/types.js";
 import { type TickmarkrConfig, type Tier } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
+import { type StructuredFinding } from "../run/journal.js";
 import { modelProvider } from "../route/preference.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
@@ -16,6 +17,8 @@ export interface ReviewFinding {
 }
 export interface ReviewVerdict {
     approve?: boolean;
+    resolved?: string[];
+    reraised?: string[];
     issues?: string[];
     findings?: ReviewFinding[];
     comments?: Array<{
@@ -54,12 +57,12 @@ export declare function pickReviewer(author: Assignment, channels: BillingChanne
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor?: Tier, // task-declared only; config floors govern workers and must not silently move review seats
 history?: string[], // run-scoped picks, oldest to newest; empty preserves the established ranking
-onSeat?: (seat: number) => void): BillingChannel | null;
-export type ReviewUnparseableCause = VerdictUnparseableCause;
+onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>): BillingChannel | null;
+export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-started" | "truncated" | "silent";
 /**
  * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
  * remains a separate stated input, so whether its touched paths fit the declaration stays a reviewer
  * judgement rather than a guarantee made by this renderer.
  */
 export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
-export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[]): Promise<GateResult>;
+export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[], demotedReviewers?: ReadonlySet<string>, carriedFindings?: readonly StructuredFinding[]): Promise<GateResult>;

package/dist/gates/review.js

@@ -6,6 +6,7 @@ import { filesGlob } from "../graph/files-glob.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
+import { structuredFindings } from "../run/journal.js";
 import { redactSecrets } from "../run/redact.js";
 import { marginalCostRank } from "../route/router.js";
 import { modelProvider } from "../route/preference.js";
@@ -178,7 +179,7 @@ export function pickReviewer(author, channels, exclude = [], // v1.1 failover: r
 prefer = [], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor, // task-declared only; config floors govern workers and must not silently move review seats
 history = [], // run-scoped picks, oldest to newest; empty preserves the established ranking
-onSeat) {
+onSeat, demoted = new Set()) {
     // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
     // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
     // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
@@ -188,20 +189,21 @@ onSeat) {
         return null;
     const authorProvider = modelProvider(author.model, authorChannel.vendor);
     const ranked = channels
-        // two independent axes: different vendor AND different base-model identity (ADDED TO the vendor
-        // rule, never replacing it — a future edit can't silently drop either). Failover additionally guards
-        // true provider identity; the initial pick keeps the established stamped-vendor contract. The diversity
+        // Three independent axes: different vendor, different resolved provider identity (OBS-946: on initial pick
+        // as well as failover, so an aggregator channel stamped "mixed" never seats the author's own provider),
+        // and different base-model identity (ADDED TO the vendor rule, never replacing it). The diversity
         // filter runs BEFORE preference ranking, so prefer cannot resurrect an excluded channel.
         .filter((c) => c.vendor !== authorChannel.vendor
-        && (exclude.length === 0 || modelProvider(c.model, c.vendor) !== authorProvider)
+        && modelProvider(c.model, c.vendor) !== authorProvider
         && modelId(c.model) !== modelId(author.model)
         && !exclude.includes(channelKey(c))
         && (floor === undefined || TIER_RANK[c.tier] >= TIER_RANK[floor]))
         .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b));
-    const reviewer = [...ranked].sort((a, b) => history.lastIndexOf(channelKey(a)) - history.lastIndexOf(channelKey(b))
+    const reviewer = [...ranked].sort((a, b) => Number(demoted.has(channelKey(a))) - Number(demoted.has(channelKey(b)))
+        || history.lastIndexOf(channelKey(a)) - history.lastIndexOf(channelKey(b))
         || ranked.indexOf(a) - ranked.indexOf(b))[0] ?? null;
     if (reviewer)
-        onSeat?.(ranked.indexOf(reviewer) + 1);
+        onSeat?.(ranked.indexOf(reviewer) + 1, ranked.length);
     return reviewer;
 }
 /**
@@ -220,7 +222,7 @@ ${files.map((path) => `- ${path}`).join("\n")}`;
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers, 
 // OBS-196: run dir for raw-output persistence on an unparseable verdict; absent (older callers,
 // direct tests) skips persistence and changes nothing else.
-artifactDir, reviewHistory) {
+artifactDir, reviewHistory, demotedReviewers, carriedFindings = []) {
     // R3 (OBS-186): participation is keyed on PATHS. The compiler's assignment comes from the DECLARED
     // files[]; the operator's floor may RAISE it to full and can never lower it. `complexityThreshold` is
     // retired — the branch that returned a green skip on a complexity comparison is gone, and with it the
@@ -241,8 +243,9 @@ artifactDir, reviewHistory) {
     // so production rounds have journaled both siblings all along — only the fixtures were blind to it.
     // Fixed in the ledger rather than in the oracles, because determinism run-to-run is a property of
     // the journal, not of three test files that happen to assert it.
+    const priorMaterials = carriedFindings.filter((finding) => finding.class === "review:material");
     const declaredPolicy = declaredReviewPolicy(task.files);
-    const policy = raiseReviewPolicy(declaredPolicy, cfg.review.policy);
+    const policy = priorMaterials.length ? "full" : raiseReviewPolicy(declaredPolicy, cfg.review.policy);
     // PROMOTION: the declared assignment is a claim about paths, and the diff is the evidence. A
     // judge-only task whose diff left the leaf class is reviewed in full — the claim never outranks
     // what actually happened, and an empty diff promotes too (a skip earned by an absence is not earned).
@@ -293,15 +296,15 @@ artifactDir, reviewHistory) {
     // historical seat for every task that never asked for review-tier coupling.
     const reviewerFloor = task.routingHints?.floor;
     let rotationSeat;
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined);
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined, demotedReviewers);
     if (!reviewer) {
         // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
         // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
         const reason = reviewerFloor
             ? `no cross-vendor reviewer available at or above task-declared ${reviewerFloor} floor (diversity rule)`
             : "no cross-vendor reviewer available (diversity rule)";
-        return cfg.review.required
-            ? { gate: "review", pass: false, details: `unreadable — ${reason}; set review.required:false to waive`, meta: { noEligibleReviewer: true, unreadable: true, ...(reviewerFloor ? { reviewerFloor } : {}) } }
+        return cfg.review.required || priorMaterials.length > 0
+            ? { gate: "review", pass: false, details: `unreadable — ${reason}; ${priorMaterials.length ? "carried materials require a review verdict" : "set review.required:false to waive"}`, meta: { noEligibleReviewer: true, unreadable: true, ...(reviewerFloor ? { reviewerFloor } : {}) } }
             : { gate: "review", pass: true, details: `WARNING: ${reason} — review waived by config`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } };
     }
     reviewHistory?.push(channelKey(reviewer));
@@ -327,7 +330,10 @@ ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}
 
 ${renderDeclaredWriteScope(task.files)}
 
-## Diff
+${priorMaterials.length ? `## Prior materials this attempt must close
+${priorMaterials.map((finding) => `Fingerprint: ${finding.fingerprint}\n${finding.note}`).join("\n\n")}
+
+` : ""}## Diff
 \`\`\`diff
 ${diff}
 \`\`\`
@@ -340,18 +346,31 @@ block approval. For a minor concern you have decided not to block on, set "defer
 one-line "rationale" — it is recorded in the review, never dropped.
 
 Respond with ONLY this JSON:
-{"nonce": "${nonce}", "approve": true|false, "findings": [{"note": "...", "severity": "material"|"minor", "defer": false, "rationale": ""}], "comments": [{"path": "path/to/file", "line": 42, "body": "actionable feedback"}]}
-Approve iff no material finding remains; an empty findings list is a clean approval.
+{"nonce": "${nonce}", "approve": true|false, "resolved": [], "reraised": [], "findings": [{"note": "...", "severity": "material"|"minor", "defer": false, "rationale": ""}], "comments": [{"path": "path/to/file", "line": 42, "body": "actionable feedback"}]}
+For every prior material, put its fingerprint in exactly one of resolved (verified fixed) or reraised
+(still a blocking defect). Use only the listed fingerprints; never omit one or put it in both lists.
+Approve iff no material finding remains and every prior material is resolved.
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
-    let concludedOnInactivity = false;
+    const artifactId = `${task.id}-${nonce}`;
+    const briefPath = artifactDir ? join(artifactDir, `review-brief-${artifactId}.md`) : undefined;
+    // Persistence is evidence, not a gate input: a full disk or a removed run dir never fails the gate.
+    let savedBrief;
+    if (briefPath) {
+        try {
+            writeFileSync(briefPath, redactSecrets(prompt));
+            savedBrief = briefPath;
+        }
+        catch {
+            savedBrief = undefined;
+        }
+    }
     const llm = await runLlmDetailed(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? {
         driver: via.driver,
         keep: via.keep,
         onSlot: via.onSlot,
         name: via.nameFor("review", reviewer.adapter),
         label: via.labelFor("review"),
-        onInactivity: () => { concludedOnInactivity = true; },
     } : undefined, 
     // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
     // output until completion — runLlm's 300s default killed reviews mid-flight, returning empty
@@ -362,53 +381,80 @@ The top-level comments array is optional. Use it only for actionable line-anchor
     const provider = modelProvider(reviewer.model, reviewer.vendor);
     const v = extractVerdictJson(raw, nonce);
     const findings = v && Array.isArray(v.findings) ? v.findings : null;
+    const priorIds = new Set(priorMaterials.map((finding) => finding.fingerprint));
+    const closureLists = [v?.resolved, v?.reraised];
+    const closureInvalid = !!v && (priorIds.size > 0 || closureLists.some((list) => list !== undefined)) && (closureLists.some((list) => !Array.isArray(list) || list.some((id) => typeof id !== "string" || !priorIds.has(id)))
+        || new Set([...(v?.resolved ?? []), ...(v?.reraised ?? [])]).size !== (v?.resolved?.length ?? 0) + (v?.reraised?.length ?? 0)
+        || [...priorIds].some((id) => !v?.resolved?.includes(id) && !v?.reraised?.includes(id)));
     // findings decides the verdict on its own; the legacy path still needs approve + issues to parse.
-    if (!v || (findings === null && (typeof v.approve !== "boolean" || !Array.isArray(v.issues)))) {
+    if (!v || closureInvalid || (findings === null && (typeof v.approve !== "boolean" || !Array.isArray(v.issues)))) {
         // OBS-196: name the cause and persist the raw bytes — a ruled-on "unparseable" without its
         // evidence cannot be audited, and a cutoff must never be indistinguishable from a parse defect.
-        const cause = classifyVerdictCause(raw, nonce, "approve", llm);
-        const bytes = Buffer.byteLength(raw, "utf8");
+        const bytes = llm.seatAuthoredBytes ?? Buffer.byteLength(raw.trim(), "utf8");
+        const cause = closureInvalid ? "malformed-verdict" : llm.launchNeverStarted ? "launch-never-started"
+            : llm.timedOut ? (bytes > 0 ? "truncated" : "silent")
+                : classifyVerdictCause(raw, nonce, "approve", llm);
         let saved;
         if (artifactDir) {
             try {
-                saved = join(artifactDir, `review-raw-${task.id}-${Date.now()}.txt`);
+                saved = join(artifactDir, `review-raw-${artifactId}.txt`);
                 writeFileSync(saved, redactSecrets(raw));
             }
             catch {
                 saved = undefined; // persistence is evidence, not a gate input — never fail the gate on it
             }
         }
-        const failure = concludedOnInactivity
-            ? "review dispatch concluded on the inactivity policy without a structurally valid nonce-bound response; output unparseable"
-            : cause === "malformed-verdict"
-                ? "review output unparseable"
-                : "review dispatch failed — no structurally valid nonce-bound response; output unparseable";
+        const failure = cause === "malformed-verdict"
+            ? "review output unparseable"
+            : "review dispatch failed — no structurally valid nonce-bound response";
         return {
             gate: "review",
             pass: false,
-            details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: ${cause}${cause === "timeout" ? `; killed at configured review timeout ${cfg.review.timeoutMs}ms` : ""}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
+            details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: ${cause}${llm.timedOut ? `; killed at configured review timeout ${cfg.review.timeoutMs}ms` : ""}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
             meta: {
                 ...policyMeta,
                 ...rotationMeta,
                 reviewer: channelKey(reviewer),
                 vendor: reviewer.vendor,
                 provider,
-                unparseable: true,
+                ...(cause === "malformed-verdict" ? { unparseable: true } : { noVerdict: true, classification: "infra", infra: true }),
                 cause,
-                ...(cause === "empty-output" ? { bytes } : {}),
-                ...(cause === "timeout" ? { timeoutMs: cfg.review.timeoutMs } : {}),
-                ...(concludedOnInactivity ? { classification: "infra", infra: true } : {}),
+                bytes, seatAuthoredBytes: bytes,
+                ...(saved ? { rawPath: saved } : {}),
+                ...(savedBrief ? { briefPath: savedBrief } : {}),
+                ...(llm.timedOut ? { timeoutMs: cfg.review.timeoutMs } : {}),
             },
         };
     }
     const decided = findings !== null
         ? classifyReviewFindings(findings)
         : classifyReviewIssues(v.approve, v.issues);
+    const reraised = priorMaterials.filter((finding) => v.reraised?.includes(finding.fingerprint));
+    if (reraised.length) {
+        if (decided.pass)
+            decided.headline = "requested changes";
+        decided.pass = false;
+        // A reviewer may also restate a re-raised material in findings. Preserve the original
+        // prose once so an unchanged defect keeps the same failure brief across repair rounds.
+        for (const finding of reraised) {
+            const line = `- [material] ${finding.note}`;
+            if (!decided.lines.includes(line))
+                decided.lines.push(line);
+        }
+    }
     const prose = `reviewer ${reviewer.adapter}:${reviewer.model} (vendor: ${reviewer.vendor}; provider: ${provider}): ${decided.headline}${decided.lines.length ? "\n" + decided.lines.join("\n") : ""}`;
+    const details = appendAnchoredReview(prose, v);
     return {
         gate: "review",
         pass: decided.pass,
-        details: appendAnchoredReview(prose, v),
-        meta: { ...policyMeta, ...rotationMeta, reviewer: channelKey(reviewer), vendor: reviewer.vendor, provider },
+        details,
+        meta: {
+            ...policyMeta, ...rotationMeta, reviewer: channelKey(reviewer), vendor: reviewer.vendor, provider,
+            ...(priorMaterials.length ? { resolved: v.resolved, reraised: v.reraised } : {}),
+            ...(reraised.length ? { findings: [
+                    ...structuredFindings("review", details).filter((finding) => !reraised.some((prior) => prior.note === finding.note)),
+                    ...reraised,
+                ] } : {}),
+        },
     };
 }

package/dist/gates/run-gates.d.ts

@@ -4,6 +4,7 @@ import { type GateName, type Task } from "../graph/schema.js";
 import { type Baseline } from "./baseline.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
+import { type StructuredFinding } from "../run/journal.js";
 export type LoadProvider = () => number;
 /** Test seam — inject deterministic load samples; production always reads os.loadavg. */
 export declare function setLoadProviderForTests(provider: LoadProvider): void;
@@ -52,7 +53,9 @@ export interface GateContext {
     adapters: WorkerAdapter[];
     cfg: TickmarkrConfig;
     via?: GateVia;
+    carriedFindings?: readonly StructuredFinding[];
     excludeReviewers?: string[];
+    demotedReviewers?: Set<string>;
     reviewHistory?: string[];
     artifactDir?: string;
     pipeline?: "v185" | "legacy";

package/dist/gates/run-gates.js

@@ -590,13 +590,23 @@ export async function runGates(task, ctx) {
         const dispatch = async (run) => {
             const captured = await captureLlmDispatches(ctx.adapters, run);
             invocations.push(...captured.invocations);
-            return captured.value;
+            const rv = captured.value;
+            if (rv.meta?.noVerdict === true || rv.meta?.unparseable === true) {
+                await ctx.onGate?.({ phase: "note", gate: "review", name: "review-no-verdict", payload: { ...rv.meta }, result: rv });
+                if (rv.meta.seatAuthoredBytes === 0 && typeof rv.meta.reviewer === "string"
+                    && !ctx.demotedReviewers?.has(rv.meta.reviewer)) {
+                    ctx.demotedReviewers?.add(rv.meta.reviewer);
+                    await ctx.onGate?.({ phase: "note", gate: "review", name: "review-pool-demotion",
+                        payload: { reviewer: rv.meta.reviewer, cause: rv.meta.cause, seatAuthoredBytes: 0 }, result: rv });
+                }
+            }
+            return rv;
         };
-        let rv = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, ctx.via, ctx.excludeReviewers, ctx.artifactDir, ctx.reviewHistory));
+        let rv = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, ctx.via, ctx.excludeReviewers, ctx.artifactDir, ctx.reviewHistory, ctx.demotedReviewers, ctx.carriedFindings));
         // OBS-193/574: an unparseable review verdict retries the REVIEW exactly once, preferring a
         // different adapter. Only a single-adapter eligible pool may fall back to another channel on the
         // flaked adapter. The flaked verdict never enters results; an exhausted pool preserves its cause.
-        if (rv.meta?.unparseable === true && typeof rv.meta.reviewer === "string") {
+        if ((rv.meta?.unparseable === true || rv.meta?.noVerdict === true) && typeof rv.meta.reviewer === "string") {
             const flaked = rv.meta.reviewer;
             const emptyOutput = rv.meta.cause === "empty-output";
             if (emptyOutput) {
@@ -615,7 +625,7 @@ export async function runGates(task, ctx) {
             const crossAdapter = pickReviewer(ctx.author, ctx.channels, [...priorExclusions, ...adapterExclusions], ctx.cfg.review.prefer ?? [], task.routingHints?.floor);
             const exclusion = crossAdapter ? "adapter" : "channel";
             const retryExclusions = [...priorExclusions, ...(crossAdapter ? adapterExclusions : [flaked])];
-            const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, retryExclusions, ctx.artifactDir, ctx.reviewHistory));
+            const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, retryExclusions, ctx.artifactDir, ctx.reviewHistory, ctx.demotedReviewers, ctx.carriedFindings));
             if (second.meta?.noEligibleReviewer !== true) {
                 const retried = typeof second.meta?.reviewer === "string" ? second.meta.reviewer : "none";
                 const route = exclusion === "adapter"

package/dist/plan/scope.d.ts

@@ -1,12 +1,14 @@
 import type { WorkerAdapter } from "../adapters/types.js";
 import type { TickmarkrConfig } from "../config/config.js";
 import type { ExecutorDriver } from "../drivers/types.js";
+export declare const MAX_SCOPE_ATTEMPTS = 3;
 export declare function clarificationGate(intent: string): string[];
 export interface ScopeOptions {
     cfg: TickmarkrConfig;
     adapters: WorkerAdapter[];
     driver?: ExecutorDriver;
     force?: boolean;
+    candidate?: ScopeCandidate;
 }
 export interface ScopeResult {
     specFile: string;
@@ -14,4 +16,27 @@ export interface ScopeResult {
     attempts: number;
 }
 export declare function specPathForIntent(intentFile: string): string;
+export interface ScopeCandidate {
+    adapter: string;
+    model: string;
+}
+export interface ScopePreview {
+    intentFile: string;
+    specFile: string;
+    specExists: boolean;
+    cached: boolean;
+    candidate?: ScopeCandidate;
+    authoringBudget: number;
+    probeCalls: number;
+}
+/**
+ * R11/R45 (C10): local-only disclosure — intent/clarification checks and a candidate read off the
+ * doctor cache, never a fresh probe or a model turn. `readDoctor` and `discoverChannels`/`route` are
+ * pure reads over that cache, so this never touches an adapter.
+ */
+export declare function previewScope(intentFile: string, repoRoot: string, options: {
+    cfg: TickmarkrConfig;
+    adapters: WorkerAdapter[];
+}): ScopePreview;
+export declare function formatScopePreview(preview: ScopePreview): string;
 export declare function scopeIntent(intentFile: string, repoRoot: string, options: ScopeOptions): Promise<ScopeResult>;