tickmarkr 2.4.2 → 2.5.1

package/dist/run/daemon.js

@@ -8,7 +8,7 @@ import { fileURLToPath } from "node:url";
 import { stringify } from "yaml";
 import { classifyDeadChannel, NO_TRAILER_SUMMARY, trailerPattern, UNPARSEABLE_TRAILER_SUMMARY, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, getAdapter, probeAll, readDoctor, rolePools } from "../adapters/registry.js";
-import { addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
+import { SettledTrailerTracker, addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { collateralHits } from "../compile/collateral.js";
 import { DEFAULT_DIFF_CAP, globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
@@ -27,14 +27,25 @@ import { runEnvironment } from "./environment.js";
 import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, sameCapacity, sh, shGit, SUITE_PARENT_ENV, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
-import { isDiffCapPark } from "../gates/review.js";
+import { isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
 import { nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
 import { harvestCpuFlatWindowMs, NUDGEABLE_ADAPTERS, PANE_READ_ROWS, StallProgressTracker, stallSnapshotBannerRows, WorkerTreeCpuAccountant, } from "./stall.js";
-// Compatibility exports for the daemon liveness tests and existing consumers. The implementation
-// lives in stall.ts so gate dispatch can depend on it without importing the daemon.
+// The live set is also the ownership claim shared by task cleanup and termination.
+export async function closeLiveSlot(liveSlots, driver, slot) {
+    if (!liveSlots.delete(slot))
+        return;
+    try {
+        await driver.close(slot);
+    }
+    catch (error) {
+        liveSlots.add(slot);
+        throw error;
+    }
+}
+// Compatibility exports: gate dispatch can import stall.ts without importing the daemon.
 export { harvestCpuFlatWindowMs, resetHarvestCpuFlatMsForTests, setHarvestCpuFlatMsForTests, workerTreeCpuMs, } from "./stall.js";
 const MODE_RANK = { "staff-led": 0, "risk-based": 1, "partner-led": 2 };
 // An override (flag/spec) re-resolves through loadConfigWithMode itself, via a synthesized repo overlay
@@ -134,12 +145,11 @@ export function formatSummary(s) {
         : "";
     return `done: ${s.done.length}, failed: ${s.failed.length}, human: ${s.human.length}, blocked: ${s.blocked.length}, pending: ${s.pending.length}\nintegration branch: ${s.branch}${tip}${outstanding}`;
 }
-/** The narrator's command, bound to THIS run. `status` takes exactly one positional and it is the
- *  run id (cli/commands/status.ts positionalRunId), so naming it here is what stops the board from
- *  following the newest journal in a repo that already carries a second, newer run — a board showing
- *  the wrong run is a recorded incident (skills/tickmarkr-overseer/SKILL.md). */
+/** The narrator enters the production Run cockpit for this exact run. The
+ *  completed static/growing four-hour records precede this default cutover;
+ *  an explicit ID prevents a newer journal from redirecting the owned board. */
 export const daemonEntrypoint = fileURLToPath(new URL("../cli/index.js", import.meta.url));
-export const watchCommand = (runId) => `${shq(process.execPath)} ${shq(daemonEntrypoint)} status --watch ${shq(runId)}`;
+export const watchCommand = (runId) => `${shq(process.execPath)} ${shq(daemonEntrypoint)} ui ${shq(runId)} --view run`;
 const MAX_ATTEMPTS = 10; // ponytail: hard cap so a pathological ladder can never loop forever
 // v1.85 T3 (retry economics): two repairs per engagement, then the fresh ladder. A repair re-uses the
 // findings and the landed diff instead of re-buying onboarding; when two of them have not closed the
@@ -1265,16 +1275,13 @@ export async function runDaemon(repoRoot, opts = {}) {
             // opens/closes keep the ledger exact. Termination then closes exactly what is still live — and a
             // slot closed once (task-done, quota reroute, gate self-clean) can never be closed twice.
             const liveSlots = new Set();
-            const closeSlot = async (s) => {
-                if (!liveSlots.delete(s))
-                    return; // already closed — never twice
-                await driver.close(s);
-            };
+            const closeSlot = (s) => closeLiveSlot(liveSlots, driver, s);
             const trackedDriver = {
                 id: driver.id,
                 interactive: driver.interactive,
                 ...(driver.readSource ? { readSource: driver.readSource } : {}),
                 ...(driver.describe ? { describe: driver.describe.bind(driver) } : {}),
+                ...(driver.focus ? { focus: driver.focus.bind(driver) } : {}),
                 slot: async (cwd, name, o) => { const s = await driver.slot(cwd, name, o); liveSlots.add(s); return s; },
                 run: (s, cmd) => driver.run(s, cmd),
                 waitOutput: (s, p, ms, o) => driver.waitOutput(s, p, ms, o),
@@ -1330,7 +1337,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // new attempt while this reaper is still closing the old ones.
                         abortRun(new Error(`terminated by ${sig}`));
                         if (cfg.visibility.keepPanes !== "forever") {
-                            for (const s of liveSlots) { // closeSlot only deletes the element being visited — safe during Set iteration
+                            for (const s of Array.from(liveSlots)) { // snapshot: failed closes restore membership for the next sweep
                                 try {
                                     await closeSlot(s);
                                 }
@@ -1349,6 +1356,9 @@ export async function runDaemon(repoRoot, opts = {}) {
             process.on("SIGINT", onTermination);
             process.on("SIGTERM", onTermination);
             journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
+            const demotedReviewers = new Set(journal.read()
+                .filter((event) => event.event === "review-pool-demotion" && typeof event.data.reviewer === "string")
+                .map((event) => event.data.reviewer));
             const reviewHistory = journal.read()
                 .filter((event) => event.event === "gate-result" && event.data.gate === "review" && typeof event.data.reviewer === "string")
                 .map((event) => event.data.reviewer);
@@ -1392,7 +1402,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     watchSlot = await trackedDriver.narrator(repoRoot, watchCommand(runId), runId);
                 }
                 catch (error) {
-                    journal.append("watch-placement-failed", undefined, { error: error instanceof Error ? error.message : String(error) });
+                    const reason = error instanceof Error ? error.message : String(error);
+                    journal.append("watch-placement-failed", undefined, { error: reason });
+                    console.error(`tickmarkr: narrator not opened: ${reason}`);
                 }
             };
             let baseRef;
@@ -1550,12 +1562,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // (no run identity) is never this run's to sweep.
                     if (watchSlot && watchSlot.name === watchName && !desired.has(watchName)) {
                         const w = watchSlot;
-                        watchSlot = undefined;
                         await trackedDriver.close(w);
+                        watchSlot = undefined;
                     }
                 }
-                catch {
-                    /* cosmetic — visibility is never a gate */
+                catch (error) {
+                    const reason = error instanceof Error ? error.message : String(error);
+                    journal.append("watch-cleanup-failed", undefined, { error: reason });
+                    console.error(`tickmarkr: ${reason}`);
                 }
             };
             // run start/resume boundary: nothing in flight, so the sweep takes this run's judge/review/consult
@@ -1811,6 +1825,35 @@ export async function runDaemon(repoRoot, opts = {}) {
                 if (rs)
                     journal.append("resume-restore", t.id, { attempts: rs.attempts, tried: [...tried], assignment });
                 const badReviewers = []; // v1.1: reviewer channels that produced unparseable output for this task
+                const noteReviewEvent = (e) => {
+                    journal.append(e.name, t.id, e.payload);
+                    if (e.name === "review-no-verdict" && typeof e.payload.reviewer === "string") {
+                        if (!badReviewers.includes(e.payload.reviewer))
+                            badReviewers.push(e.payload.reviewer);
+                    }
+                };
+                // Keep the measured siblings, including a red judge, while replacing only a missing review.
+                // Every dispatched seat is excluded for this task, so the loop is bounded by the eligible pool.
+                const runReviewRecovery = async (task, ctx) => {
+                    const round = await runGates(task, ctx);
+                    let review = round.results.find((g) => g.gate === "review");
+                    while (review?.meta?.noVerdict === true) {
+                        const next = pickReviewer(ctx.author, ctx.channels, badReviewers, cfg.review.prefer ?? [], task.routingHints?.floor, reviewHistory, undefined, demotedReviewers);
+                        if (!next)
+                            break;
+                        journal.append("review-infra-retry", t.id, { reviewer: channelKey(next), cause: review.meta.cause });
+                        const retried = await runGates({ ...task, gates: ["review"] }, ctx);
+                        const replacement = retried.results.find((g) => g.gate === "review");
+                        // A dirty tree or another pre-dispatch refusal must still fail closed.
+                        if (!replacement) {
+                            round.results.push(...retried.results.filter((g) => !gateSatisfied(g)));
+                            break;
+                        }
+                        round.results = round.results.map((g) => g.gate === "review" ? replacement : g);
+                        review = replacement;
+                    }
+                    return round;
+                };
                 // v1.70 T5 (review-convergence): failed review rounds this task has drawn, counted from the per-task
                 // review history already in the journal — the SAME review gate-result stream onGate reads to grow the
                 // reviewer-exclusion list (badReviewers), never a second parallel counter. OBS-189: scoped to the
@@ -1835,7 +1878,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // One helper, both onGate sites (satisfied-gate resume + main attempt loop).
                 let gateSubject;
                 const journalGateResult = (g) => {
-                    const blocking = gateFailed(g) && (g.gate === "review" || g.gate === "acceptance");
+                    const blocking = g.meta?.infra !== true && gateFailed(g) && (g.gate === "review" || g.gate === "acceptance");
                     // T2: a review that PASSED while DEFERRING a concern still recorded a defect — the prompt
                     // promises the deferral is recorded and never dropped, and a details string is not a record a
                     // later round can match. The blocking projection above is the only writer of structured
@@ -1856,12 +1899,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // The legacy baseline declines (a build command the repo never configured) have always written
                     // `pass: true` beside `skipped: true` and every consumer already reads them right, so their row
                     // is untouched: only a decline that would otherwise be recorded RED changes shape here.
-                    const unverdicted = g.meta?.skipped === true && !g.pass;
+                    // A no-verdict review is journaled `infra` + `skipped` with NO `pass`: the canonical reader
+                    // (outcome.ts) files it as infra regardless, the `pass === false` readers (rounds, briefs,
+                    // park kind) never charge it, and outstandingReviewFindings (journal.ts:816) skips a `skipped`
+                    // row instead of reading a missing `pass` as a PASS that settles every open blocking finding.
+                    const noVerdictReview = g.gate === "review" && g.meta?.noVerdict === true;
+                    const unverdicted = (g.meta?.skipped === true && !g.pass) || noVerdictReview;
                     journal.append("gate-result", t.id, {
                         gate: g.gate, ...(unverdicted ? {} : { pass: g.pass }), details: g.details,
                         ...(gateSubject ? { commit: gateSubject.commit, attempt: gateSubject.attempt } : {}),
                         ...(gateSubject?.replayMeasurement ? { replayMeasurement: true } : {}),
-                        ...(g.meta?.skipped === true ? { skipped: true } : {}),
+                        ...(g.meta?.skipped === true || noVerdictReview ? { skipped: true } : {}),
                         // T9: an infra-only exit is journaled AS one. The operator reading a red `test` row has to
                         // be able to tell "the suite found a defect" from "the runner never ran", and the merge
                         // predicate's reason for refusing has to be legible in the ledger it refused from.
@@ -1887,6 +1935,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ...(g.meta?.reapedGroup === true ? { reapedGroup: true } : {}),
                         ...(g.gate === "review" && typeof g.meta?.reviewer === "string" ? {
                             reviewer: g.meta.reviewer,
+                            ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised"]
+                                .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                             ...(typeof g.meta.vendor === "string" ? { vendor: g.meta.vendor } : {}),
                             ...(typeof g.meta.provider === "string" ? { provider: g.meta.provider } : {}),
                             ...(typeof g.meta.rotationSeat === "number" ? { rotationSeat: g.meta.rotationSeat } : {}),
@@ -1896,7 +1946,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // where work is allowed, not where this verdict found the defect.
                         ...(blocking ? {
                             taskContentDigest: contentDigest,
-                            findings: structuredFindings(g.gate, g.details),
+                            findings: Array.isArray(g.meta?.findings) ? g.meta.findings : structuredFindings(g.gate, g.details),
                         } : deferred.length > 0 ? {
                             taskContentDigest: contentDigest,
                             findings: deferred,
@@ -2262,7 +2312,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         };
                         await trackedDriver.project?.(t.id, "in-review");
                         journal.phaseStart(t.id, "gates");
-                        const { results } = await withSuiteWindow(t.id, resumedTask.gates.includes("test") && commands.test !== undefined, () => runGates(resumedTask, {
+                        const { results } = await withSuiteWindow(t.id, resumedTask.gates.includes("test") && commands.test !== undefined, () => runReviewRecovery(resumedTask, {
+                            carriedFindings: outstandingReviewFindings(journal.read(), t.id),
                             worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
                             commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                             collateral: collateral.get(t.id) ?? [],
@@ -2278,7 +2329,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                                 : undefined,
                             excludeReviewers: badReviewers,
-                            reviewHistory,
+                            reviewHistory, demotedReviewers,
                             onGate: async (e) => {
                                 if (e.phase === "start") {
                                     notePhaseStart(e);
@@ -2286,7 +2337,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     return;
                                 }
                                 if (e.phase === "note") {
-                                    journal.append(e.name, t.id, e.payload);
+                                    noteReviewEvent(e);
                                     return;
                                 }
                                 const g = e.result;
@@ -2313,6 +2364,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                         graph = addEvidence(graph, t.id, { commits: approvedCommits, gateResults: results });
                         saveGraph(repoRoot, graph);
                         if (!results.every(gateSatisfied)) {
+                            const infra = results.find((g) => g.meta?.infra === true);
+                            if (infra) {
+                                await park(t, `${infra.gate}: ${infra.details}`, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                return;
+                            }
                             // OBS-547: disposition FIRST, and through the same helper the ordinary attempt path uses. A
                             // crash between a journaled scope red and its classification must not turn a predicted red
                             // into a charged one just because a resume is what observed it.
@@ -2725,6 +2781,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         journal.append("worker-launch", t.id, {
                             attempt,
                             retryMode,
+                            driver: trackedDriver.id,
+                            slot: { ...slot },
+                            workspace: driver.id === "herdr" ? process.env.HERDR_WORKSPACE_ID : undefined,
                             ...(trackedDriver.describe ? await trackedDriver.describe(slot) : {}),
                         });
                     };
@@ -2863,6 +2922,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                     let startupFailure = false;
                     let deadWorkerPark;
                     let settleParsed;
+                    const trailerFrames = interactive && adapter.busyFrameMarkers
+                        ? new SettledTrailerTracker(adapter.busyFrameMarkers) : undefined;
+                    const sampleTrailer = (frame) => {
+                        const trailer = new RegExp(trailerPattern(nonce)).test(frame);
+                        return trailerFrames ? trailerFrames.sample(frame, trailer) : trailer;
+                    };
                     let seedResult;
                     // v1.22 T5 / OBS-19: auto-answer a fingerprint-matched trust dialog exactly once per slot.
                     // Any other blocked/idle dialog pages the operator (unlatched since T1 — see below).
@@ -3028,14 +3093,22 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // own source, where "TICKMARKR_EXIT:" is a string literal) must not end the wait. Only a
                                         // parseable trailer or a digit-suffixed exit marker in the harvest is completion.
                                         output = await driver.read(slot, PANE_READ_ROWS); // TUI transcripts carry chrome — read deeper than print's 500
-                                        finished = new RegExp(trailerPattern(nonce)).test(output);
+                                        finished = sampleTrailer(output);
                                         const exit = exitRe.exec(output);
-                                        if (finished || exit) {
+                                        if (finished || (exit && !(trailerFrames && new RegExp(trailerPattern(nonce)).test(output)))) {
                                             exitCode = exit ? Number(exit[1]) : null; // null ⇔ the TUI is still alive
                                             processExited = exit !== null;
                                             await sampleContext(); // final poll-seam sample before leaving the wait
                                             break;
                                         }
+                                        if (trailerFrames && new RegExp(trailerPattern(nonce)).test(output)) {
+                                            // A matching busy frame is still a live turn. Preserve the rolling progress budget.
+                                            await sampleContext();
+                                            if (stallProgress.observe({ paneText: output, contextTokens }))
+                                                lastProgressAt = Date.now();
+                                            await new Promise((resolve) => setTimeout(resolve, Math.min(250, remaining)));
+                                            continue;
+                                        }
                                     }
                                     // A failed pane read is absence of evidence, never evidence of an absent pane. Keep the
                                     // rolling taskTimeoutMinutes window as the backstop and name the held probe once.
@@ -3070,6 +3143,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
                                         continue;
                                     }
+                                    // waitOutput is only a wake hint; a driver may miss a trailer already painted.
+                                    if (trailerFrames && sampleTrailer(paneText)) {
+                                        output = paneText;
+                                        finished = true;
+                                        const exit = exitRe.exec(output);
+                                        exitCode = exit ? Number(exit[1]) : null;
+                                        processExited = exit !== null;
+                                        await sampleContext();
+                                        break;
+                                    }
                                     if (paneText.length > 0)
                                         everHadOutput = true;
                                     if (startupFailureInWindow(paneText, workerLaunchedAt)) {
@@ -3421,9 +3504,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // un-answered nudge instead of the remainder of the window.
                                         nudgeDeadline = undefined;
                                         output = await driver.read(slot, PANE_READ_ROWS);
-                                        finished = new RegExp(trailerPattern(nonce)).test(output);
+                                        finished = sampleTrailer(output);
                                         const exit = exitRe.exec(output);
-                                        if (finished || exit) {
+                                        if (finished || (exit && !(trailerFrames && new RegExp(trailerPattern(nonce)).test(output)))) {
                                             exitCode = exit ? Number(exit[1]) : null;
                                             processExited = exit !== null;
                                             await sampleContext();
@@ -3468,12 +3551,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // The poll loop already recorded the unreadable pane. Retain the last readable bytes
                                         // so this ambiguous path still reaches the ordinary timeout/consult backstop.
                                     }
-                                    finished = new RegExp(trailerPattern(nonce)).test(output);
+                                    finished = trailerFrames ? trailerFrames.settled : new RegExp(trailerPattern(nonce)).test(output);
                                     const exit = exitRe.exec(output);
                                     exitCode = exit ? Number(exit[1]) : null;
                                     processExited = exit !== null;
                                 }
-                                if (finished) {
+                                if (finished && !trailerFrames) {
                                     await driver.waitAgentStatus(slot, "idle", 5_000); // settle, then re-harvest the final render
                                     output = await driver.read(slot, PANE_READ_ROWS);
                                 }
@@ -3493,11 +3576,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             break;
                                         await new Promise((r) => setTimeout(r, Math.min(settleDelayMs, remaining)));
                                         output = await driver.read(slot, PANE_READ_ROWS);
+                                        trailerFrames?.sample(output, new RegExp(trailerPattern(nonce)).test(output));
                                         settleParsed = adapter.parse(output, nonce);
                                         settleTries++;
                                     }
                                     if (settleParsed.summary !== UNPARSEABLE_TRAILER_SUMMARY) {
-                                        finished = settleParsed.summary !== NO_TRAILER_SUMMARY;
+                                        finished = settleParsed.summary !== NO_TRAILER_SUMMARY && (!trailerFrames || trailerFrames.settled);
                                     }
                                 }
                             }
@@ -3605,13 +3689,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // encoded and therefore invisible to the raw wait regex. Keep `output` bounded: every text
                     // classifier below retains its pre-artifact tail surface.
                     let result = settleParsed ?? adapter.parse(capturedStream.output, nonce);
+                    const unsettledTrailer = trailerFrames && !trailerFrames.settled
+                        && (trailerFrames.busyMarkersSeen.size > 0 || new RegExp(trailerPattern(nonce)).test(capturedStream.output));
+                    if (unsettledTrailer) {
+                        result = { ok: false, summary: `premature-idle: trailer did not settle; busy markers: ${[...trailerFrames.busyMarkersSeen].join(", ") || "awaiting two idle samples"}`, deviations: [], raw: output };
+                    }
                     const adapterCause = result.cause;
                     // Law 46: there is one completion fact. A classified adapter result with no parse-failure cause
                     // means its decoder found the nonce-bound trailer even when the raw JSON envelope escaped it.
-                    const workerFinished = finished || adapterCause === undefined;
+                    const workerFinished = !unsettledTrailer && (finished || adapterCause === undefined);
                     finished = workerFinished;
                     const adapterStartupFailure = adapterCause === "startup-failure";
-                    const workerCause = adapterStartupFailure
+                    const workerCause = unsettledTrailer ? "premature-idle" : adapterStartupFailure
                         ? "startup-failure"
                         : startupFailure
                             ? "startup-failure"
@@ -3700,9 +3789,24 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // never certifies the channel. Reading the synthesized `finished`/`ok` here reset the streak
                     // on every harvest, so a CLI that produces commits and swallows every trailer was immune to
                     // the two-window demotion and stayed first pick for the rest of the run.
+                    // Q-1 (OBS-926): BOTH branches read the same tail — a print stream tested whole failed a
+                    // pinned codex worker over for a diff line number (`429:`) 41 985 bytes before EOF and for
+                    // this repository's own fixture prose. The matched bytes and their stream offset ride the
+                    // row so a false positive is legible from the record alone.
+                    const quotaMatch = (interactive ? !workerFinished : exitCode !== 0)
+                        ? QUOTA_RE.exec(stallSnapshotBannerRows(output))
+                        : null;
+                    // Q-1: a graph pin is an operator instruction — a quota match ALONE never overrides it; only a
+                    // channel-attributed error (auth/setup/outage/timeout, the typed dead-channel classes) may.
+                    const pin = t.routingHints?.pin;
+                    const onPin = !!pin && assignment.adapter === pin.via && assignment.model === pin.model;
+                    const channelError = quotaMatch && onPin ? classifyDeadChannel({ ...preHarvestResult, raw: output }) : undefined;
+                    const pinRefusesQuota = !!quotaMatch && onPin && !channelError;
+                    // a refused quota window is not a no-trailer verdict on the pinned channel: counting it would
+                    // demote the pin two tails in and the demotion re-dispatch would move the task off it.
                     if (preHarvestResult.ok && workerFinished)
                         noTrailerStreak.set(channelKey(assignment), 0);
-                    else if (!workerFinished && cause !== "provider-death") {
+                    else if (!workerFinished && cause !== "provider-death" && !pinRefusesQuota) {
                         const ck = channelKey(assignment);
                         const streak = (noTrailerStreak.get(ck) ?? 0) + 1;
                         noTrailerStreak.set(ck, streak);
@@ -3732,12 +3836,29 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // T2 review: the gate is `workerFinished`, not the harvest-synthesized `finished` — a
                     // committed-but-quota-walled attempt routes here FIRST (its commits ride the carry-forward
                     // into the next attempt's recreated worktree), it never buys a gate run on throttled work.
-                    const quotaHit = interactive
-                        ? !workerFinished && QUOTA_RE.test(stallSnapshotBannerRows(output))
-                        : exitCode !== 0 && QUOTA_RE.test(output);
-                    if (quotaHit) {
+                    // Q-1 review: NO cap and NO fall-through to the consult ladder (failoverOrRecycle ignores the
+                    // pin) — the attempt is counted, so a pin that never clears parks at MAX_ATTEMPTS on its own
+                    // channel; only a channel-attributed error below may leave it.
+                    if (pinRefusesQuota) {
+                        journal.append("quota-failover-refused", t.id, {
+                            pin: `${pin.via}:${pin.model}`, channel: channelKey(assignment), matched: quotaMatch[0],
+                            reason: "pinned channel; no channel-attributed error", attempt,
+                        });
+                        await new Promise((r) => setTimeout(r, PROVIDER_DEATH_BACKOFF_MS));
+                        continue;
+                    }
+                    if (quotaMatch && (!onPin || channelError)) {
                         const next = failover("quota-failover");
-                        journal.append("quota-failover", t.id, { from: channelKey(assignment), to: next ? channelKey(next) : null });
+                        // byte offset inside the PERSISTED stream (the journaled `stream` file) — the capture keeps
+                        // only its last MAX_BUF bytes, so the file's origin may sit past the buffer's.
+                        const streamBytes = Buffer.byteLength(capturedStream.output);
+                        const idx = capturedStream.output.lastIndexOf(quotaMatch[0]);
+                        const offset = idx >= 0 ? Buffer.byteLength(capturedStream.output.slice(0, idx)) - Math.max(0, streamBytes - MAX_BUF) : null;
+                        journal.append("quota-failover", t.id, {
+                            from: channelKey(assignment), to: next ? channelKey(next) : null,
+                            matched: quotaMatch[0], offset, stream: capturedStream.path, streamBytes: Math.min(streamBytes, MAX_BUF),
+                            ...(onPin ? { pin: `${pin.via}:${pin.model}`, channelError } : {}),
+                        });
                         if (next) {
                             await driver.notify(`tickmarkr ${runId}: ${t.id} quota failover`, { tier: "attention" });
                             // OBS-17 T2: the superseded slot's pane closes AT REROUTE TIME — it holds a throttled
@@ -3858,7 +3979,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             return;
                         }
                         if (e.phase === "note") {
-                            journal.append(e.name, t.id, e.payload);
+                            noteReviewEvent(e);
                             return;
                         }
                         const g = e.result;
@@ -3896,7 +4017,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         gateSubject = { commit: await gateCommitSubject(taskBase, gated, wt), attempt };
                         await trackedDriver.project?.(t.id, "in-review");
                         journal.phaseStart(t.id, "gates");
-                        ({ results, commits } = await withSuiteWindow(t.id, t.gates.includes("test") && commands.test !== undefined, () => runGates(t, {
+                        ({ results, commits } = await withSuiteWindow(t.id, t.gates.includes("test") && commands.test !== undefined, () => runReviewRecovery(t, {
+                            carriedFindings: outstandingFindings,
                             worktree: wt, baseRef: taskBase, result, author: assignment,
                             commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                             collateral: collateral.get(t.id) ?? [],
@@ -3918,7 +4040,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                                 : undefined,
                             excludeReviewers: badReviewers,
-                            reviewHistory,
+                            reviewHistory, demotedReviewers,
                             onGate,
                         })));
                         results.forEach(classifySignalOnlyTest);

package/dist/run/lock.d.ts

@@ -36,12 +36,69 @@ export declare function runLockOwner(repoRoot: string): {
 export declare function runLockRunId(repoRoot: string): string | undefined;
 export declare function runStatusLine(repoRoot: string, runId: string, events: readonly RunLineEvent[]): string | null;
 export declare function isRunLockLive(repoRoot: string): boolean;
-export declare function unlockRun(repoRoot: string): {
+export interface LockSnapshot {
+    pid?: number;
+    runId?: string;
+    garbage: boolean;
+    unreadable: boolean;
+    dead: boolean;
+    ino: number;
+    mtimeMs: number;
+    raw: Buffer;
+}
+export type UnlockPreview = {
     held: false;
 } | {
     held: true;
+    eligible: false;
+    reason: string;
+    pid?: number;
+    runId?: string;
+} | {
+    held: true;
+    eligible: true;
+    pid: number;
+    runId: string;
+    ino: number;
+    mtimeMs: number;
+    raw: Buffer;
+};
+export declare function previewUnlock(repoRoot: string, runId: string): UnlockPreview;
+export declare function commitUnlock(repoRoot: string, target: {
+    pid: number;
+    runId: string;
+    ino: number;
+    mtimeMs: number;
+    raw: Buffer;
+}): {
     removed: true;
+    pid: number;
+    runId: string;
+} | {
+    removed: false;
+    reason: string;
+};
+export type UnlockGarbagePreview = {
+    held: false;
+} | {
+    held: true;
+    eligible: false;
+    reason: string;
     pid?: number;
     runId?: string;
-    garbage: boolean;
+} | {
+    held: true;
+    eligible: true;
+    ino: number;
+    raw: Buffer;
+};
+export declare function previewGarbageUnlock(repoRoot: string): UnlockGarbagePreview;
+export declare function commitGarbageUnlock(repoRoot: string, target: {
+    ino: number;
+    raw: Buffer;
+}): {
+    removed: true;
+} | {
+    removed: false;
+    reason: string;
 };