tickmarkr 2.5.0 → 2.5.1

package/dist/run/daemon.js

@@ -8,7 +8,7 @@ import { fileURLToPath } from "node:url";
 import { stringify } from "yaml";
 import { classifyDeadChannel, NO_TRAILER_SUMMARY, trailerPattern, UNPARSEABLE_TRAILER_SUMMARY, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, getAdapter, probeAll, readDoctor, rolePools } from "../adapters/registry.js";
-import { addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
+import { SettledTrailerTracker, addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { collateralHits } from "../compile/collateral.js";
 import { DEFAULT_DIFF_CAP, globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
@@ -27,14 +27,25 @@ import { runEnvironment } from "./environment.js";
 import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, sameCapacity, sh, shGit, SUITE_PARENT_ENV, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
-import { isDiffCapPark } from "../gates/review.js";
+import { isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
 import { nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
 import { harvestCpuFlatWindowMs, NUDGEABLE_ADAPTERS, PANE_READ_ROWS, StallProgressTracker, stallSnapshotBannerRows, WorkerTreeCpuAccountant, } from "./stall.js";
-// Compatibility exports for the daemon liveness tests and existing consumers. The implementation
-// lives in stall.ts so gate dispatch can depend on it without importing the daemon.
+// The live set is also the ownership claim shared by task cleanup and termination.
+export async function closeLiveSlot(liveSlots, driver, slot) {
+    if (!liveSlots.delete(slot))
+        return;
+    try {
+        await driver.close(slot);
+    }
+    catch (error) {
+        liveSlots.add(slot);
+        throw error;
+    }
+}
+// Compatibility exports: gate dispatch can import stall.ts without importing the daemon.
 export { harvestCpuFlatWindowMs, resetHarvestCpuFlatMsForTests, setHarvestCpuFlatMsForTests, workerTreeCpuMs, } from "./stall.js";
 const MODE_RANK = { "staff-led": 0, "risk-based": 1, "partner-led": 2 };
 // An override (flag/spec) re-resolves through loadConfigWithMode itself, via a synthesized repo overlay
@@ -1264,12 +1275,7 @@ export async function runDaemon(repoRoot, opts = {}) {
             // opens/closes keep the ledger exact. Termination then closes exactly what is still live — and a
             // slot closed once (task-done, quota reroute, gate self-clean) can never be closed twice.
             const liveSlots = new Set();
-            const closeSlot = async (s) => {
-                if (!liveSlots.has(s))
-                    return; // already closed — never twice
-                await driver.close(s);
-                liveSlots.delete(s);
-            };
+            const closeSlot = (s) => closeLiveSlot(liveSlots, driver, s);
             const trackedDriver = {
                 id: driver.id,
                 interactive: driver.interactive,
@@ -1331,7 +1337,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // new attempt while this reaper is still closing the old ones.
                         abortRun(new Error(`terminated by ${sig}`));
                         if (cfg.visibility.keepPanes !== "forever") {
-                            for (const s of liveSlots) { // closeSlot only deletes the element being visited — safe during Set iteration
+                            for (const s of Array.from(liveSlots)) { // snapshot: failed closes restore membership for the next sweep
                                 try {
                                     await closeSlot(s);
                                 }
@@ -1350,6 +1356,9 @@ export async function runDaemon(repoRoot, opts = {}) {
             process.on("SIGINT", onTermination);
             process.on("SIGTERM", onTermination);
             journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
+            const demotedReviewers = new Set(journal.read()
+                .filter((event) => event.event === "review-pool-demotion" && typeof event.data.reviewer === "string")
+                .map((event) => event.data.reviewer));
             const reviewHistory = journal.read()
                 .filter((event) => event.event === "gate-result" && event.data.gate === "review" && typeof event.data.reviewer === "string")
                 .map((event) => event.data.reviewer);
@@ -1816,6 +1825,35 @@ export async function runDaemon(repoRoot, opts = {}) {
                 if (rs)
                     journal.append("resume-restore", t.id, { attempts: rs.attempts, tried: [...tried], assignment });
                 const badReviewers = []; // v1.1: reviewer channels that produced unparseable output for this task
+                const noteReviewEvent = (e) => {
+                    journal.append(e.name, t.id, e.payload);
+                    if (e.name === "review-no-verdict" && typeof e.payload.reviewer === "string") {
+                        if (!badReviewers.includes(e.payload.reviewer))
+                            badReviewers.push(e.payload.reviewer);
+                    }
+                };
+                // Keep the measured siblings, including a red judge, while replacing only a missing review.
+                // Every dispatched seat is excluded for this task, so the loop is bounded by the eligible pool.
+                const runReviewRecovery = async (task, ctx) => {
+                    const round = await runGates(task, ctx);
+                    let review = round.results.find((g) => g.gate === "review");
+                    while (review?.meta?.noVerdict === true) {
+                        const next = pickReviewer(ctx.author, ctx.channels, badReviewers, cfg.review.prefer ?? [], task.routingHints?.floor, reviewHistory, undefined, demotedReviewers);
+                        if (!next)
+                            break;
+                        journal.append("review-infra-retry", t.id, { reviewer: channelKey(next), cause: review.meta.cause });
+                        const retried = await runGates({ ...task, gates: ["review"] }, ctx);
+                        const replacement = retried.results.find((g) => g.gate === "review");
+                        // A dirty tree or another pre-dispatch refusal must still fail closed.
+                        if (!replacement) {
+                            round.results.push(...retried.results.filter((g) => !gateSatisfied(g)));
+                            break;
+                        }
+                        round.results = round.results.map((g) => g.gate === "review" ? replacement : g);
+                        review = replacement;
+                    }
+                    return round;
+                };
                 // v1.70 T5 (review-convergence): failed review rounds this task has drawn, counted from the per-task
                 // review history already in the journal — the SAME review gate-result stream onGate reads to grow the
                 // reviewer-exclusion list (badReviewers), never a second parallel counter. OBS-189: scoped to the
@@ -1840,7 +1878,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // One helper, both onGate sites (satisfied-gate resume + main attempt loop).
                 let gateSubject;
                 const journalGateResult = (g) => {
-                    const blocking = gateFailed(g) && (g.gate === "review" || g.gate === "acceptance");
+                    const blocking = g.meta?.infra !== true && gateFailed(g) && (g.gate === "review" || g.gate === "acceptance");
                     // T2: a review that PASSED while DEFERRING a concern still recorded a defect — the prompt
                     // promises the deferral is recorded and never dropped, and a details string is not a record a
                     // later round can match. The blocking projection above is the only writer of structured
@@ -1861,12 +1899,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // The legacy baseline declines (a build command the repo never configured) have always written
                     // `pass: true` beside `skipped: true` and every consumer already reads them right, so their row
                     // is untouched: only a decline that would otherwise be recorded RED changes shape here.
-                    const unverdicted = g.meta?.skipped === true && !g.pass;
+                    // A no-verdict review is journaled `infra` + `skipped` with NO `pass`: the canonical reader
+                    // (outcome.ts) files it as infra regardless, the `pass === false` readers (rounds, briefs,
+                    // park kind) never charge it, and outstandingReviewFindings (journal.ts:816) skips a `skipped`
+                    // row instead of reading a missing `pass` as a PASS that settles every open blocking finding.
+                    const noVerdictReview = g.gate === "review" && g.meta?.noVerdict === true;
+                    const unverdicted = (g.meta?.skipped === true && !g.pass) || noVerdictReview;
                     journal.append("gate-result", t.id, {
                         gate: g.gate, ...(unverdicted ? {} : { pass: g.pass }), details: g.details,
                         ...(gateSubject ? { commit: gateSubject.commit, attempt: gateSubject.attempt } : {}),
                         ...(gateSubject?.replayMeasurement ? { replayMeasurement: true } : {}),
-                        ...(g.meta?.skipped === true ? { skipped: true } : {}),
+                        ...(g.meta?.skipped === true || noVerdictReview ? { skipped: true } : {}),
                         // T9: an infra-only exit is journaled AS one. The operator reading a red `test` row has to
                         // be able to tell "the suite found a defect" from "the runner never ran", and the merge
                         // predicate's reason for refusing has to be legible in the ledger it refused from.
@@ -1892,6 +1935,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ...(g.meta?.reapedGroup === true ? { reapedGroup: true } : {}),
                         ...(g.gate === "review" && typeof g.meta?.reviewer === "string" ? {
                             reviewer: g.meta.reviewer,
+                            ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised"]
+                                .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                             ...(typeof g.meta.vendor === "string" ? { vendor: g.meta.vendor } : {}),
                             ...(typeof g.meta.provider === "string" ? { provider: g.meta.provider } : {}),
                             ...(typeof g.meta.rotationSeat === "number" ? { rotationSeat: g.meta.rotationSeat } : {}),
@@ -1901,7 +1946,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // where work is allowed, not where this verdict found the defect.
                         ...(blocking ? {
                             taskContentDigest: contentDigest,
-                            findings: structuredFindings(g.gate, g.details),
+                            findings: Array.isArray(g.meta?.findings) ? g.meta.findings : structuredFindings(g.gate, g.details),
                         } : deferred.length > 0 ? {
                             taskContentDigest: contentDigest,
                             findings: deferred,
@@ -2267,7 +2312,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         };
                         await trackedDriver.project?.(t.id, "in-review");
                         journal.phaseStart(t.id, "gates");
-                        const { results } = await withSuiteWindow(t.id, resumedTask.gates.includes("test") && commands.test !== undefined, () => runGates(resumedTask, {
+                        const { results } = await withSuiteWindow(t.id, resumedTask.gates.includes("test") && commands.test !== undefined, () => runReviewRecovery(resumedTask, {
+                            carriedFindings: outstandingReviewFindings(journal.read(), t.id),
                             worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
                             commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                             collateral: collateral.get(t.id) ?? [],
@@ -2283,7 +2329,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                                 : undefined,
                             excludeReviewers: badReviewers,
-                            reviewHistory,
+                            reviewHistory, demotedReviewers,
                             onGate: async (e) => {
                                 if (e.phase === "start") {
                                     notePhaseStart(e);
@@ -2291,7 +2337,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     return;
                                 }
                                 if (e.phase === "note") {
-                                    journal.append(e.name, t.id, e.payload);
+                                    noteReviewEvent(e);
                                     return;
                                 }
                                 const g = e.result;
@@ -2318,6 +2364,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                         graph = addEvidence(graph, t.id, { commits: approvedCommits, gateResults: results });
                         saveGraph(repoRoot, graph);
                         if (!results.every(gateSatisfied)) {
+                            const infra = results.find((g) => g.meta?.infra === true);
+                            if (infra) {
+                                await park(t, `${infra.gate}: ${infra.details}`, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                return;
+                            }
                             // OBS-547: disposition FIRST, and through the same helper the ordinary attempt path uses. A
                             // crash between a journaled scope red and its classification must not turn a predicted red
                             // into a charged one just because a resume is what observed it.
@@ -2871,6 +2922,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                     let startupFailure = false;
                     let deadWorkerPark;
                     let settleParsed;
+                    const trailerFrames = interactive && adapter.busyFrameMarkers
+                        ? new SettledTrailerTracker(adapter.busyFrameMarkers) : undefined;
+                    const sampleTrailer = (frame) => {
+                        const trailer = new RegExp(trailerPattern(nonce)).test(frame);
+                        return trailerFrames ? trailerFrames.sample(frame, trailer) : trailer;
+                    };
                     let seedResult;
                     // v1.22 T5 / OBS-19: auto-answer a fingerprint-matched trust dialog exactly once per slot.
                     // Any other blocked/idle dialog pages the operator (unlatched since T1 — see below).
@@ -3036,14 +3093,22 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // own source, where "TICKMARKR_EXIT:" is a string literal) must not end the wait. Only a
                                         // parseable trailer or a digit-suffixed exit marker in the harvest is completion.
                                         output = await driver.read(slot, PANE_READ_ROWS); // TUI transcripts carry chrome — read deeper than print's 500
-                                        finished = new RegExp(trailerPattern(nonce)).test(output);
+                                        finished = sampleTrailer(output);
                                         const exit = exitRe.exec(output);
-                                        if (finished || exit) {
+                                        if (finished || (exit && !(trailerFrames && new RegExp(trailerPattern(nonce)).test(output)))) {
                                             exitCode = exit ? Number(exit[1]) : null; // null ⇔ the TUI is still alive
                                             processExited = exit !== null;
                                             await sampleContext(); // final poll-seam sample before leaving the wait
                                             break;
                                         }
+                                        if (trailerFrames && new RegExp(trailerPattern(nonce)).test(output)) {
+                                            // A matching busy frame is still a live turn. Preserve the rolling progress budget.
+                                            await sampleContext();
+                                            if (stallProgress.observe({ paneText: output, contextTokens }))
+                                                lastProgressAt = Date.now();
+                                            await new Promise((resolve) => setTimeout(resolve, Math.min(250, remaining)));
+                                            continue;
+                                        }
                                     }
                                     // A failed pane read is absence of evidence, never evidence of an absent pane. Keep the
                                     // rolling taskTimeoutMinutes window as the backstop and name the held probe once.
@@ -3078,6 +3143,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
                                         continue;
                                     }
+                                    // waitOutput is only a wake hint; a driver may miss a trailer already painted.
+                                    if (trailerFrames && sampleTrailer(paneText)) {
+                                        output = paneText;
+                                        finished = true;
+                                        const exit = exitRe.exec(output);
+                                        exitCode = exit ? Number(exit[1]) : null;
+                                        processExited = exit !== null;
+                                        await sampleContext();
+                                        break;
+                                    }
                                     if (paneText.length > 0)
                                         everHadOutput = true;
                                     if (startupFailureInWindow(paneText, workerLaunchedAt)) {
@@ -3429,9 +3504,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // un-answered nudge instead of the remainder of the window.
                                         nudgeDeadline = undefined;
                                         output = await driver.read(slot, PANE_READ_ROWS);
-                                        finished = new RegExp(trailerPattern(nonce)).test(output);
+                                        finished = sampleTrailer(output);
                                         const exit = exitRe.exec(output);
-                                        if (finished || exit) {
+                                        if (finished || (exit && !(trailerFrames && new RegExp(trailerPattern(nonce)).test(output)))) {
                                             exitCode = exit ? Number(exit[1]) : null;
                                             processExited = exit !== null;
                                             await sampleContext();
@@ -3476,12 +3551,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // The poll loop already recorded the unreadable pane. Retain the last readable bytes
                                         // so this ambiguous path still reaches the ordinary timeout/consult backstop.
                                     }
-                                    finished = new RegExp(trailerPattern(nonce)).test(output);
+                                    finished = trailerFrames ? trailerFrames.settled : new RegExp(trailerPattern(nonce)).test(output);
                                     const exit = exitRe.exec(output);
                                     exitCode = exit ? Number(exit[1]) : null;
                                     processExited = exit !== null;
                                 }
-                                if (finished) {
+                                if (finished && !trailerFrames) {
                                     await driver.waitAgentStatus(slot, "idle", 5_000); // settle, then re-harvest the final render
                                     output = await driver.read(slot, PANE_READ_ROWS);
                                 }
@@ -3501,11 +3576,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             break;
                                         await new Promise((r) => setTimeout(r, Math.min(settleDelayMs, remaining)));
                                         output = await driver.read(slot, PANE_READ_ROWS);
+                                        trailerFrames?.sample(output, new RegExp(trailerPattern(nonce)).test(output));
                                         settleParsed = adapter.parse(output, nonce);
                                         settleTries++;
                                     }
                                     if (settleParsed.summary !== UNPARSEABLE_TRAILER_SUMMARY) {
-                                        finished = settleParsed.summary !== NO_TRAILER_SUMMARY;
+                                        finished = settleParsed.summary !== NO_TRAILER_SUMMARY && (!trailerFrames || trailerFrames.settled);
                                     }
                                 }
                             }
@@ -3613,13 +3689,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // encoded and therefore invisible to the raw wait regex. Keep `output` bounded: every text
                     // classifier below retains its pre-artifact tail surface.
                     let result = settleParsed ?? adapter.parse(capturedStream.output, nonce);
+                    const unsettledTrailer = trailerFrames && !trailerFrames.settled
+                        && (trailerFrames.busyMarkersSeen.size > 0 || new RegExp(trailerPattern(nonce)).test(capturedStream.output));
+                    if (unsettledTrailer) {
+                        result = { ok: false, summary: `premature-idle: trailer did not settle; busy markers: ${[...trailerFrames.busyMarkersSeen].join(", ") || "awaiting two idle samples"}`, deviations: [], raw: output };
+                    }
                     const adapterCause = result.cause;
                     // Law 46: there is one completion fact. A classified adapter result with no parse-failure cause
                     // means its decoder found the nonce-bound trailer even when the raw JSON envelope escaped it.
-                    const workerFinished = finished || adapterCause === undefined;
+                    const workerFinished = !unsettledTrailer && (finished || adapterCause === undefined);
                     finished = workerFinished;
                     const adapterStartupFailure = adapterCause === "startup-failure";
-                    const workerCause = adapterStartupFailure
+                    const workerCause = unsettledTrailer ? "premature-idle" : adapterStartupFailure
                         ? "startup-failure"
                         : startupFailure
                             ? "startup-failure"
@@ -3708,9 +3789,24 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // never certifies the channel. Reading the synthesized `finished`/`ok` here reset the streak
                     // on every harvest, so a CLI that produces commits and swallows every trailer was immune to
                     // the two-window demotion and stayed first pick for the rest of the run.
+                    // Q-1 (OBS-926): BOTH branches read the same tail — a print stream tested whole failed a
+                    // pinned codex worker over for a diff line number (`429:`) 41 985 bytes before EOF and for
+                    // this repository's own fixture prose. The matched bytes and their stream offset ride the
+                    // row so a false positive is legible from the record alone.
+                    const quotaMatch = (interactive ? !workerFinished : exitCode !== 0)
+                        ? QUOTA_RE.exec(stallSnapshotBannerRows(output))
+                        : null;
+                    // Q-1: a graph pin is an operator instruction — a quota match ALONE never overrides it; only a
+                    // channel-attributed error (auth/setup/outage/timeout, the typed dead-channel classes) may.
+                    const pin = t.routingHints?.pin;
+                    const onPin = !!pin && assignment.adapter === pin.via && assignment.model === pin.model;
+                    const channelError = quotaMatch && onPin ? classifyDeadChannel({ ...preHarvestResult, raw: output }) : undefined;
+                    const pinRefusesQuota = !!quotaMatch && onPin && !channelError;
+                    // a refused quota window is not a no-trailer verdict on the pinned channel: counting it would
+                    // demote the pin two tails in and the demotion re-dispatch would move the task off it.
                     if (preHarvestResult.ok && workerFinished)
                         noTrailerStreak.set(channelKey(assignment), 0);
-                    else if (!workerFinished && cause !== "provider-death") {
+                    else if (!workerFinished && cause !== "provider-death" && !pinRefusesQuota) {
                         const ck = channelKey(assignment);
                         const streak = (noTrailerStreak.get(ck) ?? 0) + 1;
                         noTrailerStreak.set(ck, streak);
@@ -3740,12 +3836,29 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // T2 review: the gate is `workerFinished`, not the harvest-synthesized `finished` — a
                     // committed-but-quota-walled attempt routes here FIRST (its commits ride the carry-forward
                     // into the next attempt's recreated worktree), it never buys a gate run on throttled work.
-                    const quotaHit = interactive
-                        ? !workerFinished && QUOTA_RE.test(stallSnapshotBannerRows(output))
-                        : exitCode !== 0 && QUOTA_RE.test(output);
-                    if (quotaHit) {
+                    // Q-1 review: NO cap and NO fall-through to the consult ladder (failoverOrRecycle ignores the
+                    // pin) — the attempt is counted, so a pin that never clears parks at MAX_ATTEMPTS on its own
+                    // channel; only a channel-attributed error below may leave it.
+                    if (pinRefusesQuota) {
+                        journal.append("quota-failover-refused", t.id, {
+                            pin: `${pin.via}:${pin.model}`, channel: channelKey(assignment), matched: quotaMatch[0],
+                            reason: "pinned channel; no channel-attributed error", attempt,
+                        });
+                        await new Promise((r) => setTimeout(r, PROVIDER_DEATH_BACKOFF_MS));
+                        continue;
+                    }
+                    if (quotaMatch && (!onPin || channelError)) {
                         const next = failover("quota-failover");
-                        journal.append("quota-failover", t.id, { from: channelKey(assignment), to: next ? channelKey(next) : null });
+                        // byte offset inside the PERSISTED stream (the journaled `stream` file) — the capture keeps
+                        // only its last MAX_BUF bytes, so the file's origin may sit past the buffer's.
+                        const streamBytes = Buffer.byteLength(capturedStream.output);
+                        const idx = capturedStream.output.lastIndexOf(quotaMatch[0]);
+                        const offset = idx >= 0 ? Buffer.byteLength(capturedStream.output.slice(0, idx)) - Math.max(0, streamBytes - MAX_BUF) : null;
+                        journal.append("quota-failover", t.id, {
+                            from: channelKey(assignment), to: next ? channelKey(next) : null,
+                            matched: quotaMatch[0], offset, stream: capturedStream.path, streamBytes: Math.min(streamBytes, MAX_BUF),
+                            ...(onPin ? { pin: `${pin.via}:${pin.model}`, channelError } : {}),
+                        });
                         if (next) {
                             await driver.notify(`tickmarkr ${runId}: ${t.id} quota failover`, { tier: "attention" });
                             // OBS-17 T2: the superseded slot's pane closes AT REROUTE TIME — it holds a throttled
@@ -3866,7 +3979,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             return;
                         }
                         if (e.phase === "note") {
-                            journal.append(e.name, t.id, e.payload);
+                            noteReviewEvent(e);
                             return;
                         }
                         const g = e.result;
@@ -3904,7 +4017,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         gateSubject = { commit: await gateCommitSubject(taskBase, gated, wt), attempt };
                         await trackedDriver.project?.(t.id, "in-review");
                         journal.phaseStart(t.id, "gates");
-                        ({ results, commits } = await withSuiteWindow(t.id, t.gates.includes("test") && commands.test !== undefined, () => runGates(t, {
+                        ({ results, commits } = await withSuiteWindow(t.id, t.gates.includes("test") && commands.test !== undefined, () => runReviewRecovery(t, {
+                            carriedFindings: outstandingFindings,
                             worktree: wt, baseRef: taskBase, result, author: assignment,
                             commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                             collateral: collateral.get(t.id) ?? [],
@@ -3926,7 +4040,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                                 : undefined,
                             excludeReviewers: badReviewers,
-                            reviewHistory,
+                            reviewHistory, demotedReviewers,
                             onGate,
                         })));
                         results.forEach(classifySignalOnlyTest);

package/dist/tui/ink/init-app.d.ts

@@ -1,12 +1,16 @@
 import type { InitConfigOverlay } from "../../config/config.js";
 type Driver = NonNullable<InitConfigOverlay["driver"]>;
 type VisibilityLlm = NonNullable<NonNullable<InitConfigOverlay["visibility"]>["llm"]>;
+export type DetectedHost = "herdr" | "orca" | "subprocess";
+export declare function detectedHost(env?: NodeJS.ProcessEnv): DetectedHost;
+export declare function driverDescription(driver: Driver, host?: DetectedHost): string;
 export type InitWizardFields = {
     driver: Driver;
     concurrency: number;
     visibilityLlm: VisibilityLlm;
     offerSkills: boolean;
     skillsDefault: boolean;
+    detectedHost?: DetectedHost;
 };
 export type InitWizardResult = {
     kind: "continue";

package/dist/tui/ink/init-app.js

@@ -1,23 +1,33 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Box, render, Text, useApp, useInput } from "ink";
 import { useRef, useState } from "react";
+import { orcaHostDetected } from "../../drivers/index.js";
 import { ToggleMark } from "./components.js";
 import { clip, INK, inkInput, inkOutput, KeyBar, padCell, Pointer } from "./frame.js";
 const DRIVERS = ["auto", "herdr", "subprocess", "orca"];
-// One line per driver, shown for the value currently selected: four environments no longer fit on
-// a single description row at 80 columns (the shipped three already clipped). Auto identifies its
-// innermost host from environment markers only; outside an Orca terminal, Orca is named explicitly.
+export function detectedHost(env = process.env) {
+    if (env.HERDR_ENV === "1")
+        return "herdr";
+    if (orcaHostDetected(env))
+        return "orca";
+    return "subprocess";
+}
 const DRIVER_DESC = {
-    auto: "auto: herdr when HERDR_ENV=1, else orca inside an Orca terminal, else subprocess",
+    auto: "auto — resolves to subprocess here",
     herdr: "herdr: every worker runs in a visible pane you can watch and unblock",
     subprocess: "subprocess: headless child processes — no cockpit, same fail-closed gates",
     orca: "orca: visible terminals in the Orca app — picked by auto inside one; name it elsewhere",
 };
+export function driverDescription(driver, host = detectedHost()) {
+    if (driver === "auto")
+        return `auto — resolves to ${host} here`;
+    return DRIVER_DESC[driver];
+}
 const VISIBILITY = ["pane", "headless"];
 // Three fields, one toggle, one action — a descriptor array, deliberately not a forms framework.
-function buildRows(offerSkills, driver) {
+function buildRows(offerSkills, driver, host) {
     const rows = [
-        { id: "driver", section: "Run", label: "Driver", desc: DRIVER_DESC[driver] },
+        { id: "driver", section: "Run", label: "Driver", desc: driverDescription(driver, host) },
         { id: "concurrency", section: "Run", label: "Concurrency", desc: "parallel task batteries per run — min 1; an empty or zero entry reverts on leave" },
         {
             id: "visibility",
@@ -45,6 +55,7 @@ function buildRows(offerSkills, driver) {
 }
 export function InitWizardApp({ fields, frameColumns = 74 }) {
     const { exit } = useApp();
+    const host = fields.detectedHost ?? detectedHost();
     const [cursor, setCursor] = useState(0);
     const cursorRef = useRef(0);
     const driverRef = useRef(fields.driver);
@@ -56,7 +67,7 @@ export function InitWizardApp({ fields, frameColumns = 74 }) {
     const typedRef = useRef(false);
     const doneRef = useRef(false);
     // Built per render so the description row follows the driver the cursor last cycled to.
-    const rows = buildRows(fields.offerSkills, driverRef.current);
+    const rows = buildRows(fields.offerSkills, driverRef.current, host);
     const [, setRevision] = useState(0);
     const bump = () => setRevision((n) => n + 1);
     // Leaving the row (or pressing Enter on it) is the commit point: a parse ≥ 1 becomes the new

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/scripts/watch-context.sh

@@ -212,19 +212,30 @@ banner_pct() {
   # The rule glyph is passed IN, never written as an escape: this host's awk (BWK 20200816) does not
   # honour \xNN, and an unsupported escape matches nothing — the selector would find no rule line and
   # report UNREADABLE on every real pane while staying green against any fixture that skipped awk.
+  # OBS-964 (2): a codex footer has NO rule line above it, so the rule selector is UNREADABLE for the whole
+  # life of a codex seat. Fall back to the self-labelled `Context N% used` row — the label IS the selector.
   banner=$(printf '%s\n' "$screen" | awk -v rule='─' '
     { line[NR] = $0
       bare = $0; gsub(/[[:space:]]/, "", bare)
       stripped = bare; gsub(rule, "", stripped)
       if (bare != "" && stripped == "") last = NR }
-    END { if (last) for (i = last + 1; i <= NR; i++) if (line[i] ~ /[0-9]+%/) print line[i] }
+    END { labelled = 0
+          for (i = 1; i <= NR; i++) if (line[i] ~ /Context [0-9]+% used/) { print line[i]; labelled = 1 }
+          if (!labelled && last) for (i = last + 1; i <= NR; i++) if (line[i] ~ /[0-9]+%/) print line[i] }
   ' | tail -1)
   # No rule line in the window, or no percentage below it: say so out loud rather than guess.
   [ -n "$banner" ] || { printf 'UNREADABLE\n'; return 0; }
   printf '%s\n' "$banner" |
     grep -Eqi '(^|[^[:alnum:]])(claude|opus|sonnet|haiku|fable|gpt|gemini|glm|kimi|grok|composer|openai|zai)[[:alnum:]_./-]*([[:space:]]|$)' ||
     { printf 'UNREADABLE\n'; return 0; }
-  pct=$(printf '%s\n' "$banner" | grep -oE '[0-9]+%' | tail -1 | tr -d '%')
+  # OBS-964: a codex banner carries TWO percentages ("Context 16% used · weekly 96% left"); the LAST one is the
+  # quota, not the fill. Prefer the labelled context figure; fall back to the last bare % (claude-code banner).
+  pct=$(printf '%s\n' "$banner" | grep -oE 'Context [0-9]+% used' | grep -oE '[0-9]+' | head -1)
+  # OBS-964 add.3: a codex footer while WORKING drops the labelled figure but keeps `weekly N% left`; strip the
+  # quota phrase before the bare-% fallback so a quota can never be read as fill.
+  [ -n "$pct" ] || pct=$(printf '%s\n' "$banner" | sed -E 's/weekly [0-9]+% left//g' | grep -oE '[0-9]+%' | tail -1 | tr -d '%')
+  # OBS-964 add.4: keep the row the number came from, so a false reading can be diagnosed from bytes.
+  printf '%s\t%s\n' "$(date -u +%H:%M:%SZ)" "$banner" >> "${TMPDIR:-/tmp}/tkr-watch-context-banner-$(printf '%s' "$TARGET" | tr -c 'A-Za-z0-9' _).log" 2>/dev/null || true
   [ -n "$pct" ] && printf '%s\n' "$pct" || printf 'UNREADABLE\n'
 }