tickmarkr 2.5.0 → 2.5.2

package/dist/gates/baseline.js

@@ -30,7 +30,7 @@ const FAIL_ANCHOR_RE = /^\s*(?:FAIL\s+|[^\w]*(?:Unhandled Errors|Uncaught Except
 // to render. Digits are written (?:\d+|#) so a shape matches both raw and digit-normalized lines.
 // Run summaries: " Tests  N failed | M passed (T)" (vitest), "# fail N" (TAP / node:test),
 // "ℹ fail N" (node:test's spec reporter) and "test result: FAILED. …" (cargo / libtest).
-const SUMMARY_FAIL_RE = /^\s*(?:Tests?\s+(?:Files?\s+)?(?:\d+|#)\s+failed|#\s+fail\s+(?!0\b)(?:\d+|#)\b|ℹ\s+fail\s+(?!0\b)(?:\d+|#)\b|test result:\s+FAILED\b)/;
+const SUMMARY_FAIL_RE = /^\s*(?:Tests?\s+(?:Files?\s+)?(?!0\b)(?:\d+|#)\s+failed|#\s+fail\s+(?!0\b)(?:\d+|#)\b|ℹ\s+fail\s+(?!0\b)(?:\d+|#)\b|test result:\s+FAILED\b)/;
 const ERROR_ANCHOR_RE = /^\s*(?:Error|[A-Za-z_$][\w$]*Error):\s+\S/;
 const TSC_ERROR_RE = /^\s*\S.*\((?:\d+|#),(?:\d+|#)\):\s+error\s+[A-Z]+(?:\d+|#):/i; // tsc
 const LINTER_ERROR_RE = /^\s*(?:\d+|#):(?:\d+|#)\s+error\s+\S/; // eslint stylish
@@ -103,9 +103,8 @@ const stripTurboPrefix = (l) => {
 // Lines that NAME a failing test — the ones worth headlining to the operator. One list, so recognition
 // and reporting cannot drift apart (a shape that blocks but never gets named cost 3 attempts once).
 const namesFailure = (l) => FAIL_ANCHOR_RE.test(l) || RUNNER_FAIL_RE.test(l) || TRAILING_FAIL_RE.test(l) || GLYPH_FAIL_RE.test(l) || TURBO_FAIL_RE.test(l);
-// The stripped form is a second READ of the same line, for the recognition/headline paths that ask
-// "does anything here name a failure" — verdict classification (isInfraLine/namesRegression) keeps
-// reading the raw line only, so infra/regression verdicts are byte-unchanged by the prefix pass.
+// The stripped form lets recognition and headlines read the runner beneath a turbo prefix.
+// Classification applies the same prefix stripping before its infra/regression vetoes.
 const namesFailureEitherForm = (l) => {
     if (namesFailure(l))
         return true;
@@ -163,9 +162,13 @@ export function classifyFailureOutput(output) {
     // token inside a test's echoed stdout/stderr block must be as invisible to this classifier as it is
     // to fingerprint(): test-owned output is never runner evidence about the work.
     const lines = withoutVitestEchoBlocks(output).map((l) => l.replace(ANSI_RE, "")).filter((l) => !PASS_LINE_RE.test(l) && !OPERATOR_LINE_RE.test(l));
-    if (lines.some(namesRegression))
+    const evidence = lines.map((line) => stripTurboPrefix(line) ?? line).filter((line) => !PASS_LINE_RE.test(line) && !OPERATOR_LINE_RE.test(line));
+    const infra = evidence.some(isInfraLine);
+    // A diagnostic section heading names no failing test. It cannot outvote the RPC death
+    // beneath it, but an actual FAIL/AssertionError anywhere still takes precedence.
+    if (evidence.some((line) => !(infra && UNHANDLED_HEADER_RE.test(line)) && namesRegression(line)))
         return "regression";
-    return lines.some(isInfraLine) ? "infra" : undefined;
+    return infra ? "infra" : undefined;
 }
 /**
  * Capture validity asks a different question from gate classification. At a gate, one genuine
@@ -338,6 +341,8 @@ export function detectGateCommands(repoRoot, cfg) {
         else if (scripts[name])
             out[name] = `${runPrefix} ${name}`;
     }
+    if (cfg.gates.tipTest)
+        out.tipTest = cfg.gates.tipTest;
     return out;
 }
 /**
@@ -452,6 +457,7 @@ const invalidCaptureEntry = (durationMs, invalidCause, invalidatingLines = []) =
     fingerprints: [],
     durationMs,
     fileDurationSumMs: null,
+    fileCount: null,
     impliedParallelism: null,
     longestFile: null,
     ceilingMs: effectiveCeilingMs({ durationMs }),
@@ -460,11 +466,16 @@ const invalidCaptureEntry = (durationMs, invalidCause, invalidatingLines = []) =
 export async function captureBaseline(cwd, commands) {
     const base = { commands: {} };
     for (const [name, cmd] of Object.entries(commands)) {
+        if (name === "tipTest" && commands.test !== undefined && cmd === commands.test) {
+            continue;
+        }
         const r = await sh(cmd, cwd, CAPTURE_CEILING_MS);
         // ponytail: strip the executing cwd so repo-root capture and worktree compare fingerprint identically; /private-vs-/tmp symlink variance is out of scope
         // ponytail: a capture that was itself killed records the ceiling as its "measurement", which
         // scales the next ceiling up — the right direction for a suite that never finished once.
         const durationMs = r.durationMs ?? 0;
+        const combinedOutput = r.stdout + "\n" + r.stderr;
+        const raw = combinedOutput.split(cwd).join("");
         // OBS-534 (T2): a capture SIGKILLed at its ceiling never returned a verdict, so `r.code` is the
         // kill and not evidence about the command. Run 1501 recorded `test: {durationMs: 600007,
         // exitCode: 1}` for exactly this — a kill written down as a red baseline. There the accident
@@ -483,11 +494,9 @@ export async function captureBaseline(cwd, commands) {
             console.error(`tickmarkr: baseline capture for "${name}" was killed at its ${CAPTURE_CEILING_MS}ms ceiling — `
                 + `it recorded NO fingerprints, so nothing is forgiven and every gate will treat a pre-existing `
                 + `failure as a fresh one. Raise the ceiling or shorten the command.`);
-            base.commands[name] = invalidCaptureEntry(durationMs, "ceiling-kill");
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "ceiling-kill"), fileCount: runnerFileCount(raw) };
             continue;
         }
-        const combinedOutput = r.stdout + "\n" + r.stderr;
-        const raw = combinedOutput.split(cwd).join("");
         // Run 2137: the child exited and printed ordinary FAIL/AssertionError lines, so the gate-side
         // discriminator correctly called the mixed output a regression. But the same output also said
         // `spawn EAGAIN`: the machine had run out of processes while the pristine-tree measurement was
@@ -499,15 +508,15 @@ export async function captureBaseline(cwd, commands) {
                 + `it recorded NO exit-code verdict and NO fingerprints, so nothing is forgiven for this command; `
                 + `the measurement cannot distinguish a pre-existing failure from one caused by exhaustion. `
                 + `First invalidating line: ${invalidatingLines[0]}`);
-            base.commands[name] = invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines);
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines), fileCount: runnerFileCount(raw) };
             continue;
         }
-        // OBS-885/887: capture and gate ask the same classifier. A green summary followed only by the
-        // teardown fingerprint is a pass; infrastructure without a summary is no verdict to forgive.
+        // OBS-966: a worker RPC timeout is infra even beside an all-green summary.
+        // Capture and both gate readers share this discriminator; genuine test failures still dominate.
         const runnerVerdict = classifyRunnerOutput(raw, r.code);
         if (runnerVerdict === "infra") {
-            console.error(`tickmarkr: baseline capture for "${name}" carries runner-infrastructure evidence and no green summary — it recorded NO verdict; nothing is forgiven for this command`);
-            base.commands[name] = invalidCaptureEntry(durationMs, "infra");
+            console.error(`tickmarkr: baseline capture for "${name}" carries runner-infrastructure evidence — it recorded NO verdict; nothing is forgiven for this command`);
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "infra", withoutVitestEchoBlocks(combinedOutput).filter((line) => isInfraLine(line.replace(ANSI_RE, "")))), fileCount: runnerFileCount(raw) };
             continue;
         }
         base.commands[name] = {
@@ -519,13 +528,14 @@ export async function captureBaseline(cwd, commands) {
             missingCommand: missingConfiguredCommand(cmd, r),
             durationMs,
             ...fileTiming(raw, durationMs),
+            fileCount: runnerFileCount(raw),
             ceilingMs: effectiveCeilingMs({ durationMs }),
             // T7: the world this measurement was taken in, so a later reader can ask whether its own world
             // is the same one. Recorded from THIS command's own shell result, never re-derived here.
             ...(r.capacity ? { capacity: r.capacity } : {}),
         };
     }
-    const names = Object.keys(commands);
+    const names = Object.keys(commands).filter((name) => !(name === "tipTest" && commands.test !== undefined && commands[name] === commands.test));
     const missing = names.filter((name) => base.commands[name]?.missingCommand === true);
     if (names.length > 0 && missing.length === names.length) {
         base.warnings = [{
@@ -609,10 +619,15 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             const withReapError = r.reapError ? { ...withReap, meta: { ...withReap.meta, reapError: r.reapError } } : withReap;
             const withRerun = rerunOf ? {
                 ...withReapError,
-                details: `host-starved rerun after waiting ${rerunOf.waitedMs}ms for a calm load window: ${withReapError.details}`,
+                details: `${g.meta?.classification === "infra" ? "infra; " : ""}host-starved rerun after waiting ${rerunOf.waitedMs}ms for a calm load window: ${withReapError.details.replace(/^infra; /, "")}`,
                 meta: { ...withReapError.meta, hostStarvedRerun: rerunOf },
             } : withReapError;
-            results.push(r.capacity ? { ...withRerun, capacity: r.capacity } : withRerun);
+            const final = opts.infraRerun ? {
+                ...withRerun,
+                details: `${g.meta?.classification === "infra" ? "infra; " : ""}runner-infra rerun after waiting ${opts.infraRerun.waitedMs}ms for a calm load window: ${withRerun.details.replace(/^infra; /, "")}`,
+                meta: { ...withRerun.meta, runnerInfraRerun: opts.infraRerun },
+            } : withRerun;
+            results.push(r.capacity ? { ...final, capacity: r.capacity } : final);
         };
         // …and whether the entry that would forgive this command was measured in the same world. A
         // baseline captured under a different fork cap forgives nothing: its fingerprints describe a
@@ -641,11 +656,16 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             });
             continue;
         }
+        const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
+        const deficit = fileCountDeficit(entry, raw);
+        if (deficit) {
+            record({ gate: name, pass: false, details: deficit, meta: { classification: "infra", infra: true } });
+            continue;
+        }
         if (r.code === 0) {
             record({ gate: name, pass: true, details: "exit 0" });
             continue;
         }
-        const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
         // OBS-885/887: the same classifier the capture applied names a completed green suite on both sides.
         const runnerVerdict = classifyRunnerOutput(raw, r.code);
         if (runnerVerdict === "green-teardown") {
@@ -665,12 +685,16 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // that known assertion outvote the fresh birpc line turns machine failure into a worker defect.
         // `classifyRunnerOutput` remains the single discriminator. When there is no fresh fingerprint,
         // retain the whole-output read so a repeated infra abort can never be baseline-forgiven as green.
-        const freshVerdict = failing.length ? classifyRunnerOutput(failing.join("\n"), r.code) : undefined;
-        const freshClassification = freshVerdict === "infra" || freshVerdict === "regression" ? freshVerdict : undefined;
-        const classification = freshClassification ?? (!failing.length && (runnerVerdict === "infra" || runnerVerdict === "regression") ? runnerVerdict : undefined);
+        const classification = classifyFreshRunnerOutput(entry, raw, r.code);
+        if (name === "test" && classification === "infra" && !rerunOf && !opts.infraRerun) {
+            const waitedMs = await waitForCalmWindow();
+            const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
+            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { infraRerun: provenance }));
+            continue;
+        }
         // OBS-896: every fresh failure must be timeout-class, and the suite must take at least twice its
         // own baseline measurement. The first read buys one calm rerun here, never a worker repair.
-        if (name === "test" && classification !== "infra" && failing.length && !rerunOf
+        if (name === "test" && classification !== "infra" && failing.length && !rerunOf && !opts.infraRerun
             && hostStarved(failing.join("\n"), r.durationMs ?? 0, entry?.durationMs)) {
             const waitedMs = await waitForCalmWindow();
             const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
@@ -684,7 +708,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             record({
                 gate: name,
                 pass: false,
-                details: `exit ${r.code}; the fresh failures carry infrastructure evidence alone — the runner never completed a suite, so this gate verified nothing:\n${evidence}`,
+                details: `infra; exit ${r.code}; the fresh failures carry infrastructure evidence alone — the runner never completed a suite, so this gate verified nothing:\n${evidence}`,
                 meta: { classification, infra: true },
             });
             continue;
@@ -695,9 +719,11 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // entries with no exitCode keep the `?? 1` red default both readers share (merge.ts:131).
         const baselineRed = entry?.infra !== true && (entry?.exitCode ?? 1) !== 0;
         if (!failing.length && !baselineRed) {
-            const recordedCause = entry?.invalidCause === "resource-exhaustion" || entry?.invalidatingLines?.length
-                ? `was invalidated by its recorded process/resource-exhaustion cause${entry.invalidatingLines?.[0] ? ` (${entry.invalidatingLines[0]})` : ""}`
-                : "was killed at its ceiling";
+            const recordedCause = entry?.invalidCause === "infra"
+                ? "was invalidated by its recorded runner-infrastructure cause"
+                : entry?.invalidCause === "resource-exhaustion" || entry?.invalidatingLines?.length
+                    ? `was invalidated by its recorded process/resource-exhaustion cause${entry.invalidatingLines?.[0] ? ` (${entry.invalidatingLines[0]})` : ""}`
+                    : "was killed at its ceiling";
             const closed = entry?.infra === true
                 ? `the baseline capture for this command ${recordedCause} and recorded no verdict, so nothing here is forgivable — it now exits ${r.code} with no recognizable failure lines — failing closed`
                 : `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`;
@@ -742,7 +768,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
     return results;
 }
 const SUMMARY_LINE_RE = /^[^\S\n]*Test Files[^\S\n]+(.+)$/m;
-const TEARDOWN_RE = /\[vitest-worker\]: Timeout calling\b|\[birpc\] rpc is closed, cannot call\b/;
+const TEARDOWN_RE = /\[birpc\] rpc is closed, cannot call\b/;
 const UNHANDLED_HEADER_RE = /^\s*[^\w]*(?:Unhandled Errors|Uncaught Exception)\b/;
 /** One interpretation of runner bytes, shared by baseline capture and every gate consumer. */
 export function classifyRunnerOutput(raw, code) {
@@ -750,6 +776,8 @@ export function classifyRunnerOutput(raw, code) {
         return undefined;
     const lines = withoutVitestEchoBlocks(raw).map((l) => l.replace(ANSI_RE, ""));
     const text = lines.join("\n");
+    if (lines.some((line) => /\[vitest-worker\]: Timeout calling\b/.test(line) && !PASS_LINE_RE.test(line) && !OPERATOR_LINE_RE.test(line)))
+        return classifyFailureOutput(text);
     const summary = SUMMARY_LINE_RE.exec(text);
     if (summary) {
         const failed = [...summary[1].matchAll(/\b(\d+)\s+failed\b/g)].map((match) => Number(match[1]));
@@ -780,14 +808,42 @@ export function hostStarved(fresh, durationMs, referenceMs) {
     const heads = fresh.split("\n").map((line) => line.replace(ANSI_RE, "")).filter((line) => ERROR_HEAD_RE.test(line));
     return heads.length > 0 && heads.every((line) => TIMEOUT_CLASS_RE.test(line));
 }
-const DEFAULT_CALM = { pollMs: 5_000, maxWaitMs: 600_000, loadProvider: () => loadavg()[0] ?? 0, calmLoad: () => availableParallelism() / 2 };
+const DEFAULT_CALM = {
+    pollMs: process.env.VITEST ? 10 : 5_000,
+    maxWaitMs: process.env.VITEST ? 50 : 600_000,
+    loadProvider: () => loadavg()[0] ?? 0,
+    calmLoad: () => availableParallelism() / 2,
+};
 let calm = DEFAULT_CALM;
 export function setCalmWindowForTests(over) { calm = { ...calm, ...over }; }
 export function resetCalmWindowForTests() { calm = DEFAULT_CALM; }
-async function waitForCalmWindow() {
+export async function waitForCalmWindow() {
     const started = Date.now();
     while (calm.loadProvider() > calm.calmLoad() && Date.now() - started < calm.maxWaitMs) {
         await new Promise((resolve) => setTimeout(resolve, calm.pollMs));
     }
     return Date.now() - started;
 }
+/** Summary totals survive digit-normalized fingerprints and exclude test-owned echoed output. */
+export function runnerFileCount(raw) {
+    const counts = withoutVitestEchoBlocks(raw).flatMap((line) => {
+        const clean = line.replace(ANSI_RE, "");
+        const match = /^\s*Test Files\s+.*\((\d+)\)\s*$/.exec(stripTurboPrefix(clean) ?? clean);
+        return match ? [Number(match[1])] : [];
+    });
+    return counts.length ? counts.reduce((sum, count) => sum + count, 0) : null;
+}
+export function fileCountDeficit(entry, raw) {
+    const actual = runnerFileCount(raw);
+    return entry?.fileCount != null && actual !== null && actual < entry.fileCount
+        ? `infra; runner reported ${actual} test files, below baseline ${entry.fileCount} — suite incomplete`
+        : undefined;
+}
+/** Both readers classify fresh evidence first, retaining the whole-output guard against infra forgiveness. */
+export function classifyFreshRunnerOutput(entry, raw, code) {
+    if (classifyRunnerOutput(raw, code) === "green-teardown")
+        return undefined;
+    const { failing } = freshFailures(entry, raw);
+    const verdict = classifyRunnerOutput(failing.length ? failing.join("\n") : raw, code);
+    return verdict === "infra" || verdict === "regression" ? verdict : undefined;
+}

package/dist/gates/llm.d.ts

@@ -61,7 +61,12 @@ export interface LlmRunResult {
     output: string;
     exitCode?: number;
     timedOut: boolean;
+    launchNeverStarted?: boolean;
+    seatAuthoredBytes?: number;
 }
+export declare const PROMPT_GLYPHS: readonly ["➜", "❯", "$", "%", ">>", ">"];
+export declare function reviewSeatOutput(raw: string, nonce: string): string;
+export declare const REVIEW_FIRST_LIVENESS_MS = 30000;
 export declare function runHeadless(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, timeoutMs?: number): Promise<string>;
 export declare function runViaDriver(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function dewrapPaneVerdict(out: string, nonce: string): string;

package/dist/gates/llm.js

@@ -1,3 +1,4 @@
+import { stripVTControlCharacters } from "node:util";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes } from "node:crypto";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
@@ -5,7 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { matchesTrustDialog } from "../adapters/types.js";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
-import { bannerShell, paneDispatchCommand } from "../brand.js";
+import { bannerShell, paneDispatchCommand, PLAIN_BANNER } from "../brand.js";
 import { sh } from "../run/git.js";
 import { harvestCpuFlatWindowMs, normalizeStallSnapshot, WorkerTreeCpuAccountant, } from "../run/stall.js";
 export const GATE_PANE_SEP = " · ";
@@ -129,13 +130,164 @@ export async function captureLlmOutput(run) {
     const value = await llmOutputCapture.run(outputs, run);
     return { value, outputs };
 }
+// The harness preamble has a fixed row shape, in order: the dispatch echo rows (the identity export
+// and the START printf, each possibly re-echoed behind the shell prompt), the START acknowledgement
+// row, the banner rows, blank rows, and the identity row. RULING-229-15 add.1 makes the boundary
+// STRUCTURAL: a pane read is line-terminated, so only the LAST row of a capture can be a partial
+// paint. Every row before it is complete, and a complete row is harness only when it EQUALS a full
+// harness row in the position the preamble allows. A complete row that merely starts with "T",
+// "export", "review" or a banner glyph is seat text, and seat prose that MENTIONS a marker mid-row
+// counts in full — "contains TICKMARKR_START_ somewhere" is never by itself a reason to measure zero.
+const BANNER_ROWS = PLAIN_BANNER.replace(/\n$/, "").split("\n");
+const ECHO_OPENER = "export HERDR_WORKSPACE_ID=";
+const ECHO_START_OPENER = "printf '%s%s\\n' 'TICKMARKR_START_' '";
+const ECHO_OPENERS = [ECHO_OPENER, ECHO_START_OPENER];
+// RULING-229-15 add.5: the prompt glyph set is this CLOSED list — the corpus sweeps it, the grammar
+// consumes the LONGEST glyph that matches (so ">>" is one glyph and ">" is still one).
+export const PROMPT_GLYPHS = ["➜", "❯", "$", "%", ">>", ">"];
+const GIT_SEGMENT_OPEN = "git:(";
+function echoRowMatch(row) {
+    const opener = (at) => {
+        const body = row.slice(at);
+        if (ECHO_OPENERS.some((o) => body.startsWith(o)))
+            return "complete";
+        return ECHO_OPENERS.some((o) => o.startsWith(body)) ? "partial" : "none";
+    };
+    const ws = (at) => /^\s+/.exec(row.slice(at))?.[0].length;
+    const bare = opener(0);
+    if (bare !== "none")
+        return bare;
+    const glyph = PROMPT_GLYPHS.find((g) => row.startsWith(g));
+    if (glyph === undefined)
+        return "none";
+    let i = glyph.length;
+    const ws1 = ws(i);
+    if (ws1 === undefined)
+        return row.length === i ? "partial" : "none";
+    i += ws1;
+    const dir = /^\S+/.exec(row.slice(i));
+    if (!dir)
+        return "partial";
+    i += dir[0].length;
+    const ws2 = ws(i);
+    if (ws2 === undefined)
+        return "partial";
+    i += ws2;
+    const rest = row.slice(i);
+    if (rest.startsWith(GIT_SEGMENT_OPEN)) {
+        const close = row.indexOf(")", i + GIT_SEGMENT_OPEN.length);
+        if (close < 0)
+            return "partial";
+        i = close + 1;
+        const ws3 = ws(i);
+        if (ws3 === undefined)
+            return row.length === i ? "partial" : "none";
+        return opener(i + ws3);
+    }
+    if (GIT_SEGMENT_OPEN.startsWith(rest))
+        return "partial"; // "", "g", "gi", "git", "git:"
+    return opener(i);
+}
+// A complete dispatch echo row: the grammar reaches the opener. Never "contains the opener" — a row
+// that mentions it mid-prose is the seat's.
+function completeEchoRow(row) {
+    return echoRowMatch(row) === "complete";
+}
+// A LAST row still being painted: any prefix of a row in the grammar.
+function partialEchoRow(row) {
+    return echoRowMatch(row) !== "none";
+}
+const START_MARKER = "TICKMARKR_START_";
+const START_ROW = /^TICKMARKR_START_[\w-]+$/;
+const IDENTITY_LINE = /^(?:review\s*·|tickmarkr(?::|$))/;
+const IDENTITY_OPENERS = ["review ·", "tickmarkr"];
+// Stages of the preamble walk. Each complete harness row is accepted only at or after its stage.
+const ECHO = 0, START = 1, BANNER = 2, IDENTITY = 3, SEAT = 4;
+// The char offset where the seat's own text begins, or -1 when the capture ends inside the preamble.
+function seatStart(output) {
+    const rows = output.split("\n");
+    if (rows.length > 1 && rows[rows.length - 1] === "")
+        rows.pop(); // the read's own line terminator
+    let stage = ECHO;
+    let bannerAt; // next banner row expected once the banner has begun
+    let offset = 0;
+    for (let i = 0; i < rows.length; i++) {
+        const row = rows[i].replace(/[ \t]+$/, "");
+        const t = row.trim();
+        const last = i === rows.length - 1;
+        // Complete harness rows: equality against the shape the preamble allows at this stage.
+        let accepted = false;
+        if (stage < SEAT && t.length === 0)
+            accepted = true; // blank rows between preamble rows
+        else if (stage <= ECHO && completeEchoRow(row))
+            accepted = true;
+        else if (stage <= START && START_ROW.test(row)) {
+            stage = BANNER;
+            accepted = true;
+        }
+        else if (stage <= BANNER && bannerAt === undefined && BANNER_ROWS.includes(row)) {
+            stage = BANNER;
+            bannerAt = BANNER_ROWS.indexOf(row) + 1;
+            accepted = true;
+        }
+        else if (stage <= BANNER && bannerAt !== undefined && row === BANNER_ROWS[bannerAt]) {
+            bannerAt++;
+            accepted = true;
+        }
+        else if (stage <= IDENTITY && IDENTITY_LINE.test(t)) {
+            stage = SEAT;
+            accepted = true;
+        }
+        if (accepted) {
+            offset += rows[i].length + 1;
+            continue;
+        }
+        if (!last)
+            return offset;
+        // The last row may be a partial paint: a prefix of the next harness row the preamble allows.
+        if (stage <= ECHO && partialEchoRow(row))
+            return -1;
+        if (stage <= START && (START_MARKER.startsWith(row) || /^TICKMARKR_START_[\w-]*$/.test(row)))
+            return -1;
+        if (stage <= BANNER && (bannerAt === undefined
+            ? BANNER_ROWS.some((b) => b.startsWith(row))
+            : BANNER_ROWS[bannerAt]?.startsWith(row) === true))
+            return -1;
+        // The identity row is painted right after the banner, so its prefix is a partial paint only there;
+        // with no banner in the capture, "review" or "tick" alone is the seat's own first row.
+        if (stage <= IDENTITY && bannerAt === BANNER_ROWS.length && IDENTITY_OPENERS.some((o) => o.startsWith(t)))
+            return -1;
+        return offset;
+    }
+    return -1; // every row was harness — the seat has not taken its turn
+}
+// A pane's dispatch echo, start acknowledgement, banner and identity are harness bytes.
+// Remove only that leading preamble, never matching text later in the seat's response.
+// Every capture taken before the preamble finishes therefore measures ZERO seat-authored bytes,
+// which is what makes the caller's running Math.max safe: a partial banner counted once would be
+// retained for the whole call and buy a silent seat its full ceiling.
+export function reviewSeatOutput(raw, nonce) {
+    const output = stripVTControlCharacters(raw).replace(/\r\n?/g, "\n");
+    const start = seatStart(output);
+    if (start < 0)
+        return "";
+    const seat = output.slice(start);
+    // Anything after the nonce-bound trailer belongs to the terminal (typically the next shell
+    // prompt), not the reviewer. Deleting only the marker would count that postlude as seat output and
+    // let a zero-byte seat escape first-silence demotion.
+    const trailer = new RegExp(`(?:^|\\n)TICKMARKR_EXIT_${nonce}:\\d+[^\\n]*(?:\\n|$)`).exec(seat);
+    // A trailer row still being typed is not stripped: after the preamble a last row "T" is far more
+    // often the seat's first byte than the harness's exit marker, and the next read completes either.
+    return trailer ? seat.slice(0, trailer.index) : seat;
+}
+export const REVIEW_FIRST_LIVENESS_MS = 30_000;
 async function runHeadlessDetailed(adapter, model, prompt, cwd, timeoutMs = 300000) {
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
     try {
         const pf = join(dir, "prompt.md");
         writeFileSync(pf, prompt);
         const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
-        return { output: r.stdout + "\n" + r.stderr, exitCode: r.code, timedOut: r.timedOut === true };
+        return { output: r.stdout + "\n" + r.stderr, exitCode: r.code, timedOut: r.timedOut === true, seatAuthoredBytes: Buffer.byteLength((r.stdout + r.stderr).trim()) };
     }
     finally {
         rmSync(dir, { recursive: true, force: true });
@@ -150,6 +302,7 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
     let slot;
     let accountant;
+    let forceClose = false;
     try {
         const pf = join(dir, "prompt.md");
         writeFileSync(pf, prompt);
@@ -180,6 +333,8 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
         const exitPattern = `TICKMARKR_EXIT_${nonce}:\\d`;
         let out;
         let timedOut = false;
+        let launchNeverStarted = false;
+        let seatAuthoredBytes = 0;
         const gatePrompt = prompt.startsWith("TICKMARKR-JUDGE") || prompt.startsWith("TICKMARKR-REVIEW");
         if (!gatePrompt) {
             await via.driver.waitOutput(slot, exitPattern, timeoutMs, { regex: true });
@@ -193,6 +348,9 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
             await accountant.start();
             const startedAt = Date.now();
             out = await via.driver.read(slot, 400);
+            const reviewing = prompt.startsWith("TICKMARKR-REVIEW");
+            seatAuthoredBytes = Buffer.byteLength(reviewSeatOutput(out, nonce));
+            let firstLivenessObserved = false;
             let priorSnapshot = normalizeStallSnapshot(out);
             const anchoredAt = Date.now();
             let quietSince = anchoredAt;
@@ -207,12 +365,35 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
                 const matched = await via.driver.waitOutput(slot, exitPattern, sliceMs, { regex: true });
                 const raw = await via.driver.read(slot, 400);
                 out = raw;
+                seatAuthoredBytes = Math.max(seatAuthoredBytes, Buffer.byteLength(reviewSeatOutput(raw, nonce)));
                 // waitOutput is the driver's authoritative marker match. The raw check covers drivers whose
                 // wait timed out at the same boundary the marker landed; either way a trailer completes
                 // normally and is never mistaken for inactivity.
                 if (matched || new RegExp(exitPattern).test(raw))
                     break;
                 const now = Date.now();
+                // The ceiling wins if it coincides with the first beat (or the read crosses it).
+                // That seat was killed by its configured timeout, not an early launch reroute.
+                if (now - startedAt >= timeoutMs)
+                    break;
+                if (reviewing && !firstLivenessObserved && now - startedAt >= REVIEW_FIRST_LIVENESS_MS) {
+                    firstLivenessObserved = true;
+                    // RS-2: the beat reads seat-authored bytes ALONE. CPU evidence never holds a preamble-only
+                    // capture open to the ceiling; a seat that has not written one byte of its own is re-routed.
+                    // OBS-944 is why a buffering runner earns no exemption here: the claude-code seat's 901 s
+                    // capture was byte-identical across two legs and ended at the pane-identity line — that
+                    // seat never started, it was not quietly working. RULING-229-06 puts the beat on the PANE
+                    // path only; a headless `-p` runner (runHeadlessDetailed, no pane, no beat) buffers every
+                    // byte until completion and keeps its full ceiling.
+                    if (seatAuthoredBytes === 0) {
+                        launchNeverStarted = true;
+                        forceClose = true;
+                        break;
+                    }
+                }
+                // Producing reviews own their full ceiling; inactivity is not a review verdict.
+                if (reviewing)
+                    continue;
                 const snapshot = normalizeStallSnapshot(raw);
                 if (snapshot !== priorSnapshot) {
                     priorSnapshot = snapshot;
@@ -246,18 +427,22 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
                 }
             }
             timedOut = Date.now() - startedAt >= timeoutMs && !new RegExp(exitPattern).test(out);
+            if (timedOut && reviewing)
+                forceClose = true;
         }
         const exitCode = Number(new RegExp(`TICKMARKR_EXIT_${nonce}:(\\d+)`).exec(out)?.[1]);
         return {
             output: dewrapPaneVerdict(out, nonce),
             ...(Number.isFinite(exitCode) ? { exitCode } : {}),
             timedOut,
+            launchNeverStarted,
+            seatAuthoredBytes,
         };
     }
     finally {
         try {
             await accountant?.stop();
-            if (slot && !via.keep)
+            if (slot && (forceClose || !via.keep))
                 await via.driver.close(slot);
         }
         finally {

package/dist/gates/review.d.ts

@@ -1,6 +1,7 @@
 import { type Assignment, type BillingChannel, type WorkerAdapter } from "../adapters/types.js";
 import { type TickmarkrConfig, type Tier } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
+import { type StructuredFinding } from "../run/journal.js";
 import { modelProvider } from "../route/preference.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
@@ -16,6 +17,8 @@ export interface ReviewFinding {
 }
 export interface ReviewVerdict {
     approve?: boolean;
+    resolved?: string[];
+    reraised?: string[];
     issues?: string[];
     findings?: ReviewFinding[];
     comments?: Array<{
@@ -54,12 +57,12 @@ export declare function pickReviewer(author: Assignment, channels: BillingChanne
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor?: Tier, // task-declared only; config floors govern workers and must not silently move review seats
 history?: string[], // run-scoped picks, oldest to newest; empty preserves the established ranking
-onSeat?: (seat: number) => void): BillingChannel | null;
-export type ReviewUnparseableCause = VerdictUnparseableCause;
+onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>): BillingChannel | null;
+export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-started" | "truncated" | "silent";
 /**
  * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
  * remains a separate stated input, so whether its touched paths fit the declaration stays a reviewer
  * judgement rather than a guarantee made by this renderer.
  */
 export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
-export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[]): Promise<GateResult>;
+export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[], demotedReviewers?: ReadonlySet<string>, carriedFindings?: readonly StructuredFinding[]): Promise<GateResult>;