tickmarkr 2.5.1 → 2.5.2

package/dist/cli/commands/approve.js

@@ -114,7 +114,7 @@ export function approvalRunOwner(cwd, runId) {
 /** The one sentence that says who enacts this release and what it buys. */
 export function approvalEnactment(token, run) {
     if (run.live) {
-        return `the live daemon enacts this at its next task boundary — it will ${APPROVAL_ENACTS[token]}`;
+        return `the live daemon enacts this at its next task boundary — it will ${APPROVAL_ENACTS[token]}, including in the approval window or by cancelling an in-progress tip verify`;
     }
     if (run.blockingRunId) {
         return `release recorded; live run \`${run.blockingRunId}\` holds the repository lock, so resume \`${run.runId}\` after it ends to ${APPROVAL_ENACTS[token]}`;

package/dist/cli/commands/doctor.d.ts

@@ -162,6 +162,7 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
     gates: {
         build?: string | undefined;
         test?: string | undefined;
+        tipTest?: string | undefined;
         lint?: string | undefined;
         diffCap?: number | undefined;
         byShape?: Partial<Record<"plan" | "spec" | "implement" | "tests" | "docs" | "migration" | "ui" | "refactor" | "chore", {
@@ -278,6 +279,7 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
     gates: {
         build?: string | undefined;
         test?: string | undefined;
+        tipTest?: string | undefined;
         lint?: string | undefined;
         diffCap?: number | undefined;
         byShape?: Partial<Record<"plan" | "spec" | "implement" | "tests" | "docs" | "migration" | "ui" | "refactor" | "chore", {

package/dist/cli/commands/init.js

@@ -114,7 +114,7 @@ A run is green only when ALL of these hold: the run-end event exists in the jour
 
 ### Verified handoffs
 
-When relaying missions between agents, never use bare send-text (\`herdr agent send\` / pane send-text) — it omits Enter. Use \`herdr pane run <pane> "<message>"\` or \`herdr notification show "<message>"\`. Confirm delivery by reading the target pane afterward; never report "relayed" without read-back.
+When relaying missions between agents, never use bare send-text (\`herdr agent send\` / pane send-text) — it omits Enter. Use \`herdr pane run <pane> "<message>"\` or \`herdr notification show "<message>"\`. Confirm delivery by reading the TARGET composer afterward; if the sent text still sits unsubmitted after ~15 s, send-keys enter to that pane once and read again (OBS-975); never report "relayed" without read-back.
 
 ### Orient before you act — this block may be the ONLY guidance your host loaded
 

package/dist/cli/commands/run.d.ts

@@ -4,6 +4,11 @@ import { type JournalEvent } from "../../run/journal.js";
  *  it is a phase counter, while a phase-start CARRYING a gate is the gate start the rail draws. */
 export declare const TTY_NOISE_EVENTS: readonly ["worker-contact", "worker-status"];
 type RailTone = "pass" | "fail" | "attention" | "active" | "neutral";
+/** Approval-close lifecycle labels extend the established closed rail vocabulary. */
+export declare const APPROVAL_RAIL_ROWS: Record<string, {
+    label: string;
+    tone: RailTone;
+}>;
 /** Closed retained set: the short operator label and the row's default tone. Labels are the rail's
  *  own vocabulary — a raw journal event name is what this surface exists to stop printing. A `pass`
  *  or `ok` datum on the event overrides the default tone, so one gate row can read either way.

package/dist/cli/commands/run.js

@@ -33,6 +33,12 @@ const RAIL_TONES = {
     active: { glyph: GLYPHS.pointer, paint: LIVE.running },
     neutral: { glyph: GLYPHS.neutral, paint: LIVE.chrome },
 };
+/** Approval-close lifecycle labels extend the established closed rail vocabulary. */
+export const APPROVAL_RAIL_ROWS = {
+    "approval-window-start": { label: "approval window", tone: "attention" },
+    "approval-window-expired": { label: "approval window expired", tone: "attention" },
+    "tip-verify-cancelled": { label: "tip verify cancelled", tone: "attention" },
+};
 /** Closed retained set: the short operator label and the row's default tone. Labels are the rail's
  *  own vocabulary — a raw journal event name is what this surface exists to stop printing. A `pass`
  *  or `ok` datum on the event overrides the default tone, so one gate row can read either way.
@@ -116,6 +122,8 @@ export const RAIL_ROWS = {
     // gate starts and verdicts
     "phase-start": { label: "gate start", tone: "active" },
     "gate-result": { label: "gate", tone: "pass" },
+    "baseline-wait": { label: "baseline wait", tone: "active" },
+    "suite-budget": { label: "suite budget", tone: "attention" },
     "gate-reused": { label: "gate reused", tone: "neutral" },
     "judge-retry": { label: "judge retry", tone: "attention" },
     "review-no-verdict": { label: "review unavailable", tone: "attention" },
@@ -307,6 +315,11 @@ const RAIL_PROJECTION = {
         ? `gated ${d.gatedCommit.slice(0, 12)}, tip ${d.branchTip.slice(0, 12)}`
         : undefined,
     "trust-auto-answer": (d) => typeof d.adapter === "string" ? `${d.adapter}${typeof d.phase === "string" ? ` ${d.phase}` : ""}` : undefined,
+    // SB-1: the census the ceiling released beside, and the budget the round ran under versus the one it
+    // would have had on an empty census — none of `{count, occupancyCap, conservativeCap}` is on the ladder
+    "suite-budget": (d) => typeof d.count === "number" && typeof d.conservativeCap === "number" && typeof d.occupancyCap === "number"
+        ? `beside ${d.count}, cap ${d.conservativeCap} not ${d.occupancyCap}`
+        : undefined,
 };
 // The row's text: the formatter's detail first, then the salient fields that detail could not carry.
 // Appending (never prefixing) keeps the operator's prose at the front of the row, so the clip a
@@ -333,7 +346,7 @@ const clipCells = (text, cells) => cells <= 0 ? "" : cellWidth(text) <= cells ?
 export function narrationRow(event, runId, columns = process.stdout.columns ?? 80) {
     if (TTY_NOISE_EVENTS.includes(event.event))
         return null;
-    const row = RAIL_ROWS[event.event];
+    const row = APPROVAL_RAIL_ROWS[event.event] ?? RAIL_ROWS[event.event];
     if (!row)
         return null;
     if (event.event === "phase-start" && typeof event.data.gate !== "string")

package/dist/compile/native.js

@@ -847,6 +847,9 @@ acceptance is required on every task (a nested list of observable outcomes).
       hard value anywhere in the domain, the criterion asserts a universal that may be FALSE ABOUT THE
       WORLD — bound it or say where it stops holding, rather than demanding a value that does not exist.
 
+    - A millisecond ceiling in a test is a BUDGET for the SLOWEST RUNNER.
+      Any ceiling under one second must carry a SLOWEST-RUNNER note and a member that OVERRUNS it.
+
   PICK THE CRITERION FORM FROM WHO COULD BE WRONG:
     - When the WORKER could be wrong because it can choose the value, use "test:" and pin the exact
       literal it could otherwise choose; an example selected by its implementer proves only itself.

package/dist/config/config.d.ts

@@ -240,6 +240,7 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
     gates: z.ZodObject<{
         build: z.ZodOptional<z.ZodString>;
         test: z.ZodOptional<z.ZodString>;
+        tipTest: z.ZodOptional<z.ZodString>;
         lint: z.ZodOptional<z.ZodString>;
         diffCap: z.ZodOptional<z.ZodNumber>;
         byShape: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodEnum<{
@@ -339,6 +340,11 @@ export type InitConfigOverlay = {
         llm?: TickmarkrConfig["visibility"]["llm"];
     };
 };
+/**
+ * Default config overlay template.
+ * Seam: gates.test defines the per-task gate and baseline test command;
+ * gates.tipTest optionally defines the integration tip verify test command (defaults to gates.test).
+ */
 export declare function configTemplate(overlay?: InitConfigOverlay): string;
 export { FLEET_OVERLAY_KEYS, fleetEditableEquals, fleetRepoOverlayFromDelta, renderFleetOverlayWrite, repoOverlayYaml, serializeFleetOverlay, unifiedYamlDiff, } from "./fleet-overlay.js";
 export type { FleetOverlayWrite } from "./fleet-overlay.js";

package/dist/config/config.js

@@ -337,6 +337,7 @@ export const TickmarkrConfigSchema = z.object({
     gates: z.object({
         build: z.string(),
         test: z.string(),
+        tipTest: z.string(),
         lint: z.string(),
         diffCap: z.number().int().positive(),
         byShape: z.partialRecord(z.enum(SHAPES), ShapeGateParticipationSchema).optional(),
@@ -756,6 +757,11 @@ export function overlayBytesLoadError(repoRoot, bytes, opts = {}) {
         return e.message;
     }
 }
+/**
+ * Default config overlay template.
+ * Seam: gates.test defines the per-task gate and baseline test command;
+ * gates.tipTest optionally defines the integration tip verify test command (defaults to gates.test).
+ */
 export function configTemplate(overlay) {
     const base = `# tickmarkr config overlay — merges over built-in defaults (repo beats global beats defaults)
 # concurrency: 3

package/dist/drivers/subprocess.d.ts

@@ -3,9 +3,8 @@ export declare const MAX_BUF: number;
 export declare const HERDR_CONTROL_VARS: readonly ["HERDR_ENV", "HERDR_SOCKET_PATH", "ORCA_TERMINAL_HANDLE", "ORCA_PANE_KEY", "ORCA_TAB_ID"];
 /**
  * Copy of worker env with the fork cap applied and host control-plane vars stripped.
- * The cap is the one the enclosing run resolved (resolvedForkCap) — a worker's suites divide the
- * same machine the gate shells do, so both seams have to read the same run-owned number rather
- * than a flat constant. The operator's own export still wins.
+ * Workers retain the run's concurrency-derived cap (resolvedForkCap), independently of
+ * verification's suite-window budget. The operator's own export still wins.
  */
 export declare function sealHerdrEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /** Pane/login-shell form of the same host-neutral worker env seal (herdr seed + daemon setup). */

package/dist/drivers/subprocess.js

@@ -22,9 +22,8 @@ export const HERDR_CONTROL_VARS = [
 ];
 /**
  * Copy of worker env with the fork cap applied and host control-plane vars stripped.
- * The cap is the one the enclosing run resolved (resolvedForkCap) — a worker's suites divide the
- * same machine the gate shells do, so both seams have to read the same run-owned number rather
- * than a flat constant. The operator's own export still wins.
+ * Workers retain the run's concurrency-derived cap (resolvedForkCap), independently of
+ * verification's suite-window budget. The operator's own export still wins.
  */
 export function sealHerdrEnv(env = process.env) {
     const out = { ...env };

package/dist/gates/baseline.d.ts

@@ -31,6 +31,8 @@ export interface BaselineCommand {
     durationMs?: number;
     /** Sum of the per-file durations named by the runner; null when its output names none. */
     fileDurationSumMs?: number | null;
+    /** Total files reported by the runner summary; null when unavailable. */
+    fileCount?: number | null;
     /** fileDurationSumMs / durationMs — average implied file concurrency, not a configured fork count. */
     impliedParallelism?: number | null;
     /** The slowest per-file entry named by the runner; null when per-file timing is unavailable. */
@@ -158,6 +160,7 @@ export declare function detectVacuousOracles(cwd: string, tasks: ReadonlyArray<{
 }>): Promise<VacuousOracleWarning[]>;
 export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[], opts?: {
     rerunOf?: HostStarvedRerun;
+    infraRerun?: HostStarvedRerun;
 }): Promise<GateResult[]>;
 export interface HostStarvedRerun {
     durationMs: number;
@@ -178,4 +181,10 @@ interface CalmWindow {
 }
 export declare function setCalmWindowForTests(over: Partial<CalmWindow>): void;
 export declare function resetCalmWindowForTests(): void;
+export declare function waitForCalmWindow(): Promise<number>;
+/** Summary totals survive digit-normalized fingerprints and exclude test-owned echoed output. */
+export declare function runnerFileCount(raw: string): number | null;
+export declare function fileCountDeficit(entry: BaselineCommand | undefined, raw: string): string | undefined;
+/** Both readers classify fresh evidence first, retaining the whole-output guard against infra forgiveness. */
+export declare function classifyFreshRunnerOutput(entry: BaselineCommand | undefined, raw: string, code: number): FailureClassification | undefined;
 export {};

package/dist/gates/baseline.js

@@ -30,7 +30,7 @@ const FAIL_ANCHOR_RE = /^\s*(?:FAIL\s+|[^\w]*(?:Unhandled Errors|Uncaught Except
 // to render. Digits are written (?:\d+|#) so a shape matches both raw and digit-normalized lines.
 // Run summaries: " Tests  N failed | M passed (T)" (vitest), "# fail N" (TAP / node:test),
 // "ℹ fail N" (node:test's spec reporter) and "test result: FAILED. …" (cargo / libtest).
-const SUMMARY_FAIL_RE = /^\s*(?:Tests?\s+(?:Files?\s+)?(?:\d+|#)\s+failed|#\s+fail\s+(?!0\b)(?:\d+|#)\b|ℹ\s+fail\s+(?!0\b)(?:\d+|#)\b|test result:\s+FAILED\b)/;
+const SUMMARY_FAIL_RE = /^\s*(?:Tests?\s+(?:Files?\s+)?(?!0\b)(?:\d+|#)\s+failed|#\s+fail\s+(?!0\b)(?:\d+|#)\b|ℹ\s+fail\s+(?!0\b)(?:\d+|#)\b|test result:\s+FAILED\b)/;
 const ERROR_ANCHOR_RE = /^\s*(?:Error|[A-Za-z_$][\w$]*Error):\s+\S/;
 const TSC_ERROR_RE = /^\s*\S.*\((?:\d+|#),(?:\d+|#)\):\s+error\s+[A-Z]+(?:\d+|#):/i; // tsc
 const LINTER_ERROR_RE = /^\s*(?:\d+|#):(?:\d+|#)\s+error\s+\S/; // eslint stylish
@@ -103,9 +103,8 @@ const stripTurboPrefix = (l) => {
 // Lines that NAME a failing test — the ones worth headlining to the operator. One list, so recognition
 // and reporting cannot drift apart (a shape that blocks but never gets named cost 3 attempts once).
 const namesFailure = (l) => FAIL_ANCHOR_RE.test(l) || RUNNER_FAIL_RE.test(l) || TRAILING_FAIL_RE.test(l) || GLYPH_FAIL_RE.test(l) || TURBO_FAIL_RE.test(l);
-// The stripped form is a second READ of the same line, for the recognition/headline paths that ask
-// "does anything here name a failure" — verdict classification (isInfraLine/namesRegression) keeps
-// reading the raw line only, so infra/regression verdicts are byte-unchanged by the prefix pass.
+// The stripped form lets recognition and headlines read the runner beneath a turbo prefix.
+// Classification applies the same prefix stripping before its infra/regression vetoes.
 const namesFailureEitherForm = (l) => {
     if (namesFailure(l))
         return true;
@@ -163,9 +162,13 @@ export function classifyFailureOutput(output) {
     // token inside a test's echoed stdout/stderr block must be as invisible to this classifier as it is
     // to fingerprint(): test-owned output is never runner evidence about the work.
     const lines = withoutVitestEchoBlocks(output).map((l) => l.replace(ANSI_RE, "")).filter((l) => !PASS_LINE_RE.test(l) && !OPERATOR_LINE_RE.test(l));
-    if (lines.some(namesRegression))
+    const evidence = lines.map((line) => stripTurboPrefix(line) ?? line).filter((line) => !PASS_LINE_RE.test(line) && !OPERATOR_LINE_RE.test(line));
+    const infra = evidence.some(isInfraLine);
+    // A diagnostic section heading names no failing test. It cannot outvote the RPC death
+    // beneath it, but an actual FAIL/AssertionError anywhere still takes precedence.
+    if (evidence.some((line) => !(infra && UNHANDLED_HEADER_RE.test(line)) && namesRegression(line)))
         return "regression";
-    return lines.some(isInfraLine) ? "infra" : undefined;
+    return infra ? "infra" : undefined;
 }
 /**
  * Capture validity asks a different question from gate classification. At a gate, one genuine
@@ -338,6 +341,8 @@ export function detectGateCommands(repoRoot, cfg) {
         else if (scripts[name])
             out[name] = `${runPrefix} ${name}`;
     }
+    if (cfg.gates.tipTest)
+        out.tipTest = cfg.gates.tipTest;
     return out;
 }
 /**
@@ -452,6 +457,7 @@ const invalidCaptureEntry = (durationMs, invalidCause, invalidatingLines = []) =
     fingerprints: [],
     durationMs,
     fileDurationSumMs: null,
+    fileCount: null,
     impliedParallelism: null,
     longestFile: null,
     ceilingMs: effectiveCeilingMs({ durationMs }),
@@ -460,11 +466,16 @@ const invalidCaptureEntry = (durationMs, invalidCause, invalidatingLines = []) =
 export async function captureBaseline(cwd, commands) {
     const base = { commands: {} };
     for (const [name, cmd] of Object.entries(commands)) {
+        if (name === "tipTest" && commands.test !== undefined && cmd === commands.test) {
+            continue;
+        }
         const r = await sh(cmd, cwd, CAPTURE_CEILING_MS);
         // ponytail: strip the executing cwd so repo-root capture and worktree compare fingerprint identically; /private-vs-/tmp symlink variance is out of scope
         // ponytail: a capture that was itself killed records the ceiling as its "measurement", which
         // scales the next ceiling up — the right direction for a suite that never finished once.
         const durationMs = r.durationMs ?? 0;
+        const combinedOutput = r.stdout + "\n" + r.stderr;
+        const raw = combinedOutput.split(cwd).join("");
         // OBS-534 (T2): a capture SIGKILLed at its ceiling never returned a verdict, so `r.code` is the
         // kill and not evidence about the command. Run 1501 recorded `test: {durationMs: 600007,
         // exitCode: 1}` for exactly this — a kill written down as a red baseline. There the accident
@@ -483,11 +494,9 @@ export async function captureBaseline(cwd, commands) {
             console.error(`tickmarkr: baseline capture for "${name}" was killed at its ${CAPTURE_CEILING_MS}ms ceiling — `
                 + `it recorded NO fingerprints, so nothing is forgiven and every gate will treat a pre-existing `
                 + `failure as a fresh one. Raise the ceiling or shorten the command.`);
-            base.commands[name] = invalidCaptureEntry(durationMs, "ceiling-kill");
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "ceiling-kill"), fileCount: runnerFileCount(raw) };
             continue;
         }
-        const combinedOutput = r.stdout + "\n" + r.stderr;
-        const raw = combinedOutput.split(cwd).join("");
         // Run 2137: the child exited and printed ordinary FAIL/AssertionError lines, so the gate-side
         // discriminator correctly called the mixed output a regression. But the same output also said
         // `spawn EAGAIN`: the machine had run out of processes while the pristine-tree measurement was
@@ -499,15 +508,15 @@ export async function captureBaseline(cwd, commands) {
                 + `it recorded NO exit-code verdict and NO fingerprints, so nothing is forgiven for this command; `
                 + `the measurement cannot distinguish a pre-existing failure from one caused by exhaustion. `
                 + `First invalidating line: ${invalidatingLines[0]}`);
-            base.commands[name] = invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines);
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines), fileCount: runnerFileCount(raw) };
             continue;
         }
-        // OBS-885/887: capture and gate ask the same classifier. A green summary followed only by the
-        // teardown fingerprint is a pass; infrastructure without a summary is no verdict to forgive.
+        // OBS-966: a worker RPC timeout is infra even beside an all-green summary.
+        // Capture and both gate readers share this discriminator; genuine test failures still dominate.
         const runnerVerdict = classifyRunnerOutput(raw, r.code);
         if (runnerVerdict === "infra") {
-            console.error(`tickmarkr: baseline capture for "${name}" carries runner-infrastructure evidence and no green summary — it recorded NO verdict; nothing is forgiven for this command`);
-            base.commands[name] = invalidCaptureEntry(durationMs, "infra");
+            console.error(`tickmarkr: baseline capture for "${name}" carries runner-infrastructure evidence — it recorded NO verdict; nothing is forgiven for this command`);
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "infra", withoutVitestEchoBlocks(combinedOutput).filter((line) => isInfraLine(line.replace(ANSI_RE, "")))), fileCount: runnerFileCount(raw) };
             continue;
         }
         base.commands[name] = {
@@ -519,13 +528,14 @@ export async function captureBaseline(cwd, commands) {
             missingCommand: missingConfiguredCommand(cmd, r),
             durationMs,
             ...fileTiming(raw, durationMs),
+            fileCount: runnerFileCount(raw),
             ceilingMs: effectiveCeilingMs({ durationMs }),
             // T7: the world this measurement was taken in, so a later reader can ask whether its own world
             // is the same one. Recorded from THIS command's own shell result, never re-derived here.
             ...(r.capacity ? { capacity: r.capacity } : {}),
         };
     }
-    const names = Object.keys(commands);
+    const names = Object.keys(commands).filter((name) => !(name === "tipTest" && commands.test !== undefined && commands[name] === commands.test));
     const missing = names.filter((name) => base.commands[name]?.missingCommand === true);
     if (names.length > 0 && missing.length === names.length) {
         base.warnings = [{
@@ -609,10 +619,15 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             const withReapError = r.reapError ? { ...withReap, meta: { ...withReap.meta, reapError: r.reapError } } : withReap;
             const withRerun = rerunOf ? {
                 ...withReapError,
-                details: `host-starved rerun after waiting ${rerunOf.waitedMs}ms for a calm load window: ${withReapError.details}`,
+                details: `${g.meta?.classification === "infra" ? "infra; " : ""}host-starved rerun after waiting ${rerunOf.waitedMs}ms for a calm load window: ${withReapError.details.replace(/^infra; /, "")}`,
                 meta: { ...withReapError.meta, hostStarvedRerun: rerunOf },
             } : withReapError;
-            results.push(r.capacity ? { ...withRerun, capacity: r.capacity } : withRerun);
+            const final = opts.infraRerun ? {
+                ...withRerun,
+                details: `${g.meta?.classification === "infra" ? "infra; " : ""}runner-infra rerun after waiting ${opts.infraRerun.waitedMs}ms for a calm load window: ${withRerun.details.replace(/^infra; /, "")}`,
+                meta: { ...withRerun.meta, runnerInfraRerun: opts.infraRerun },
+            } : withRerun;
+            results.push(r.capacity ? { ...final, capacity: r.capacity } : final);
         };
         // …and whether the entry that would forgive this command was measured in the same world. A
         // baseline captured under a different fork cap forgives nothing: its fingerprints describe a
@@ -641,11 +656,16 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             });
             continue;
         }
+        const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
+        const deficit = fileCountDeficit(entry, raw);
+        if (deficit) {
+            record({ gate: name, pass: false, details: deficit, meta: { classification: "infra", infra: true } });
+            continue;
+        }
         if (r.code === 0) {
             record({ gate: name, pass: true, details: "exit 0" });
             continue;
         }
-        const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
         // OBS-885/887: the same classifier the capture applied names a completed green suite on both sides.
         const runnerVerdict = classifyRunnerOutput(raw, r.code);
         if (runnerVerdict === "green-teardown") {
@@ -665,12 +685,16 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // that known assertion outvote the fresh birpc line turns machine failure into a worker defect.
         // `classifyRunnerOutput` remains the single discriminator. When there is no fresh fingerprint,
         // retain the whole-output read so a repeated infra abort can never be baseline-forgiven as green.
-        const freshVerdict = failing.length ? classifyRunnerOutput(failing.join("\n"), r.code) : undefined;
-        const freshClassification = freshVerdict === "infra" || freshVerdict === "regression" ? freshVerdict : undefined;
-        const classification = freshClassification ?? (!failing.length && (runnerVerdict === "infra" || runnerVerdict === "regression") ? runnerVerdict : undefined);
+        const classification = classifyFreshRunnerOutput(entry, raw, r.code);
+        if (name === "test" && classification === "infra" && !rerunOf && !opts.infraRerun) {
+            const waitedMs = await waitForCalmWindow();
+            const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
+            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { infraRerun: provenance }));
+            continue;
+        }
         // OBS-896: every fresh failure must be timeout-class, and the suite must take at least twice its
         // own baseline measurement. The first read buys one calm rerun here, never a worker repair.
-        if (name === "test" && classification !== "infra" && failing.length && !rerunOf
+        if (name === "test" && classification !== "infra" && failing.length && !rerunOf && !opts.infraRerun
             && hostStarved(failing.join("\n"), r.durationMs ?? 0, entry?.durationMs)) {
             const waitedMs = await waitForCalmWindow();
             const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
@@ -684,7 +708,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             record({
                 gate: name,
                 pass: false,
-                details: `exit ${r.code}; the fresh failures carry infrastructure evidence alone — the runner never completed a suite, so this gate verified nothing:\n${evidence}`,
+                details: `infra; exit ${r.code}; the fresh failures carry infrastructure evidence alone — the runner never completed a suite, so this gate verified nothing:\n${evidence}`,
                 meta: { classification, infra: true },
             });
             continue;
@@ -695,9 +719,11 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // entries with no exitCode keep the `?? 1` red default both readers share (merge.ts:131).
         const baselineRed = entry?.infra !== true && (entry?.exitCode ?? 1) !== 0;
         if (!failing.length && !baselineRed) {
-            const recordedCause = entry?.invalidCause === "resource-exhaustion" || entry?.invalidatingLines?.length
-                ? `was invalidated by its recorded process/resource-exhaustion cause${entry.invalidatingLines?.[0] ? ` (${entry.invalidatingLines[0]})` : ""}`
-                : "was killed at its ceiling";
+            const recordedCause = entry?.invalidCause === "infra"
+                ? "was invalidated by its recorded runner-infrastructure cause"
+                : entry?.invalidCause === "resource-exhaustion" || entry?.invalidatingLines?.length
+                    ? `was invalidated by its recorded process/resource-exhaustion cause${entry.invalidatingLines?.[0] ? ` (${entry.invalidatingLines[0]})` : ""}`
+                    : "was killed at its ceiling";
             const closed = entry?.infra === true
                 ? `the baseline capture for this command ${recordedCause} and recorded no verdict, so nothing here is forgivable — it now exits ${r.code} with no recognizable failure lines — failing closed`
                 : `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`;
@@ -742,7 +768,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
     return results;
 }
 const SUMMARY_LINE_RE = /^[^\S\n]*Test Files[^\S\n]+(.+)$/m;
-const TEARDOWN_RE = /\[vitest-worker\]: Timeout calling\b|\[birpc\] rpc is closed, cannot call\b/;
+const TEARDOWN_RE = /\[birpc\] rpc is closed, cannot call\b/;
 const UNHANDLED_HEADER_RE = /^\s*[^\w]*(?:Unhandled Errors|Uncaught Exception)\b/;
 /** One interpretation of runner bytes, shared by baseline capture and every gate consumer. */
 export function classifyRunnerOutput(raw, code) {
@@ -750,6 +776,8 @@ export function classifyRunnerOutput(raw, code) {
         return undefined;
     const lines = withoutVitestEchoBlocks(raw).map((l) => l.replace(ANSI_RE, ""));
     const text = lines.join("\n");
+    if (lines.some((line) => /\[vitest-worker\]: Timeout calling\b/.test(line) && !PASS_LINE_RE.test(line) && !OPERATOR_LINE_RE.test(line)))
+        return classifyFailureOutput(text);
     const summary = SUMMARY_LINE_RE.exec(text);
     if (summary) {
         const failed = [...summary[1].matchAll(/\b(\d+)\s+failed\b/g)].map((match) => Number(match[1]));
@@ -780,14 +808,42 @@ export function hostStarved(fresh, durationMs, referenceMs) {
     const heads = fresh.split("\n").map((line) => line.replace(ANSI_RE, "")).filter((line) => ERROR_HEAD_RE.test(line));
     return heads.length > 0 && heads.every((line) => TIMEOUT_CLASS_RE.test(line));
 }
-const DEFAULT_CALM = { pollMs: 5_000, maxWaitMs: 600_000, loadProvider: () => loadavg()[0] ?? 0, calmLoad: () => availableParallelism() / 2 };
+const DEFAULT_CALM = {
+    pollMs: process.env.VITEST ? 10 : 5_000,
+    maxWaitMs: process.env.VITEST ? 50 : 600_000,
+    loadProvider: () => loadavg()[0] ?? 0,
+    calmLoad: () => availableParallelism() / 2,
+};
 let calm = DEFAULT_CALM;
 export function setCalmWindowForTests(over) { calm = { ...calm, ...over }; }
 export function resetCalmWindowForTests() { calm = DEFAULT_CALM; }
-async function waitForCalmWindow() {
+export async function waitForCalmWindow() {
     const started = Date.now();
     while (calm.loadProvider() > calm.calmLoad() && Date.now() - started < calm.maxWaitMs) {
         await new Promise((resolve) => setTimeout(resolve, calm.pollMs));
     }
     return Date.now() - started;
 }
+/** Summary totals survive digit-normalized fingerprints and exclude test-owned echoed output. */
+export function runnerFileCount(raw) {
+    const counts = withoutVitestEchoBlocks(raw).flatMap((line) => {
+        const clean = line.replace(ANSI_RE, "");
+        const match = /^\s*Test Files\s+.*\((\d+)\)\s*$/.exec(stripTurboPrefix(clean) ?? clean);
+        return match ? [Number(match[1])] : [];
+    });
+    return counts.length ? counts.reduce((sum, count) => sum + count, 0) : null;
+}
+export function fileCountDeficit(entry, raw) {
+    const actual = runnerFileCount(raw);
+    return entry?.fileCount != null && actual !== null && actual < entry.fileCount
+        ? `infra; runner reported ${actual} test files, below baseline ${entry.fileCount} — suite incomplete`
+        : undefined;
+}
+/** Both readers classify fresh evidence first, retaining the whole-output guard against infra forgiveness. */
+export function classifyFreshRunnerOutput(entry, raw, code) {
+    if (classifyRunnerOutput(raw, code) === "green-teardown")
+        return undefined;
+    const { failing } = freshFailures(entry, raw);
+    const verdict = classifyRunnerOutput(failing.length ? failing.join("\n") : raw, code);
+    return verdict === "infra" || verdict === "regression" ? verdict : undefined;
+}

package/dist/gates/llm.js

@@ -287,7 +287,7 @@ async function runHeadlessDetailed(adapter, model, prompt, cwd, timeoutMs = 3000
         const pf = join(dir, "prompt.md");
         writeFileSync(pf, prompt);
         const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
-        return { output: r.stdout + "\n" + r.stderr, exitCode: r.code, timedOut: r.timedOut === true, seatAuthoredBytes: Buffer.byteLength(r.stdout + r.stderr) };
+        return { output: r.stdout + "\n" + r.stderr, exitCode: r.code, timedOut: r.timedOut === true, seatAuthoredBytes: Buffer.byteLength((r.stdout + r.stderr).trim()) };
     }
     finally {
         rmSync(dir, { recursive: true, force: true });
@@ -427,7 +427,7 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
                 }
             }
             timedOut = Date.now() - startedAt >= timeoutMs && !new RegExp(exitPattern).test(out);
-            if (timedOut)
+            if (timedOut && reviewing)
                 forceClose = true;
         }
         const exitCode = Number(new RegExp(`TICKMARKR_EXIT_${nonce}:(\\d+)`).exec(out)?.[1]);

package/dist/gates/review.js

@@ -352,7 +352,12 @@ For every prior material, put its fingerprint in exactly one of resolved (verifi
 Approve iff no material finding remains and every prior material is resolved.
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
-    const artifactId = `${task.id}-${nonce}`;
+    // Filenames are journaled (daemon.ts lifts meta.rawPath/briefPath onto the gate-result row), so they
+    // must be reproducible from the same inputs — the verdict nonce is cryptographically random and would
+    // make two otherwise-identical runs diverge in their journal bytes. The reviewer channel already
+    // disambiguates every call that matters: a retry always excludes the flaked channel (run-gates.ts),
+    // so it can never collide with the attempt it replaces.
+    const artifactId = `${task.id}-${channelKey(reviewer).replace(/[^a-zA-Z0-9_.-]/g, "-")}`;
     const briefPath = artifactDir ? join(artifactDir, `review-brief-${artifactId}.md`) : undefined;
     // Persistence is evidence, not a gate input: a full disk or a removed run dir never fails the gate.
     let savedBrief;
@@ -378,6 +383,16 @@ The top-level comments array is optional. Use it only for actionable line-anchor
     // (run-20260709-104447 P87-09). The configured ceiling defaults to that measured 15 minutes.
     cfg.review.timeoutMs);
     const raw = llm.output;
+    let saved;
+    if (artifactDir) {
+        try {
+            saved = join(artifactDir, `review-raw-${artifactId}.txt`);
+            writeFileSync(saved, redactSecrets(raw));
+        }
+        catch {
+            saved = undefined; // persistence is evidence, not a gate input — never fail the gate on it
+        }
+    }
     const provider = modelProvider(reviewer.model, reviewer.vendor);
     const v = extractVerdictJson(raw, nonce);
     const findings = v && Array.isArray(v.findings) ? v.findings : null;
@@ -394,16 +409,6 @@ The top-level comments array is optional. Use it only for actionable line-anchor
         const cause = closureInvalid ? "malformed-verdict" : llm.launchNeverStarted ? "launch-never-started"
             : llm.timedOut ? (bytes > 0 ? "truncated" : "silent")
                 : classifyVerdictCause(raw, nonce, "approve", llm);
-        let saved;
-        if (artifactDir) {
-            try {
-                saved = join(artifactDir, `review-raw-${artifactId}.txt`);
-                writeFileSync(saved, redactSecrets(raw));
-            }
-            catch {
-                saved = undefined; // persistence is evidence, not a gate input — never fail the gate on it
-            }
-        }
         const failure = cause === "malformed-verdict"
             ? "review output unparseable"
             : "review dispatch failed — no structurally valid nonce-bound response";
@@ -455,6 +460,8 @@ The top-level comments array is optional. Use it only for actionable line-anchor
                     ...structuredFindings("review", details).filter((finding) => !reraised.some((prior) => prior.note === finding.note)),
                     ...reraised,
                 ] } : {}),
+            ...(saved ? { rawPath: saved } : {}),
+            ...(savedBrief ? { briefPath: savedBrief } : {}),
         },
     };
 }

package/dist/run/daemon.d.ts

@@ -14,6 +14,8 @@ export interface RunOptions {
     graphChanged?: boolean;
     retryFailed?: boolean;
     concurrency?: number;
+    /** Bounded wait at a drain caused solely by parked tasks. */
+    approvalWindowMs?: number;
     driver?: ExecutorDriver;
     driverOverride?: DriverChoice;
     adapters?: WorkerAdapter[];
@@ -55,9 +57,8 @@ export interface RunSummary {
  * T14, amended by v2.2 T3: approvals the run accepted and never acted on. `approved` above is still
  * built ONCE at startup — replay determinism depends on it — but a live approval is no longer inert:
  * the boundary sweep in the task loop releases what lands while the daemon runs, so an approval
- * written mid-run is normally enacted by this run. ONE window survives, and it is the reason this
- * fold still exists: an approval accepted after the task loop exits — during tip verify, before the
- * run-end sample below — meets no further boundary, so nothing can release it before this run ends.
+ * written mid-run is enacted at a boundary, during the approval window, or by cancelling tip verify.
+ * This fold still exposes decisions that could not enact, including a failure before dispatch.
  * Without this the run-end record stated only buckets and tipVerify, both accurate, over a milestone
  * that was silently incomplete: run …230 ended tipVerify "passed" with two upheld approvals and zero
  * subsequent dispatches. Scored per task on its NEWEST approval: a later approval is the live
@@ -108,6 +109,7 @@ export declare const SUITE_WAIT_CEILING_MS = 600000;
 export declare const setSuiteWaitCeilingForTests: (ms: number) => void;
 export declare const resetSuiteWaitCeilingForTests: () => void;
 export declare const APPROVAL_POLL_MS = 250;
+export declare const APPROVAL_WINDOW_MS = 1000;
 export declare const EARLY_LAUNCH_LIVENESS_MS = 60000;
 /** Test seam — lowers the empty-pane liveness window without sleeping 60s per case. */
 export declare function setEarlyLaunchLivenessMsForTests(ms: number): void;
@@ -151,6 +153,7 @@ export declare function commandsHash(commands: Record<string, string>): string;
 export declare function verifyIntegrationTipCached(intWt: string, commands: Record<string, string>, journal: Journal, opts?: {
     lastMergedTask?: string;
     baseline?: Baseline;
+    signal?: AbortSignal;
 }): Promise<boolean>;
 type SuitePidProbe = (pid: number) => number | undefined;
 /** Count full-suite roots in one process-table snapshot. The probes are arguments so the ownership