tickmarkr 2.5.2 → 2.5.4

package/dist/compile/ownership.js

@@ -1,7 +1,42 @@
-import { readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { basename, extname, join, posix } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import { collateralHits } from "./collateral.js";
+export const SHAPE_ORACLES = [
+    "tests/run/narration.test.ts",
+    "tests/cli/brand-surfaces.test.ts",
+    "tests/run/notify-identity.test.ts",
+    "tests/run/outcome-projections.test.ts",
+    "tests/cockpit/setup.test.ts",
+];
+export const SHAPE_ORACLE_SOURCES = [
+    "src/run/daemon.ts",
+    "src/cli/commands/run.ts",
+];
+export const SHAPE_ORACLE_MAP = {
+    "src/run/daemon.ts": SHAPE_ORACLES,
+    "src/cli/commands/run.ts": SHAPE_ORACLES,
+};
+// A files[] entry touches a mapped shape-oracle source when it names it literally or by stem, or when
+// the entry's glob — anchored or broad — matches the source AND the source exists in the repository
+// being compiled: "src/run/**" owning this repository's daemon owns the five oracles, while the
+// shipped sample PRD's "src/**" task in a repository holding no mapped source compiles clean.
+// Anchored globs like "src/run/daemon.*" target the source specifically and touch it regardless.
+function touchesSource(files, source, repoRoot) {
+    const stem = source.replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    return files.some((entry) => {
+        if (entry === source || entry === stem)
+            return true;
+        const special = entry.search(/[*?{[]/);
+        if (special === -1)
+            return false;
+        if (!filesGlob([entry])(source))
+            return false;
+        if (entry.slice(0, special) === `${stem}.`)
+            return true;
+        return repoRoot !== undefined && existsSync(join(repoRoot, source));
+    });
+}
 const normalize = (path) => path.replace(/^\.\//, "").split("\\").join("/");
 function testSources(repoRoot) {
     const root = join(repoRoot, "tests");
@@ -101,20 +136,24 @@ function mentionsCommandEntry(text) {
     return /(?:^|\/)src\/cli\/index\.(?:ts|js)\b/.test(text)
         || /["'`]src["'`]\s*,\s*["'`]cli["'`]\s*,\s*["'`]index\.(?:ts|js)["'`]/.test(text);
 }
-function corroboration(test, matches) {
-    // A .test.ts-shaped collateral fixture is not by itself a dedicated test. Requiring a runner leaf
-    // keeps import-only scan fixtures advisory while every executable subject in the measured union stays.
+function corroborateSource(test, sourcePath) {
     const executable = test.text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
     if (!/\b(?:test|it)(?:\.(?:concurrent|each|fails|only|skip|todo))*\s*\(/.test(executable))
         return undefined;
-    for (const match of matches) {
-        if (directlyImports(test, match.source))
-            return { kind: "direct-import", source: match.source };
-    }
+    if (directlyImports(test, sourcePath))
+        return { kind: "direct-import", source: sourcePath };
     if (invokesChildProcessSpawn(test.text) && mentionsCommandEntry(test.text)) {
-        const command = matches.find(({ source }) => /^src\/cli\/commands\/[^/]+\.(?:[cm]?[jt]sx?)$/.test(source));
-        if (command)
-            return { kind: "command-entry-spawn", source: command.source, entry: "src/cli/index.ts" };
+        if (/^src\/cli\/commands\/[^/]+\.(?:[cm]?[jt]sx?)$/.test(sourcePath)) {
+            return { kind: "command-entry-spawn", source: sourcePath, entry: "src/cli/index.ts" };
+        }
+    }
+    return undefined;
+}
+function corroboration(test, matches) {
+    for (const match of matches) {
+        const evidence = corroborateSource(test, match.source);
+        if (evidence)
+            return evidence;
     }
     return undefined;
 }
@@ -155,6 +194,7 @@ export function ownershipFindings(tasks, repoRoot) {
         const context = task.context.map(normalize);
         return {
             task,
+            files,
             owns: files.length === 0 ? () => false : filesGlob(files),
             allows: files.length === 0 ? () => true : filesGlob([...files, ...context]),
         };
@@ -204,6 +244,52 @@ export function ownershipFindings(tasks, repoRoot) {
             });
         }
     }
+    for (const entry of indexed) {
+        for (const [source, oracles] of Object.entries(SHAPE_ORACLE_MAP)) {
+            if (!touchesSource(entry.files, source, repoRoot))
+                continue;
+            for (const oracle of oracles) {
+                if (!entry.owns(oracle)) {
+                    findings.push({
+                        code: "unowned-shape-oracle",
+                        taskId: entry.task.id,
+                        source,
+                        oracle,
+                        detail: `${entry.task.id} touches ${source} without owning shape oracle ${oracle}`,
+                    });
+                }
+            }
+        }
+    }
+    for (const test of sources) {
+        const testOwners = owners(test.path);
+        if (testOwners.length === 0)
+            continue;
+        const testStem = basename(test.path).replace(/\.test\.ts$/, "");
+        for (const sourcePath of allSources) {
+            if (owners(sourcePath).length > 0)
+                continue;
+            const sourceStem = basename(sourcePath, extname(sourcePath));
+            if (testStem !== sourceStem && !testStem.startsWith(`${sourceStem}-`))
+                continue;
+            const evidence = corroborateSource(test, sourcePath);
+            if (!evidence)
+                continue;
+            for (const owner of testOwners) {
+                findings.push({
+                    code: "unowned-source-of-owned-test",
+                    taskId: owner.task.id,
+                    test: test.path,
+                    source: sourcePath,
+                    corroboration: evidence,
+                    detail: `${test.path} owned by ${owner.task.id} is a dedicated test of ${sourcePath} but no task owns ${sourcePath}`
+                        + (evidence.kind === "direct-import" ? `; it imports ${evidence.source} directly`
+                            : evidence.kind === "command-entry-spawn"
+                                ? `; it spawns ${evidence.entry} to exercise ${evidence.source}` : ""),
+                });
+            }
+        }
+    }
     for (const source of sources) {
         for (const owner of owners(source.path)) {
             for (const path of repositoryPaths(source.text)) {
@@ -234,11 +320,25 @@ export function ownershipFindings(tasks, repoRoot) {
             }
         }
     }
-    return findings.sort((a, b) => `${a.code}:${"test" in a ? a.test : a.path}:${"taskId" in a ? a.taskId : ""}`.localeCompare(`${b.code}:${"test" in b ? b.test : b.path}:${"taskId" in b ? b.taskId : ""}`));
+    const target = (f) => {
+        switch (f.code) {
+            case "unowned-test": return f.test;
+            case "unowned-shape-oracle": return f.oracle;
+            case "test-path-outside-allowlist": return f.test;
+            case "unordered-context-write": return f.path;
+            case "unowned-source-of-owned-test": return f.test;
+        }
+    };
+    return findings.sort((a, b) => {
+        const taskA = "taskId" in a ? a.taskId : "";
+        const taskB = "taskId" in b ? b.taskId : "";
+        return `${a.code}:${target(a)}:${taskA}`.localeCompare(`${b.code}:${target(b)}:${taskB}`);
+    });
 }
 export function renderOwnershipFinding(finding) {
     return `tickmarkr: ownership-lint[${finding.code}]: ${finding.detail}`;
 }
 export function blocksCompile(finding) {
-    return finding.code === "unowned-test" && finding.corroboration !== undefined;
+    return (finding.code === "unowned-test" && finding.corroboration !== undefined)
+        || finding.code === "unowned-shape-oracle";
 }

package/dist/config/config.d.ts

@@ -175,6 +175,10 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
             on: "on";
             off: "off";
         }>;
+        escalateTier: z.ZodDefault<z.ZodEnum<{
+            on: "on";
+            off: "off";
+        }>>;
         learnedTuning: z.ZodOptional<z.ZodObject<{
             halfLifeRuns: z.ZodOptional<z.ZodNumber>;
             availWeight: z.ZodOptional<z.ZodNumber>;
@@ -275,6 +279,11 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
             "judge-only": "judge-only";
         }>>;
         criticalPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        floor: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"worker">, z.ZodEnum<{
+            cheap: "cheap";
+            mid: "mid";
+            frontier: "frontier";
+        }>]>>;
     }, z.core.$strip>;
     consult: z.ZodObject<{
         adapter: z.ZodString;

package/dist/config/config.js

@@ -302,6 +302,8 @@ export const TickmarkrConfigSchema = z.object({
         }),
         floors: z.record(z.string(), TierEnum),
         learned: z.enum(["on", "off"]), // v1.6 ROUTE-09 kill switch; a typo (offf) fails loud via safeParse
+        // OBS-986 (ES-1): climb one tier on request when untried channels exist in higher tiers.
+        escalateTier: z.enum(["on", "off"]).default("on"),
         // v1.9 ROUTE-15 — optional overrides for profile.ts HALF_LIFE_RUNS/AVAIL_WEIGHT; absent ⇒ byte-identical defaults.
         // SIBLING of learned (not nested): routing.learned is the on/off enum switch.
         learnedTuning: z.object({
@@ -366,6 +368,11 @@ export const TickmarkrConfigSchema = z.object({
         // R3: globs no task may skip review on (input/demux/lifecycle, gates/run/drivers/adapters, anything
         // reaching a shell). A judge-only task intersecting one of these fails COMPILE, never silently skips.
         criticalPaths: z.array(z.string()).optional(),
+        // RF-1 (OBS-922 add.2/3): review.floor — `worker` (default) names no tier and leaves the seat
+        // ranking to the author's routed seat; a tier is folded in as max(task floor, this) by reviewGate
+        // and its retry — it can raise a seat and never lower one. Not in the template: the cockpit
+        // fixture pins the fresh-install bytes (see d0e89a9a).
+        floor: z.union([z.literal("worker"), TierEnum]).default("worker"),
     }),
     // v1.54 T1: prefer — ranked consult seat failover. Entries MUST be adapter:model (unlike
     // review.prefer's adapter|adapter:model grammar): a consult seat has no channel to inherit a
@@ -445,6 +452,7 @@ export const DEFAULT_CONFIG = {
         // a workspace that has accumulated ≥MIN_SAMPLES warm telemetry per cell. Preview any workspace's effect
         // first with `tickmarkr plan` / `tickmarkr report`; flip to "off" to pin exact static routing (the kill switch stands).
         learned: "on",
+        escalateTier: "on",
         allowUnverifiedModels: false,
     },
     // Seed table (spec §13). New models = edit this (or your config.yaml), never code.
@@ -590,7 +598,7 @@ export const DEFAULT_CONFIG = {
     judge: { adapter: "claude-code", model: "fable" },
     // R3: no `policy` floor — the neutral floor leaves the compiler's per-task assignment standing, so
     // the path-keyed rule is reachable out of the box rather than raised to full by construction.
-    review: { complexityThreshold: 7, timeoutMs: 900_000, required: true, criticalPaths: [...DEFAULT_REVIEW_CRITICAL_PATHS] },
+    review: { complexityThreshold: 7, timeoutMs: 900_000, required: true, floor: "worker", criticalPaths: [...DEFAULT_REVIEW_CRITICAL_PATHS] },
     consult: { adapter: "claude-code", model: "fable", stallMinutes: 15 },
     // v1.4: gate LLM calls (judge/review/consult) run headless by default; pane opts back into visible agents.
     // v1.2: workers are the real agent TUI in the pane; "print" restores the -p-rendered-in-pane path.
@@ -784,6 +792,7 @@ export function configTemplate(overlay) {
 #   floors:               # tier authority — advisory minimum bands; 'tickmarkr plan' lints violations
 #     migration: frontier
 #   learned: on            # default ON (ROUTE-14); cold profile = exact v1.5 static routing, warms per workspace. Set 'off' to pin static routing; preview with 'tickmarkr plan'
+#   escalateTier: on       # on | off (default on): climb one tier on request when untried channels exist in higher tiers
 #   learnedTuning: { halfLifeRuns: 5, availWeight: 0.05 }  # optional; defaults byte-identical
 #   explore: { mode: on, excludeShapes: [], excludeComplexityAtOrAbove: null, cap: 5 }  # optional; absent ⇒ byte-identical
 #   sla: { implement: 15 }  # optional per-shape minutes — advisory plan lint only; absent ⇒ no lint
@@ -817,7 +826,9 @@ export function configTemplate(overlay) {
 #   test: npm test
 #   byShape:
 #     docs: { acceptance: false, review: false }  # baseline, evidence, and scope are mandatory
-# review: { complexityThreshold: 7, timeoutMs: 900000, required: true, prefer: [codex:gpt-5.6-sol, kimi] }
+# review: { complexityThreshold: 7, timeoutMs: 900000, required: true, floor: worker, prefer: [codex:gpt-5.6-sol, kimi] }
+#                         # floor: worker (default) | cheap | mid | frontier — the reviewer seats at or above
+#                         # max(author tier, task floor, this tier, prior reviewer); a tier here only raises it
 #                         # prefer: ordered reviewer seat preference (adapter | adapter:model); ranks
 #                         # diversity-eligible channels only — never admits a same-vendor/same-model reviewer
 # consult: { adapter: claude-code, model: fable, stallMinutes: 15, prefer: [codex:gpt-5.6-sol, kimi:kimi-code/k3] }

package/dist/drivers/herdr.d.ts

@@ -128,6 +128,11 @@ export declare class HerdrDriver implements ExecutorDriver {
     close(slot: Slot): Promise<void>;
     private closeGrouped;
     private watchPanes;
+    /** WB-1 (OBS-988): the daemon proved this run's own board lost. Forget the cached slot FIRST — even a
+     *  retire that fails must never let the narrator answer with the ghost again — then take the pane
+     *  back on ownership alone: the dead UI can never acknowledge, so the stop request is left for a
+     *  merely stuck one to find. Serialized with the narrator so no split races the close. */
+    retireLostWatch(slot: Slot): Promise<void>;
     /** Name collisions never confer repository ownership. Unknown boards stay protected. */
     private retireWatch;
     focus(target: FocusTarget): Promise<FocusResult>;

package/dist/drivers/herdr.js

@@ -6,7 +6,7 @@ import { declaredInputBoxForWorkerName, matchesEmptyInputBox, matchesInputBox, m
 import { consumePaneLaunchIntent, PANE_IDENTITY_ENV, paneIdentityLine } from "../brand.js";
 import { createWorktree, sh } from "../run/git.js";
 import { Journal } from "../run/journal.js";
-import { readSupervision, readWatchBoard, reserveWatchBoard, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
+import { readSupervision, readWatchBoard, requestWatchBoardStop, reserveWatchBoard, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
 import { herdrSealShellPrefix } from "./subprocess.js";
 import { canonicalizeLegacyName, formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 // VIS-09 P43-03: adopted safety floor from 43-MEASUREMENT.md (narrowest safe 53 → floor 108).
@@ -1169,8 +1169,16 @@ export class HerdrDriver {
             throw new Error("herdr pane list returned no panes");
         return panes.filter(p => p.workspace_id === this.ws && p.label === name);
     }
+    /** WB-1 (OBS-988): the daemon proved this run's own board lost. Forget the cached slot FIRST — even a
+     *  retire that fails must never let the narrator answer with the ghost again — then take the pane
+     *  back on ownership alone: the dead UI can never acknowledge, so the stop request is left for a
+     *  merely stuck one to find. Serialized with the narrator so no split races the close. */
+    async retireLostWatch(slot) {
+        this.watches.delete(slot.name);
+        await this.serial(() => this.retireWatch(slot, true));
+    }
     /** Name collisions never confer repository ownership. Unknown boards stay protected. */
-    async retireWatch(slot) {
+    async retireWatch(slot, lost = false) {
         const runId = parseOwnedName(slot.name)?.runId;
         const owner = runId ? readWatchBoard(slot.cwd, runId) : undefined;
         const matches = await this.watchPanes(slot.name);
@@ -1181,7 +1189,10 @@ export class HerdrDriver {
             owner.pane !== slot.id || matches.length !== 1 || matches[0]?.pane_id !== owner.pane) {
             throw new Error(`watch ownership unknown or foreign for ${slot.name}; existing board protected`);
         }
-        await stopWatchBoard(owner, this.time);
+        if (lost)
+            requestWatchBoardStop(owner); // a lost owner never answers; only a live one still gets the ack window
+        else
+            await stopWatchBoard(owner, this.time);
         const verified = await this.watchPanes(slot.name);
         if (verified.length !== 1 || verified[0]?.pane_id !== owner.pane)
             throw new Error("watch target changed after acknowledgement; pane protected");

package/dist/drivers/types.d.ts

@@ -106,6 +106,7 @@ export interface ExecutorDriver {
     narrateWith?(narrate: (event: JournalEvent) => void): void;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;
     narrator?: (cwd: string, command: string, runId?: string) => Promise<Slot>;
+    retireLostWatch?: (slot: Slot) => Promise<void>;
     /** Best-effort projection of a task's lifecycle onto the execution host. */
     project?: (taskId: string, state: "in-progress" | "in-review" | "completed") => Promise<void>;
     reconcile?: (desired: Set<string>, runId: string, opts?: PanesToCloseOpts) => Promise<void>;

package/dist/gates/baseline.d.ts

@@ -161,6 +161,7 @@ export declare function detectVacuousOracles(cwd: string, tasks: ReadonlyArray<{
 export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[], opts?: {
     rerunOf?: HostStarvedRerun;
     infraRerun?: HostStarvedRerun;
+    selected?: readonly string[];
 }): Promise<GateResult[]>;
 export interface HostStarvedRerun {
     durationMs: number;
@@ -184,7 +185,10 @@ export declare function resetCalmWindowForTests(): void;
 export declare function waitForCalmWindow(): Promise<number>;
 /** Summary totals survive digit-normalized fingerprints and exclude test-owned echoed output. */
 export declare function runnerFileCount(raw: string): number | null;
-export declare function fileCountDeficit(entry: BaselineCommand | undefined, raw: string): string | undefined;
+export declare function fileCountDeficit(entry: BaselineCommand | undefined, raw: string, opts?: {
+    name?: string;
+    selected?: readonly string[];
+}): string | undefined;
 /** Both readers classify fresh evidence first, retaining the whole-output guard against infra forgiveness. */
 export declare function classifyFreshRunnerOutput(entry: BaselineCommand | undefined, raw: string, code: number): FailureClassification | undefined;
 export {};

package/dist/gates/baseline.js

@@ -627,7 +627,16 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
                 details: `${g.meta?.classification === "infra" ? "infra; " : ""}runner-infra rerun after waiting ${opts.infraRerun.waitedMs}ms for a calm load window: ${withRerun.details.replace(/^infra; /, "")}`,
                 meta: { ...withRerun.meta, runnerInfraRerun: opts.infraRerun },
             } : withRerun;
-            results.push(r.capacity ? { ...final, capacity: r.capacity } : final);
+            const withSelected = name === "test" && opts.selected
+                ? {
+                    ...final,
+                    meta: {
+                        ...final.meta,
+                        ...(Array.isArray(opts.selected) ? { selectedTests: [...opts.selected] } : {}),
+                    },
+                }
+                : final;
+            results.push(r.capacity ? { ...withSelected, capacity: r.capacity } : withSelected);
         };
         // …and whether the entry that would forgive this command was measured in the same world. A
         // baseline captured under a different fork cap forgives nothing: its fingerprints describe a
@@ -657,7 +666,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             continue;
         }
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
-        const deficit = fileCountDeficit(entry, raw);
+        const deficit = fileCountDeficit(entry, raw, { name, selected: opts.selected });
         if (deficit) {
             record({ gate: name, pass: false, details: deficit, meta: { classification: "infra", infra: true } });
             continue;
@@ -689,7 +698,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         if (name === "test" && classification === "infra" && !rerunOf && !opts.infraRerun) {
             const waitedMs = await waitForCalmWindow();
             const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
-            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { infraRerun: provenance }));
+            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { ...opts, infraRerun: provenance }));
             continue;
         }
         // OBS-896: every fresh failure must be timeout-class, and the suite must take at least twice its
@@ -698,7 +707,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             && hostStarved(failing.join("\n"), r.durationMs ?? 0, entry?.durationMs)) {
             const waitedMs = await waitForCalmWindow();
             const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
-            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { rerunOf: provenance }));
+            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { ...opts, rerunOf: provenance }));
             continue;
         }
         if (classification === "infra") {
@@ -833,7 +842,11 @@ export function runnerFileCount(raw) {
     });
     return counts.length ? counts.reduce((sum, count) => sum + count, 0) : null;
 }
-export function fileCountDeficit(entry, raw) {
+export function fileCountDeficit(entry, raw, opts) {
+    // OBS-985: only a real, named selected-test run of the TEST gate is exempt — a truthy flag or an
+    // empty list named no selection and let a full-suite call opt itself out of the deficit guard.
+    if (opts?.name === "test" && opts.selected !== undefined && opts.selected.length > 0)
+        return undefined;
     const actual = runnerFileCount(raw);
     return entry?.fileCount != null && actual !== null && actual < entry.fileCount
         ? `infra; runner reported ${actual} test files, below baseline ${entry.fileCount} — suite incomplete`

package/dist/gates/llm.d.ts

@@ -65,7 +65,7 @@ export interface LlmRunResult {
     seatAuthoredBytes?: number;
 }
 export declare const PROMPT_GLYPHS: readonly ["➜", "❯", "$", "%", ">>", ">"];
-export declare function reviewSeatOutput(raw: string, nonce: string): string;
+export declare function reviewSeatOutput(raw: string, nonce: string, adapterBannerRows?: readonly string[]): string;
 export declare const REVIEW_FIRST_LIVENESS_MS = 30000;
 export declare function runHeadless(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, timeoutMs?: number): Promise<string>;
 export declare function runViaDriver(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via: LlmVia, timeoutMs?: number): Promise<string>;

package/dist/gates/llm.js

@@ -204,12 +204,14 @@ const IDENTITY_OPENERS = ["review ·", "tickmarkr"];
 // Stages of the preamble walk. Each complete harness row is accepted only at or after its stage.
 const ECHO = 0, START = 1, BANNER = 2, IDENTITY = 3, SEAT = 4;
 // The char offset where the seat's own text begins, or -1 when the capture ends inside the preamble.
-function seatStart(output) {
+function seatStart(output, adapterBannerRows) {
     const rows = output.split("\n");
     if (rows.length > 1 && rows[rows.length - 1] === "")
         rows.pop(); // the read's own line terminator
     let stage = ECHO;
     let bannerAt; // next banner row expected once the banner has begun
+    let adapterBannerAt;
+    let identitySeen = false;
     let offset = 0;
     for (let i = 0; i < rows.length; i++) {
         const row = rows[i].replace(/[ \t]+$/, "");
@@ -217,7 +219,7 @@ function seatStart(output) {
         const last = i === rows.length - 1;
         // Complete harness rows: equality against the shape the preamble allows at this stage.
         let accepted = false;
-        if (stage < SEAT && t.length === 0)
+        if (!identitySeen && stage < SEAT && t.length === 0)
             accepted = true; // blank rows between preamble rows
         else if (stage <= ECHO && completeEchoRow(row))
             accepted = true;
@@ -225,17 +227,27 @@ function seatStart(output) {
             stage = BANNER;
             accepted = true;
         }
-        else if (stage <= BANNER && bannerAt === undefined && BANNER_ROWS.includes(row)) {
+        else if (!identitySeen && stage <= BANNER && bannerAt === undefined && BANNER_ROWS.includes(row)) {
             stage = BANNER;
             bannerAt = BANNER_ROWS.indexOf(row) + 1;
             accepted = true;
         }
-        else if (stage <= BANNER && bannerAt !== undefined && row === BANNER_ROWS[bannerAt]) {
+        else if (!identitySeen && stage <= BANNER && bannerAt !== undefined && row === BANNER_ROWS[bannerAt]) {
             bannerAt++;
             accepted = true;
         }
-        else if (stage <= IDENTITY && IDENTITY_LINE.test(t)) {
-            stage = SEAT;
+        else if (stage <= IDENTITY && adapterBannerAt === undefined && adapterBannerRows.includes(row)) {
+            stage = BANNER;
+            adapterBannerAt = adapterBannerRows.indexOf(row) + 1;
+            accepted = true;
+        }
+        else if (stage <= IDENTITY && adapterBannerAt !== undefined && row === adapterBannerRows[adapterBannerAt]) {
+            adapterBannerAt++;
+            accepted = true;
+        }
+        else if (!identitySeen && stage <= IDENTITY && IDENTITY_LINE.test(t)) {
+            stage = IDENTITY;
+            identitySeen = true;
             accepted = true;
         }
         if (accepted) {
@@ -253,9 +265,16 @@ function seatStart(output) {
             ? BANNER_ROWS.some((b) => b.startsWith(row))
             : BANNER_ROWS[bannerAt]?.startsWith(row) === true))
             return -1;
+        if (stage <= IDENTITY && (adapterBannerAt === undefined
+            ? adapterBannerRows.some((b) => b.startsWith(row))
+            : adapterBannerRows[adapterBannerAt]?.startsWith(row) === true))
+            return -1;
         // The identity row is painted right after the banner, so its prefix is a partial paint only there;
         // with no banner in the capture, "review" or "tick" alone is the seat's own first row.
-        if (stage <= IDENTITY && bannerAt === BANNER_ROWS.length && IDENTITY_OPENERS.some((o) => o.startsWith(t)))
+        if (!identitySeen && stage <= IDENTITY
+            && (bannerAt === BANNER_ROWS.length
+                || (adapterBannerRows.length > 0 && adapterBannerAt === adapterBannerRows.length))
+            && IDENTITY_OPENERS.some((o) => o.startsWith(t)))
             return -1;
         return offset;
     }
@@ -266,9 +285,9 @@ function seatStart(output) {
 // Every capture taken before the preamble finishes therefore measures ZERO seat-authored bytes,
 // which is what makes the caller's running Math.max safe: a partial banner counted once would be
 // retained for the whole call and buy a silent seat its full ceiling.
-export function reviewSeatOutput(raw, nonce) {
+export function reviewSeatOutput(raw, nonce, adapterBannerRows = []) {
     const output = stripVTControlCharacters(raw).replace(/\r\n?/g, "\n");
-    const start = seatStart(output);
+    const start = seatStart(output, adapterBannerRows);
     if (start < 0)
         return "";
     const seat = output.slice(start);
@@ -287,7 +306,10 @@ async function runHeadlessDetailed(adapter, model, prompt, cwd, timeoutMs = 3000
         const pf = join(dir, "prompt.md");
         writeFileSync(pf, prompt);
         const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
-        return { output: r.stdout + "\n" + r.stderr, exitCode: r.code, timedOut: r.timedOut === true, seatAuthoredBytes: Buffer.byteLength((r.stdout + r.stderr).trim()) };
+        const output = r.stdout + "\n" + r.stderr;
+        const nonce = extractPromptNonce(prompt) ?? "";
+        return { output, exitCode: r.code, timedOut: r.timedOut === true,
+            seatAuthoredBytes: Buffer.byteLength(reviewSeatOutput(output, nonce, adapter.harnessBannerRows).trim()) };
     }
     finally {
         rmSync(dir, { recursive: true, force: true });
@@ -349,7 +371,7 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
             const startedAt = Date.now();
             out = await via.driver.read(slot, 400);
             const reviewing = prompt.startsWith("TICKMARKR-REVIEW");
-            seatAuthoredBytes = Buffer.byteLength(reviewSeatOutput(out, nonce));
+            seatAuthoredBytes = Buffer.byteLength(reviewSeatOutput(out, nonce, adapter.harnessBannerRows));
             let firstLivenessObserved = false;
             let priorSnapshot = normalizeStallSnapshot(out);
             const anchoredAt = Date.now();
@@ -365,7 +387,7 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
                 const matched = await via.driver.waitOutput(slot, exitPattern, sliceMs, { regex: true });
                 const raw = await via.driver.read(slot, 400);
                 out = raw;
-                seatAuthoredBytes = Math.max(seatAuthoredBytes, Buffer.byteLength(reviewSeatOutput(raw, nonce)));
+                seatAuthoredBytes = Math.max(seatAuthoredBytes, Buffer.byteLength(reviewSeatOutput(raw, nonce, adapter.harnessBannerRows)));
                 // waitOutput is the driver's authoritative marker match. The raw check covers drivers whose
                 // wait timed out at the same boundary the marker landed; either way a trailer completes
                 // normally and is never mistaken for inactivity.

package/dist/gates/review.d.ts

@@ -53,9 +53,53 @@ export declare function isDiffCapPark(result: GateResult): boolean;
 export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
 export { modelProvider };
+/**
+ * One function decides whether a reviewer's `resolved` or `reraised` id names a carried fingerprint,
+ * comparing both sides with every whitespace run removed (`s.replace(/\s+/g, "")`).
+ */
+export declare function matchClosureId(candidate: unknown, fingerprint: string): boolean;
+export declare function matchClosureId(candidate: unknown, fingerprints: Iterable<string>): string | undefined;
+/**
+ * Validates closure ids in a review verdict: membership, duplication, and coverage of every prior id
+ * all route through matchClosureId.
+ */
+export declare function isReviewClosureInvalid(v: Pick<ReviewVerdict, "resolved" | "reraised"> | null | undefined, priorIds: ReadonlySet<string> | readonly string[]): boolean;
+export type ReviewerFloorCause = "author-tier" | "task-floor" | "config" | "prior-reviewer";
+/**
+ * RF-1 (OBS-922 add.2/3): the tier a reviewer must meet is the maximum of the author's tier, the
+ * task-declared floor, a configured `review.floor` tier and, on a second round or a retry, the prior
+ * reviewer's tier. The cause names the input that reached the maximum (earlier inputs win a tie, so a
+ * floor the author's tier already satisfies is attributed to the author).
+ */
+export declare function resolveReviewerFloor(authorTier: Tier, taskFloor?: Tier, configFloor?: Tier, priorReviewerTier?: Tier): {
+    floor: Tier;
+    cause: ReviewerFloorCause;
+};
+/** A prior reviewer of THIS task: a channel key, or a journaled row's key plus the tier it was DISPATCHED at. */
+export type PriorReviewer = string | {
+    reviewer: string;
+    tier?: unknown;
+};
+/**
+ * The highest tier among the task's prior reviewers — the prior reviewer's tier for RF-1. A recorded
+ * dispatch tier is historical evidence and wins over the current pool; an unrecorded one falls back to
+ * the seat's channel; a seat neither establishes (it left the pool on resume, or the journal holds
+ * garbage) holds frontier — fail closed, never silently dropped.
+ */
+export declare function priorReviewerTier(channels: BillingChannel[], priorReviewers?: readonly PriorReviewer[]): Tier | undefined;
+/**
+ * The gate's floor: author tier, task floor, review.floor (a tier — `worker` names none) and the seats
+ * the caller names as THIS TASK's prior reviewers (earlier rounds' seats, a flaked seat). Eligibility
+ * exclusions are NOT evidence — a retry bans a flaked seat's whole adapter, and those sibling channels
+ * never reviewed — and neither is the run-scoped LRU rotation history, which names unrelated tasks' seats.
+ */
+export declare function gateReviewerFloor(task: Pick<Task, "routingHints">, cfg: TickmarkrConfig, author: Assignment, channels: BillingChannel[], priorReviewers?: readonly PriorReviewer[]): {
+    floor: Tier;
+    cause: ReviewerFloorCause;
+};
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[], // v1.1 failover: reviewer channels that already produced garbage for this task
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
-floor?: Tier, // task-declared only; config floors govern workers and must not silently move review seats
+floor?: Tier, // task/config/prior floor from the caller; the author's own tier is ALWAYS applied here (RF-1)
 history?: string[], // run-scoped picks, oldest to newest; empty preserves the established ranking
 onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>): BillingChannel | null;
 export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-started" | "truncated" | "silent";
@@ -65,4 +109,4 @@ export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-sta
  * judgement rather than a guarantee made by this renderer.
  */
 export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
-export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[], demotedReviewers?: ReadonlySet<string>, carriedFindings?: readonly StructuredFinding[]): Promise<GateResult>;
+export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[], demotedReviewers?: ReadonlySet<string>, carriedFindings?: readonly StructuredFinding[], priorReviewers?: readonly PriorReviewer[]): Promise<GateResult>;