tickmarkr 2.5.3 → 2.5.4

package/dist/run/daemon.js

@@ -31,8 +31,9 @@ import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferre
 import { isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
-import { nextChannel, route } from "../route/router.js";
+import { climbChannel, marginalCostRank, nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
+import { readTierLiveness, readWatchBoard, supervisionBeatPath } from "./supervision.js";
 import { harvestCpuFlatWindowMs, NUDGEABLE_ADAPTERS, PANE_READ_ROWS, StallProgressTracker, stallSnapshotBannerRows, WorkerTreeCpuAccountant, } from "./stall.js";
 // The live set is also the ownership claim shared by task cleanup and termination.
 export async function closeLiveSlot(liveSlots, driver, slot) {
@@ -1358,7 +1359,7 @@ export async function runDaemon(repoRoot, opts = {}) {
             return await runWithVerificationBudget(occupancyCapacity, async () => {
                 // v1.51 T4: every dispatch provenance line begins with the mode and its source; when a pin won
                 // the route (the final "→ " segment is a pin, not a degraded-to-auto tail) it names the mode it bypassed.
-                const dispatchProvenance = (p) => `mode ${rm.mode.mode} (${rm.source})${p.split("→ ").pop().startsWith("pin ") ? ` — pin bypasses mode ${rm.mode.mode}` : ""} · ${p}`;
+                const dispatchProvenance = (p) => `mode ${rm.mode.mode} (${rm.source})${p.split("→ ").pop().startsWith("pin ") && !p.includes("not re-tried") ? ` — pin bypasses mode ${rm.mode.mode}` : ""} · ${p}`;
                 // v1.87 T2: one pool per seat role, built once. `channels` stays the WORKER pool — every routing
                 // call below reads it exactly as before — while the judge, review and consult seats each receive
                 // the pool their own deny scope allows, so routing.deny.workers benches a channel for dispatch
@@ -1395,6 +1396,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             liveSlots.add(s);
                             return s;
                         } } : {}),
+                    ...(driver.retireLostWatch ? { retireLostWatch: driver.retireLostWatch.bind(driver) } : {}),
                     ...(driver.project ? { project: driver.project.bind(driver) } : {}),
                     ...(driver.reconcile ? { reconcile: driver.reconcile.bind(driver) } : {}),
                     notify: (m, o) => driver.notify(m, o),
@@ -1468,6 +1470,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const reviewHistory = journal.read()
                     .filter((event) => event.event === "gate-result" && event.data.gate === "review" && typeof event.data.reviewer === "string")
                     .map((event) => event.data.reviewer);
+                // RF-1 (OBS-922 add.3): the seats THIS task's review rows name — the prior reviewers a later round's
+                // floor holds. Task-scoped on purpose: reviewHistory rotates seats run-wide and is never floor evidence.
+                // Each row's journaled dispatch tier travels with it, so a seat that left the pool on resume still counts.
+                // Leg-2 T4 M2: a `review-no-verdict` note is dispatch evidence too — it lands BEFORE the in-gate retry's
+                // gate-result, so a daemon killed between the two leaves it as the task's only record of that seat.
+                const taskReviewers = (taskId) => journal.read()
+                    .filter((event) => event.taskId === taskId && typeof event.data.reviewer === "string"
+                    && ((event.event === "gate-result" && event.data.gate === "review") || event.event === "review-no-verdict"))
+                    .map((event) => ({ reviewer: event.data.reviewer, tier: event.data.reviewerTier }));
                 // Capture this before this observer appends run-resume. A prior run-end belongs to a completed
                 // lifecycle and must use the ordinary resume/redispatch rules; only an interrupted live attempt
                 // owns reusable measurements or unclean-death residue.
@@ -1499,19 +1510,99 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const commands = detectGateCommands(repoRoot, cfg);
                 const watchName = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
                 let watchSlot;
-                const openBoard = async () => {
+                let boardOpened = false; // WB-1: only a board this daemon placed is watched below
+                // Leg-2 T7 M1 (OBS-988): a reopen first retires the ghost through the driver's seam so the narrator
+                // launches a NEW pane; a driver that answers with the lost pane anyway (no seam, or a cache it
+                // would not drop) has not reopened anything, and that answer is a FAILED reopen, never a success.
+                const openBoard = async (ghost) => {
+                    try {
+                        if (ghost?.slot)
+                            await trackedDriver.retireLostWatch?.(ghost.slot);
+                        const slot = await trackedDriver.narrator(repoRoot, watchCommand(runId), runId);
+                        if (ghost && slot.id === ghost.pane) {
+                            liveSlots.delete(slot); // the ghost again: no close is ever aimed at it
+                            return { ok: false, error: `narrator answered with the lost pane ${ghost.pane}` };
+                        }
+                        watchSlot = slot;
+                        boardOpened = true;
+                        return { ok: true, slot };
+                    }
+                    catch (error) {
+                        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+                    }
+                };
+                const placeBoard = async () => {
                     if (!trackedDriver.narrator) {
                         noteCapabilityAbsent("narrator");
+                        return undefined;
+                    }
+                    const placed = await openBoard();
+                    if (placed.ok)
+                        return placed.slot;
+                    journal.append("watch-placement-failed", undefined, { error: placed.error });
+                    console.error(`tickmarkr: narrator not opened: ${placed.error}`);
+                    return undefined;
+                };
+                // WB-1 (OBS-988): the daemon watches its own cockpit. A board is lost when the watch tier's beat
+                // aged past the supervision stale bound, the recorded arm has no presence, or the owner pid is dead.
+                // The beat and presence checks wait for the UI to have armed (armId recorded) — a freshly reopened
+                // board that has not armed yet is not a second loss. Reopens are bounded per run; past the bound
+                // the loss is journaled `boardless` and the narrator is never called again.
+                // Leg-2 T7 M2: one `watch-board-lost` row per LOSS. A loss is identified by the pane and pid the
+                // owner record names; a reopen that fails leaves that record in place, so the next poll sees the
+                // same loss, journals only its own reopen attempt, and the bound retires the run boardless from the
+                // last failed attempt rather than from a repeated lost row.
+                const MAX_BOARD_REOPENS = 3;
+                let boardReopens = journal.read().filter((e) => e.event === "watch-board-reopened" || e.event === "watch-board-reopen-failed").length;
+                let boardless = false;
+                let journaledLoss;
+                const boardLoss = () => {
+                    const owner = readWatchBoard(repoRoot, runId);
+                    if (!owner)
+                        return undefined;
+                    const lost = { pane: owner.pane, ...(owner.pid !== undefined ? { pid: owner.pid } : {}) };
+                    if (owner.armId !== undefined) {
+                        const beat = readTierLiveness(repoRoot, "watch");
+                        if (beat.state === "STALE")
+                            return { ...lost, beatAgeMs: beat.beatAgeMs };
+                        // ponytail: presence path math mirrors supervision.ts's private helper (`<tier>.live.<armId>`)
+                        if (!existsSync(join(dirname(supervisionBeatPath(repoRoot, "watch")), `watch.live.${owner.armId}`)))
+                            return lost;
+                    }
+                    if (owner.pid !== undefined && !isPidLive(owner.pid))
+                        return lost;
+                    return undefined;
+                };
+                const watchBoard = async () => {
+                    if (!boardOpened || boardless || !trackedDriver.narrator)
+                        return;
+                    const loss = boardLoss();
+                    if (!loss) {
+                        journaledLoss = undefined;
                         return;
                     }
-                    try {
-                        watchSlot = await trackedDriver.narrator(repoRoot, watchCommand(runId), runId);
+                    const identity = `${loss.pane}:${loss.pid ?? ""}`;
+                    if (identity !== journaledLoss) {
+                        journaledLoss = identity;
+                        boardless = boardReopens >= MAX_BOARD_REOPENS;
+                        journal.append("watch-board-lost", undefined, { ...loss, ...(boardless ? { boardless: true } : {}) });
+                        if (boardless)
+                            return;
                     }
-                    catch (error) {
-                        const reason = error instanceof Error ? error.message : String(error);
-                        journal.append("watch-placement-failed", undefined, { error: reason });
-                        console.error(`tickmarkr: narrator not opened: ${reason}`);
+                    const attempt = ++boardReopens;
+                    // The ghost pane is gone: drop it from this run's live set so no close is ever aimed at it.
+                    const ghost = watchSlot;
+                    if (ghost)
+                        liveSlots.delete(ghost);
+                    watchSlot = undefined;
+                    const reopened = await openBoard({ slot: ghost, pane: loss.pane });
+                    if (reopened.ok) {
+                        journal.append("watch-board-reopened", undefined, { pane: readWatchBoard(repoRoot, runId)?.pane ?? reopened.slot.id, attempt });
+                        return;
                     }
+                    boardless = attempt >= MAX_BOARD_REOPENS;
+                    journal.append("watch-board-reopen-failed", undefined, { pane: loss.pane, attempt, error: reopened.error, ...(boardless ? { boardless: true } : {}) });
+                    console.error(`tickmarkr: board not reopened (attempt ${attempt}): ${reopened.error}`);
                 };
                 // OBS-829/OBS-854: one full-suite verdict round at a time in this run, and do not begin beside an
                 // externally live suite attributable to this repository. The process scan catches nested scratch
@@ -1632,12 +1723,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ...(replayedExclusions.size > 0 ? { excludedChannels: [...replayedExclusions].sort() } : {}),
                         ...(opts.retryFailed ? { retryFailed: true } : {}),
                     });
-                    await openBoard();
+                    await placeBoard();
                 }
                 else {
                     baseRef = await gitHead(repoRoot);
                     journal.append("baseline-start", undefined, { baseRef, commands, capacity: resolvedCapacity() });
-                    await openBoard();
+                    await placeBoard();
                     baselinePending = true;
                     // Workers can run beside capture, but no gate may observe an absent or partial baseline.
                     // Keep publication and warnings inside the same barrier as the suite's final verdict.
@@ -1773,15 +1864,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     ];
                     return `${identity} — release with ${commands.map((command) => `\`${command}\``).join(" or ")}`;
                 };
+                const namedPaths = (text) => [...text.matchAll(/(?:^|[\s`'"(])((?:[A-Za-z0-9_@.()[\]-]+\/)+[A-Za-z0-9_@.[\]-]+|[A-Za-z0-9_@-]+(?:\.[A-Za-z0-9_-]+)+)(?=$|[\s`'"),:;.!?])/g)]
+                    .map((match) => match[1].replace(/^\.\//, "").replace(/\.$/, ""))
+                    .filter((path) => !path.split("/").includes("..")
+                    && (/\.[A-Za-z][A-Za-z0-9_-]*$/.test(basename(path)) || existsSync(join(repoRoot, path))));
                 const park = async (t, reason, kind, assignment, attempts, startMs, gateFails = 0, consults = 0, tokens, metered = 0, retryMode = "fresh", details = {}) => {
                     // OBS-979: a worker refusal can identify the missing authoring scope even when gates
                     // subsequently supply the park's disposition. Keep that actionable path on the park itself.
                     const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
                     if (t.files.length > 0 && worker?.data.ok === false && typeof worker.data.summary === "string") {
                         const allowed = filesGlob(t.files);
-                        const paths = [...worker.data.summary.matchAll(/(?:^|[\s`'"(])((?:[A-Za-z0-9_@.()[\]-]+\/)+[A-Za-z0-9_@.[\]-]+|[A-Za-z0-9_@-]+(?:\.[A-Za-z0-9_-]+)+)(?=$|[\s`'"),:;.!?])/g)]
-                            .map((match) => match[1].replace(/^\.\//, "").replace(/\.$/, ""))
-                            .filter((path) => !path.split("/").includes("..") && !allowed(path));
+                        const paths = namedPaths(worker.data.summary).filter((path) => !allowed(path));
                         if (paths.length)
                             reason += ` — files[] repair hint: ${[...new Set(paths)].join(", ")}`;
                     }
@@ -1814,6 +1907,30 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const dispositionScopeRed = async (t, results, assignment, attempts, startMs, gateFails, consults, tokens, metered, retryMode) => {
                     const scopeRed = results.find((g) => g.gate === "scope" && gateFailed(g));
                     const verdict = scopeRed?.meta?.collateral;
+                    if (!verdict && t.files.length > 0) {
+                        const allowed = filesGlob(t.files);
+                        const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
+                        const refusal = worker?.data.ok === false && typeof worker.data.summary === "string"
+                            && /outside|out.of.scope|allowlist|scope expansion|not (?:in|own)|unowned/i.test(worker.data.summary)
+                            ? namedPaths(worker.data.summary).filter((path) => !allowed(path)) : [];
+                        const reds = results.filter(gateFailed);
+                        // A scope verdict already attributes actual out-of-scope EDITS using the collateral map.
+                        // Path-only diagnostics from the other gates name code that needs fixing, not an edit the
+                        // worker made. Do not replace the scope gate's stronger attribution with that inference.
+                        const paths = reds.filter((g) => g.gate !== "scope" || !g.meta?.collateral).flatMap((g) => namedPaths(g.details));
+                        if (refusal.length || (paths.length > 0 && paths.every((path) => !allowed(path)))) {
+                            journal.append("scope-authoring", t.id, {
+                                gate: refusal.length ? "worker" : reds[0]?.gate,
+                                paths: [...new Set(refusal.length ? refusal : paths)],
+                                repair: `files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}`,
+                                attempt: attempts + 1, chargeable: false, source: "diagnostic",
+                            });
+                            // OBS-547 (Leg-2 T3 material): unchargeable ⇒ metered 0, exactly as the predicted path below —
+                            // passing the physical count would write `meteredAttempts: 1` beside `attempts: 0`.
+                            await park(t, `authoring defect — files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}; current files[]: ${t.files.join(", ")}`, "authoring", assignment, attempts, startMs, gateFails, consults, tokens, 0, retryMode);
+                            return true;
+                        }
+                    }
                     if (!verdict)
                         return false;
                     if (verdict.authoring) {
@@ -1932,12 +2049,28 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // not re-tried first (consult bans / prior failovers survive the release).
                     const rs = resume.get(t.id);
                     const contentDigest = taskContentDigest(t);
-                    if (rs?.lastAssignment && rs.attempts > 0
+                    const previousDispatch = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "task-dispatch");
+                    const recordedGraphPath = join(journal.dir, "graph.json");
+                    const recordedTask = existsSync(recordedGraphPath)
+                        ? JSON.parse(readFileSync(recordedGraphPath, "utf8")).tasks.find((task) => task.id === t.id)
+                        : undefined;
+                    const previousHints = previousDispatch && "routingHints" in previousDispatch.data
+                        ? previousDispatch.data.routingHints : recordedTask?.routingHints;
+                    const hintsChanged = !!rs && (!!recordedTask || !!previousDispatch && "routingHints" in previousDispatch.data)
+                        && (JSON.stringify(previousHints?.pin) !== JSON.stringify(t.routingHints?.pin)
+                            || previousHints?.floor !== t.routingHints?.floor);
+                    if (hintsChanged)
+                        journal.append("restore-rerouted", t.id, {
+                            from: rs.lastAssignment ? channelKey(rs.lastAssignment) : rs.tried.at(-1) ?? null,
+                            to: channelKey(assignment),
+                            reason: JSON.stringify(previousHints?.pin) !== JSON.stringify(t.routingHints?.pin) ? "pin changed" : "floor changed",
+                        });
+                    if (!hintsChanged && rs?.lastAssignment && rs.attempts > 0
                         && channels.some((c) => channelKey(c) === channelKey(rs.lastAssignment))
                         && !demotedChannels.has(channelKey(rs.lastAssignment))) {
                         assignment = rs.lastAssignment; // restore the consult-chosen assignment (bypasses route()'s static re-pick)
                     }
-                    else if (rs && rs.tried.length) {
+                    else if (!hintsChanged && rs && rs.tried.length) {
                         // trailing-reroute edge (kill between verdict and dispatch), a stale fleet, OR a fresh-budget
                         // release (attempts 0 + non-empty tried): pick a failover over the replayed exclusions via the
                         // EXISTING nextChannel `tried` parameter — zero router changes (D-03).
@@ -1948,6 +2081,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // assignment and proceed. Dispatching on a previously-tried channel beats deadlocking a resumed
                         // run; a park-instead policy can come later if it ever bites.
                     }
+                    const taskHistory = journal.read().filter((e) => e.taskId === t.id);
+                    const lastApproval = taskHistory.map((e) => e.event).lastIndexOf("task-approved");
+                    const priorClimb = taskHistory.slice(lastApproval + 1).reverse().find((e) => e.event === "tier-escalated");
+                    if (!hintsChanged && priorClimb && taskHistory.indexOf(priorClimb) > taskHistory.map((e) => e.event).lastIndexOf("task-dispatch")) {
+                        const target = channels.find((c) => channelKey(c) === priorClimb.data.to && !demotedChannels.has(channelKey(c)));
+                        if (target)
+                            assignment = { adapter: target.adapter, model: target.model, channel: target.channel, tier: target.tier };
+                    }
                     // pre-kill invariant: tried always contains the current assignment. Spread, never alias the
                     // journal-derived array (no hidden mutation of replayed state).
                     const tried = rs?.tried.length ? [...rs.tried] : [channelKey(assignment)];
@@ -2070,7 +2211,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             ...(g.meta?.reapedGroup === true ? { reapedGroup: true } : {}),
                             ...(g.gate === "review" && typeof g.meta?.reviewer === "string" ? {
                                 reviewer: g.meta.reviewer,
-                                ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised"]
+                                ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised", "reviewerFloor", "reviewerFloorCause", "reviewerTier"]
                                     .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                                 ...(typeof g.meta.vendor === "string" ? { vendor: g.meta.vendor } : {}),
                                 ...(typeof g.meta.provider === "string" ? { provider: g.meta.provider } : {}),
@@ -2170,6 +2311,43 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ? `The operator UPHELD the reviewer's findings — address them without discarding landed work.\nreview: ${upheldFeedback}`
                         : "");
                     let ladderIdx = 0;
+                    const engagementRows = () => {
+                        const rows = journal.read().filter((e) => e.taskId === t.id);
+                        const approval = rows.map((e) => e.event).lastIndexOf("task-approved");
+                        return rows.slice(approval + 1);
+                    };
+                    let ownedGateFailures = engagementRows().filter((e) => e.event === "escalation" && e.data.workerAttributed === true).length;
+                    let climbProvenance = !hintsChanged && priorClimb
+                        ? `tier-escalated ${priorClimb.data.from} → ${priorClimb.data.to} (${priorClimb.data.cause})` : "";
+                    const climbSkips = new Set(!hintsChanged && priorClimb
+                        ? channels.filter((c) => c.tier === priorClimb.data.fromTier).map(channelKey) : []);
+                    const climb = async (cause, gate, attempt) => {
+                        if (cfg.routing.escalateTier === "off" || engagementRows().some((e) => e.event === "tier-escalated"))
+                            return;
+                        const pin = t.routingHints?.pin;
+                        if (pin) {
+                            await park(t, `pin ${pin.via}:${pin.model} held: ${cause}`, "gate-fail", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return "parked";
+                        }
+                        const next = climbChannel(assignment, t, cfg, channels, tried, profile, demotedChannels);
+                        if (!next?.climbed)
+                            return;
+                        const from = channelKey(assignment);
+                        const to = channelKey(next);
+                        const poolBefore = channels.filter((c) => !tried.includes(channelKey(c)) && !demotedChannels.has(channelKey(c))).map(channelKey);
+                        journal.append("tier-escalated", t.id, {
+                            attempt, cause, gate: gate.gate, fingerprint: normalizeGateFailure(gate.details).slice(0, 500),
+                            from, to, fromTier: assignment.tier, toTier: next.tier, poolBefore,
+                            costDelta: marginalCostRank(channels.find((c) => channelKey(c) === to)) - marginalCostRank(channels.find((c) => channelKey(c) === from)),
+                        });
+                        for (const c of channels)
+                            if (c.tier === assignment.tier && channelKey(c) !== to)
+                                climbSkips.add(channelKey(c));
+                        climbProvenance = `tier-escalated ${from} → ${to} (${cause})`;
+                        assignment = { adapter: next.adapter, model: next.model, channel: next.channel, tier: next.tier };
+                        tried.push(to);
+                        return "climbed";
+                    };
                     let modeFallbackNoted = false; // v1.2: journal the interactive→print fallback once per task, not per attempt
                     let gateFails = 0; // TEL-02: incremented ONLY where feedback is built from failing gates — never derived from attempts (quota failovers bump attempts too, Pitfall 6)
                     let consults = 0; // TEL-02: bumped in the runConsult wrapper so one counter covers all three trigger sites, across the attempt loop
@@ -2465,7 +2643,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     : undefined,
                                 excludeReviewers: badReviewers,
-                                reviewHistory, demotedReviewers,
+                                reviewHistory, demotedReviewers, priorReviewers: taskReviewers(t.id),
                                 onGate: async (e) => {
                                     if (e.phase === "start") {
                                         notePhaseStart(e);
@@ -2741,8 +2919,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
                         // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
                         journal.append("task-dispatch", t.id, {
-                            assignment, attempt, provenance: dispatchProvenance(r.provenance), retryMode,
-                            excludedChannels: [...demotedChannels].sort(),
+                            assignment, attempt, provenance: dispatchProvenance([
+                                channelKey(assignment) === channelKey(r.assignment) ? r.provenance
+                                    : t.routingHints?.pin ? `pin ${t.routingHints.pin.via}:${t.routingHints.pin.model} not re-tried` : "ladder assignment",
+                                `dispatch ${channelKey(assignment)}`, climbProvenance,
+                            ].filter(Boolean).join(" · ")), retryMode,
+                            routingHints: t.routingHints ?? {},
+                            excludedChannels: [...new Set([...demotedChannels, ...tried, ...climbSkips])]
+                                .filter((key) => key !== channelKey(assignment)).sort(),
+                            exclusionReasons: Object.fromEntries([...new Set([...demotedChannels, ...tried, ...climbSkips])]
+                                .filter((key) => key !== channelKey(assignment))
+                                .map((key) => [key, demotedChannels.has(key) ? "demoted" : tried.includes(key) ? "already tried" : "tier climb skipped"])),
                             ...(outstandingFindings.length > 0 ? { carriedFindings: outstandingFindings } : {}),
                             ...(carriedConsultGuidance ? { carriedConsultGuidance } : {}),
                         });
@@ -3896,6 +4083,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // (provider outage, quota banner, dead CLI) must still route; the harvest synthesis only
                         // decides whether THIS attempt's worktree goes to gates, and when routing wins instead, the
                         // commits survive via the existing commitsToCarry/cherryPickCommits carry-forward.
+                        if (workerFinished && !result.ok && await dispositionScopeRed(t, [], assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode))
+                            return;
                         const preHarvestResult = result;
                         // T2 (OBS-264): recognize committed no-trailer work BEFORE any no-trailer streak, provider,
                         // quota or dead-channel routing. Gates never trusted the trailer, so this successful synthesis
@@ -4208,7 +4397,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         }
                                         : undefined,
                                     excludeReviewers: badReviewers,
-                                    reviewHistory, demotedReviewers,
+                                    reviewHistory, demotedReviewers, priorReviewers: taskReviewers(t.id),
                                     onGate,
                                 })));
                             }
@@ -4300,6 +4489,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                             && !isDiffCapPark(reviewFail)
                             && results.every((g) => gateSatisfied(g) || g.gate === "review");
                         const failing = results.filter(gateFailed);
+                        const deterministic = failing.find(isDeterministicFailure);
+                        if (deterministic)
+                            ownedGateFailures++;
                         // Decided before the cap, because the cap's question is whether the NEXT move would re-buy a
                         // measurement already made — and a funded repair is one of the moves that would.
                         const landed = await commitsAheadOf(taskBase, wt);
@@ -4341,13 +4533,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 channel: channelKey(assignment), // the ban is bound to the channel that produced the repeat
                                 attempt: attempt + 1,
                             });
-                            await driver.notify(`tickmarkr ${runId}: ${t.id} ${repeated.gate} failed identically twice — consulting, identical retry banned`, { tier: "attention" });
+                            await driver.notify(`tickmarkr ${runId}: ${t.id} ${repeated.gate} failed identically twice — identical retry banned`, { tier: "attention" });
                             // The cap takes the ladder's MOVE, never its accounting: this failure still spends the rung it
                             // would have spent, so a task that cannot converge still reaches ladder exhaustion on exactly
                             // the budget it always had and the cap can never hand a stuck task extra rounds.
                             capStep = r.ladder[Math.min(ladderIdx++, r.ladder.length - 1)];
-                            journal.append("escalation", t.id, { step: capStep, attempt: attempt + 1, fingerprintCap: true });
+                            journal.append("escalation", t.id, { step: capStep, attempt: attempt + 1, fingerprintCap: true, workerAttributed: !!deterministic });
                             await driver.notify(`tickmarkr ${runId}: ${t.id} escalation: ${capStep}`, { tier: "attention" });
+                            const climbed = await climb("gate-fingerprint-cap", repeated, attempt + 1);
+                            if (climbed === "parked")
+                                return;
+                            if (climbed === "climbed")
+                                continue;
                             const v = await runConsult("gate-fail-repeat", output, feedback, results);
                             // Rule: a terminal cap consult vetoes a same-channel retry, but cannot veto an `escalate`
                             // rung that already satisfies retry-same-banned by changing channel. Thus terminal+retry
@@ -4397,12 +4594,21 @@ export async function runDaemon(repoRoot, opts = {}) {
                             : r.ladder[Math.min(ladderIdx++, r.ladder.length - 1)]);
                         if (!capStep) { // a capped failure already journaled and announced the rung it spent
                             journal.append("escalation", t.id, {
-                                step, attempt: attempt + 1,
+                                step, attempt: attempt + 1, workerAttributed: !!deterministic,
                                 ...(reviewFixRetry && !repairExhausted ? { reviewFix: true } : {}),
                                 ...(repair ? { repair: repairHistory.length + 1, repairCharge: repairsDrawn + 1 } : {}),
                             });
                             await driver.notify(`tickmarkr ${runId}: ${t.id} escalation: ${step}`, { tier: "attention" });
                         }
+                        const climbCause = repairExhausted ? "repair-exhausted"
+                            : deterministic && ownedGateFailures === 2 ? "gate-fail" : undefined;
+                        if (climbCause) {
+                            const climbed = await climb(climbCause, deterministic ?? failing[0], attempt + 1);
+                            if (climbed === "parked")
+                                return;
+                            if (climbed === "climbed")
+                                continue;
+                        }
                         if (step === "retry")
                             continue;
                         if (step === "escalate") {
@@ -4428,14 +4634,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const inflight = new Map();
                 // A settled worker can release a dependency or an approval in the same poll tick.
                 // Audit the current graph at every empty-flight boundary, never a prior ready snapshot.
-                const holdEndCondition = () => {
+                // WB-1 rider: `end-condition-held` names a CLOSE the daemon refused, so only a close attempt journals
+                // it — the post-race sweep still dispatches what it finds but says nothing.
+                const holdEndCondition = (closing = true) => {
                     sweepLiveApprovals();
                     const freeSlots = Math.max(0, concurrency - inflight.size);
                     const dispatchable = readyTasks(graph).filter((t) => !inflight.has(t.id));
                     if (freeSlots === 0 || dispatchable.length === 0)
                         return false;
-                    for (const task of dispatchable) {
-                        journal.append("end-condition-held", task.id, { deps: task.deps, freeSlots });
+                    if (closing) {
+                        for (const task of dispatchable) {
+                            journal.append("end-condition-held", task.id, { deps: task.deps, freeSlots });
+                        }
                     }
                     return true;
                 };
@@ -4446,6 +4656,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // must still stop the run before it can dispatch more work or write run-end.
                         if (termSignal)
                             throw new Error(`terminated by ${termSignal}`);
+                        await watchBoard();
                         sweepLiveApprovals();
                         const ready = readyTasks(graph)
                             .filter((t) => !inflight.has(t.id))
@@ -4500,12 +4711,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const waiters = [...inflight.values(), aborted];
                         // A free slot is itself a scheduling boundary: poll the append-only approval stream instead of
                         // sleeping until an unrelated long-running task settles.
-                        if (inflight.size < concurrency) {
+                        // An open board is polled on the same cadence, so a dead cockpit is noticed mid-task.
+                        if (inflight.size < concurrency || boardOpened) {
                             waiters.push(new Promise((wake) => setTimeout(wake, APPROVAL_POLL_MS)));
                         }
                         await Promise.race(waiters); // aborted rejects on termination — unwinds the run
                         if (inflight.size === 0)
-                            holdEndCondition();
+                            holdEndCondition(false);
                     }
                     // D-07: the sweep now closes only what's LEFT in keptSlots — done-closed worker slots were removed
                     // (no double-close) and self-cleaned LLM/consult panes were never added under keepLlm:false. This

package/dist/run/git.d.ts

@@ -179,3 +179,28 @@ export type BaseContainment = {
  */
 export declare function declaredBaseContainment(cwd: string, declaredRef: string, targetRef?: string): Promise<BaseContainment>;
 export declare function removeWorktree(repo: string, dir: string): Promise<void>;
+export declare const REFS_PREFLIGHT_PREFIX = "refs/tickmarkr/preflight";
+export declare const REFS_PROBE_REMEDY = "run from the main repository or a full clone; a sandbox that denies writes under that path cannot host a run";
+export interface RefsProbeOk {
+    ok: true;
+    path: string;
+    refsDir: string;
+}
+export interface RefsProbeRefusal {
+    ok: false;
+    path: string;
+    refsDir: string;
+    error: string;
+}
+export type RefsProbeResult = RefsProbeOk | RefsProbeRefusal;
+export declare function refsRefusalMessage(action: "run" | "resume", path: string, error: string): string;
+/**
+ * OBS-983/984: prove the repository's common git directory accepts a ref write before starting
+ * the daemon. In a linked worktree, git resolves refs to the main repository's git directory.
+ * Creates and deletes a real ref under refs/tickmarkr/preflight/ through git itself, leaving
+ * nothing behind on success.
+ */
+export declare function probeRefsWritable(cwd?: string): Promise<RefsProbeResult>;
+export declare const probeRefs: typeof probeRefsWritable;
+export declare const refsProbe: typeof probeRefsWritable;
+export declare function assertRefsWritable(cwd?: string, action?: "run" | "resume"): Promise<RefsProbeResult>;

package/dist/run/git.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { availableParallelism, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { StringDecoder } from "node:string_decoder";
@@ -565,3 +565,70 @@ export async function removeWorktree(repo, dir) {
     await shGit(`rm -rf ${shq(dir)}`, repo);
     await shGit("git worktree prune", repo);
 }
+export const REFS_PREFLIGHT_PREFIX = "refs/tickmarkr/preflight";
+export const REFS_PROBE_REMEDY = "run from the main repository or a full clone; a sandbox that denies writes under that path cannot host a run";
+export function refsRefusalMessage(action, path, error) {
+    return `refusing to ${action}: repository refs directory ${path} is not writable (${error}). `
+        + `Remedy: ${REFS_PROBE_REMEDY}.`;
+}
+/**
+ * OBS-983/984: prove the repository's common git directory accepts a ref write before starting
+ * the daemon. In a linked worktree, git resolves refs to the main repository's git directory.
+ * Creates and deletes a real ref under refs/tickmarkr/preflight/ through git itself, leaving
+ * nothing behind on success.
+ */
+export async function probeRefsWritable(cwd = process.cwd()) {
+    const refsPathRes = await shGit("git rev-parse --git-path refs", cwd);
+    if (refsPathRes.code !== 0) {
+        const error = (refsPathRes.stderr || refsPathRes.stdout).trim() || "git rev-parse --git-path refs failed";
+        return { ok: false, path: "", refsDir: "", error };
+    }
+    const raw = refsPathRes.stdout.trim();
+    let refsDir = resolve(cwd, raw);
+    try {
+        refsDir = realpathSync(refsDir);
+    }
+    catch {
+        // keep resolved path if realpath fails
+    }
+    const headRes = await shGit("git rev-parse HEAD", cwd);
+    const target = headRes.code === 0 && headRes.stdout.trim()
+        ? headRes.stdout.trim()
+        : "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+    const probeId = `probe-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    const ref = `${REFS_PREFLIGHT_PREFIX}/${probeId}`;
+    const createRes = await shGit(`git update-ref ${shq(ref)} ${shq(target)}`, cwd);
+    if (createRes.code !== 0) {
+        const error = (createRes.stderr || createRes.stdout).trim() || `git update-ref failed (${createRes.code})`;
+        return { ok: false, path: refsDir, refsDir, error };
+    }
+    const delRes = await shGit(`git update-ref -d ${shq(ref)}`, cwd);
+    if (delRes.code !== 0) {
+        const error = (delRes.stderr || delRes.stdout).trim() || `git update-ref -d failed (${delRes.code})`;
+        return { ok: false, path: refsDir, refsDir, error };
+    }
+    // Clean up empty directories left behind by git
+    try {
+        const preflightDir = join(refsDir, "tickmarkr", "preflight");
+        if (existsSync(preflightDir) && readdirSync(preflightDir).length === 0) {
+            rmSync(preflightDir, { recursive: true, force: true });
+        }
+        const tmDir = join(refsDir, "tickmarkr");
+        if (existsSync(tmDir) && readdirSync(tmDir).length === 0) {
+            rmSync(tmDir, { recursive: true, force: true });
+        }
+    }
+    catch {
+        // best-effort cleanup of empty dirs
+    }
+    return { ok: true, path: refsDir, refsDir };
+}
+export const probeRefs = probeRefsWritable;
+export const refsProbe = probeRefsWritable;
+export async function assertRefsWritable(cwd = process.cwd(), action = "run") {
+    const probe = await probeRefsWritable(cwd);
+    if (!probe.ok) {
+        throw new Error(refsRefusalMessage(action, probe.path, probe.error));
+    }
+    return probe;
+}

package/dist/tui/cockpit/live-runtime.js

@@ -467,18 +467,20 @@ export async function runConsolidatedCockpit(options) {
         const reader = createPointerReportReader();
         const stdin = new Proxy(input, { get(target, property) {
                 if (property === "read")
-                    return (...args) => {
+                    return () => {
                         try {
-                            const chunk = target.read(...args);
-                            if (chunk == null)
-                                return null;
-                            const result = reader(String(chunk));
                             let keys = "";
-                            for (const token of result.tokens) {
-                                if (token.type === "pointer")
-                                    pointer(token.report);
-                                else
-                                    keys += token.bytes;
+                            // OBS-965: drain until the stream itself says empty. A real tty (highWaterMark 0) stops its
+                            // handle after every chunk and only a read() that finds the buffer EMPTY restarts it; Ink's
+                            // loop stops at the first null, so returning null after ONE pointer-only chunk left that
+                            // empty read unmade and every later key queued in the kernel — the deaf board.
+                            for (let chunk = target.read(); chunk != null; chunk = target.read()) {
+                                for (const token of reader(String(chunk)).tokens) {
+                                    if (token.type === "pointer")
+                                        pointer(token.report);
+                                    else
+                                        keys += token.bytes;
+                                }
                             }
                             // A standalone Escape is unambiguous after Ink's own input grace.
                             if (reader.pending() === "\x1b")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.5.3",
+  "version": "2.5.4",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",